UCHealth sued for allegedly sharing patient data with Facebook
University of Colorado Health is the latest health system to face a lawsuit over alleged data-sharing with third-party tech companies, in this case Facebook.
Last week, a patient of UC Health filed a complaint with a Colorado court, alleging the academic hospital group used tracking cookies on its website that sent protected, personal information on patients to Meta, the parent company of the social media platform.
In his lawsuit, Patrick Miller said he is seeking class-action status, certain that he isn’t the only possible victim of this unique form of data privacy invasion. For now, he is the only plaintiff until a court grants that request and more individuals sign on as class members.
Despite Meta’s tools allegedly running in the background on UC Health’s website, Meta is not named as a defendant alongside the health system.
The issue in focus here is the use of these common tracking codes, which capture data on users that includes IP addresses, browser information, and text inputted into forms, in order to serve up custom ads as users browse the web.
In this case, the tracking tech was allegedly active on the “Find a Doctor” portion of the UCHealth website, as well as the patient portal—two places where personal details on treatments and diagnoses could be captured by technology companies like Meta, Google, Amazon, and Microsoft, where it is then combined with other data that can possibly identify who a patient is.
The lawsuit takes issue with this code being used in these areas of the site—if that claim is found to be true—with Miller arguing it's an invasion of his legally protected right to privacy in healthcare matters.
Further, the lawsuit accuses UCHealth of being reckless in deploying tracking tools for personal gain.
“The purpose and result of defendant’s use of the tracking Pixel was marketing and profits,” the lawsuit reads.
In a statement, UCHealth denied claims made in the lawsuit, adding that patient privacy is a top priority.
“We disagree with the plaintiffs’ argument and plan to defend ourselves if this issue moves forward,” a spokesperson with the health system said.
The lawsuit has yet to be heard by a judge.
A common complaint
In the last year alone, similar complaints of protected health information being leaked to big tech advertisers have made headlines here at HealthExec. The stories all share the common theme of tracking tools used on the websites of healthcare entities inevitably gathering personal data.
In December 2025, Managed care group Kaiser Permanente agreed to pay $46 million to resolve a lawsuit over its sharing of personal data and protected health information on 13.4 million patients via the use of tracking code.
In March 2026, a breast cancer patient in Vermont filed a complaint against Swiss pharmaceutical giant Novartis, alleging the company shared personal health information with Google.
Similarly, in July, Atrium Health agreed to pay $1.8 million to resolve a class action lawsuit that alleged it shared sensitive patient data with Google and Facebook.
In each case, the defendants deny any intentional wrongdoing.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.