Judge Skeptical of Google’s Role Protecting Patient Health Data

A San Francisco federal judge appeared doubtful of green-lighting a proposed class action alleging Google LLC violated state and federal privacy laws by collecting sensitive health data through website tracking technology.

At a hearing Thursday, Judge Vince Chhabria said Google doesn’t appear to be the entity that has a responsibility to protect patient health information under the Health Insurance Portability and Accountability Act, but instead the health providers who use tools like Google Analytics on their websites.

Google appears to have a “pretty good” HIPAA disclaimer that says its Google Analytics tool doesn’t claim to satisfy the privacy requirements, he said.

“Google has flagged the issue for” the health provider websites, Chhabria said. “I’m just not sure what else Google is supposed to do.”

The plaintiffs, who are unnamed in the proceedings, filed the class action in the US District Court for the Northern District of California in 2023, alleging Google’s tracking technology collects a patient data when users access healthcare portals online.

The plaintiffs’ legal team conducted an investigation finding that Google’s source code was found on 91% of the 5,000 health provider websites they examined, according to their complaint.

Chhabria had previously dismissed the suit in July, but granted the plaintiffs one more opportunity to amend their complaint.

Lieff Cabraser Heimann & Bernstein LLP, Scott & Scott Attorneys at Law LLP, Lowey Dannenberg PC, and Simmons Hanly Conroy LLP represent plaintiffs. Willkie Farr & Gallagher LLP represents Google.

The case is Doe I v. Google LLC, N.D. Cal., No. 3:23-cv-02431, 12/19/24.