Penn Medicine has agreed to settle a class action lawsuit for up to $9.25 million over allegations that the University of Pennsylvania’s medical system secretly embedded tracking pixels in its myPennMedicine patient portal, which then transmitted sensitive health information and personal data to Meta Platforms and Google without patients’ knowledge or consent. The settlement resolves claims that the health system violated federal and state wiretapping laws by allowing these hidden tracking technologies to intercept and share confidential medical communications. Patients who accessed their medical records through the portal between January 2021 and January 2023 and lived in Pennsylvania are eligible to file claims for compensation.
The case, Mohr, et al. v. The Trustees of The University of Pennsylvania, highlights how major health systems may inadvertently—or intentionally—allow third-party tracking tools to operate on sensitive platforms without patient awareness. While Penn Medicine maintains that it is not currently using such tracking tools on its primary web pages and has agreed to restrictions on analytics and advertising technologies going forward, the settlement reflects the serious legal liability health systems face when patient data flows to advertisers and social media companies.
Official resource:
- File your claim or check eligibility for the Penn Medicine settlement — Official settlement website administered by Epiq where eligible class members can submit compensation claims, verify eligibility, and view claim deadlines and FAQs.
Table of Contents
- What Were the Tracking Pixels and How Did They Expose Patient Data?
- How Many Patients Are Eligible for This Settlement?
- How Much Money Will Eligible Claimants Actually Receive?
- What Is the Claims Process and When Is the Deadline?
- What Legal Claims Did This Settlement Resolve?
- What Are Penn Medicine’s Obligations Going Forward?
- When Will the Settlement Be Finalized?
What Were the Tracking Pixels and How Did They Expose Patient Data?
The lawsuit centers on hidden tracking pixels that were embedded in the myPennMedicine patient portal—the online system where patients view test results, medical histories, prescriptions, and communicate with their healthcare providers. These pixels are tiny, invisible code snippets that load when a user visits a webpage, and in this case, they allegedly transmitted information about patients’ activities on the portal to Meta Platforms (Facebook, Instagram) and Google LLC. The pixels captured not just visit patterns, but the content of medical communications and personal health information that patients believed would remain private between them and their doctors. Tracking pixels are standard tools in digital marketing that allow companies to monitor user behavior across the internet for advertising purposes. The problem in this case was that health information is protected under HIPAA and state privacy laws, and sharing it with advertisers—even in an anonymized or aggregated form—raises serious legal questions. Patients who accessed sensitive medical records, private messages with physicians, or filled out health questionnaires on the portal had no idea that Meta and Google were receiving signals about their activities.
For example, a patient checking their psychiatric medications or cancer treatment status had that portal visit tracked and reported to advertising networks. The allegations invoked Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (18 Pa. Cons. Stat. § 5701, et seq.) as well as the federal Electronic Communications Privacy Act (ECPA), both of which prohibit unauthorized interception of electronic communications. The distinction is important: this was not just a data breach where hackers stole information, but rather a legal claim that the health system itself allowed third parties to monitor communications in real time.
How Many Patients Are Eligible for This Settlement?
The settlement class includes approximately 756,723 individuals—a staggering number that reflects the scale of Penn Medicine’s patient base in Pennsylvania. To qualify, claimants must have accessed the myPennMedicine patient portal at any point between January 23, 2021, and January 23, 2023, and had a recorded Pennsylvania address on file at the time of access. This two-year window captures a period when tracking pixel technology was becoming more common on healthcare websites, and before many health systems implemented stricter privacy controls.
The size of the class means that even though the total settlement fund is substantial, the money available per individual claimant is limited. With roughly 756,000 eligible patients and a $9.25 million total, the per-person recovery is reduced to an estimated $15 per claimant—assuming all eligible individuals file claims and no money is reserved for attorneys’ fees or administrative costs. In practice, many class members never file claims, which would increase the per-person payout, but also reduces the overall impact of the settlement. The Pennsylvania residency requirement is notable because it may exclude patients who lived out of state but used the portal while traveling or temporarily relocated, even if their medical care was at Penn Medicine facilities.
How Much Money Will Eligible Claimants Actually Receive?
Eligible class members are entitled to an estimated cash payment of up to $15 per person, distributed on a pro-rata basis from the $9.25 million settlement fund. The “pro-rata” structure means that payments are divided based on the actual number of valid claims filed, so if fewer than expected patients submit claims, remaining claimants receive a proportionally larger share. If 600,000 patients claim instead of 756,000, each payment would rise above $15. Conversely, the higher the claim filing rate, the lower each individual payment becomes.
This compensation is modest compared to the potential damages alleged in the case and reflects the reality of class action settlements, where individual recovery is often limited by the total fund available and the size of the class. For comparison, settlements involving data breaches affecting smaller populations or involving more severe privacy harms have sometimes yielded $100 to $500 per claimant. The $15 figure here may also not account for the ongoing harm of having health information shared with advertisers, which some legal experts argue should command higher compensation. However, claimants have no choice but to accept this amount if they wish to participate; opting out of the settlement would require filing an individual lawsuit, a costly and uncertain alternative for most patients.
What Is the Claims Process and When Is the Deadline?
All claimants must submit their claim forms by September 16, 2026, either online or by postmark. This means patients have a defined window to take action—missing this deadline forfeits compensation entirely. Claims can be filed through the official settlement website, UPHSPixelSettlement.com, or by mail to the settlement administrator. The process is designed to be straightforward for most claimants, requiring basic identifying information and confirmation of portal access during the eligible period.
The settlement administrator, Epiq, is handling all claim processing, payment distribution, and customer service. Claimants who have questions can call the toll-free helpline at 1-877-327-7567 or write to UPHS Pixel Settlement, P.O. Box 4536, Portland, OR 97208-4536. The fact that an external administrator handles this (rather than Penn Medicine directly) reduces perceived conflicts of interest and speeds processing. However, claimants should be prepared to provide proof of Pennsylvania residency during the settlement period and may be asked for additional documentation if their eligibility is unclear.
What Legal Claims Did This Settlement Resolve?
The litigation was based on two main legal theories. First, plaintiffs alleged violations of Pennsylvania’s Wiretapping and Electronic Surveillance Control Act, which prohibits anyone from intentionally intercepting, or attempting to intercept, any oral or electronic communication. The statute is strict: it does not require that the interception be malicious or that the interceptor intend to harm the victim, only that the interception occur without authorization. Second, the complaint invoked the federal Electronic Communications Privacy Act (ECPA), which provides similar protections against unauthorized interception of electronic communications traveling over wires or through the internet.
The distinction between these claims matters for understanding what Penn Medicine’s conduct allegedly violated. Under Pennsylvania law, the health system could face liability even if it believed the tracking was harmless or beneficial for fraud detection, because the law prohibits unauthorized monitoring regardless of intent. The ECPA claims add a federal layer, making the litigation more complex but also creating stronger incentives for Penn Medicine to settle rather than litigate to trial. One significant limitation of this settlement is that it does not establish that Penn Medicine intentionally misused the tracking data; the settlement is structured as a “no admission of wrongdoing,” meaning Penn Medicine paid to resolve the lawsuit without conceding that it violated the law.
What Are Penn Medicine’s Obligations Going Forward?
While settling the litigation, Penn Medicine maintains that it is not currently utilizing tracking tools on its primary web pages. However, the settlement imposes restrictions on Penn Medicine’s future use of analytics and advertising technologies. These restrictions are meant to prevent similar tracking from occurring on patient portals and other sensitive health platforms in the future.
The specific terms of these ongoing obligations are detailed in the settlement agreement and will be monitored by the court and a settlement administrator. The fact that Penn Medicine denies current wrongdoing while agreeing to restrictions creates an interesting legal posture. Essentially, the health system is saying, “We’re not doing this now, and we agree not to do it in the future,” which neither proves nor disproves what happened in the past. For patients, this means Penn Medicine has committed to operational changes, but there is no court order requiring Penn Medicine to conduct a full privacy audit or to compensate patients for any harms beyond the $9.25 million fund.
When Will the Settlement Be Finalized?
The court has scheduled a final approval hearing for November 12, 2026, at 2:00 p.m. EST, to be conducted via Zoom. During this hearing, the judge will determine whether to approve the settlement as fair, reasonable, and adequate under class action law.
This is a procedural milestone, not a guarantee that the settlement will be approved, though final approval is granted in the vast majority of class action settlements where no major objections emerge. If approved, payments to claimants can begin shortly thereafter, usually within 60 to 90 days. Claimants do not need to attend the hearing or take any action related to it; the court approval process is handled by the parties’ attorneys and the settlement administrator.
- —