The Federal Trade Commission, joined by Utah and California, by and through Los Angeles County Counsel, today sued Hims & Hers alleging that the telehealth provider shared consumers’ sensitive health information about medical conditions with third-party advertising platforms despite claiming its services maintain consumers’ privacy and deceives users about its billing and cancellation practices. In...

By Amanda Seitz, Maia Rosenfeld, and Darius Tahir Jul 27, 2026 A tiny federal agency tasked with protecting the public from injuries caused by lawn mowers and coffeemakers is demanding that some of the nation’s biggest health systems turn over detailed, personally identifiable medical records of all patients who seek help at their emergency rooms....

Emery Glover reports: Iowa is now among 42 states that have reached a settlement with the genetics and biotech company, 23andMe. A lawsuit against 23andMe was filed in 2023 after a massive data breach that impacted nearly 7 million people, according to the Iowa Attorney General’s office. The breach reportedly exposed customers’ genetic ancestry information, personal information...

Steve Alder writes: Memorial Healthcare Services, a nonprofit healthcare provider serving patients in Southern California, has agreed to settle a class action lawsuit over its use of pixels and other tracking, web analytics, and advertising technologies on its website. The tools are alleged to have been added to the website without the knowledge or consent...

Christopher Brown reports: Health-technology provider Veradigm Inc. must face a proposed class action alleging it shared patients’ health information with Google LLC without consent in violation of state and federal privacy law. The plaintiffs plausibly alleged that Veradigm disclosed their personal health information, and adequately pleaded claims under the Electronic Communications Privacy Act, the California Invasion of...

Mikeie Honda Reiland reports: A suite of recent class action lawsuits in state and federal courts seeks to hold large healthcare corporations accountable for exposing or leaking patients’ personally identifiable information (PII) and protected health information (PHI). On June 11 in Davidson County Circuit Court, three Jane Does filed suit against CareNow, which operates more...

Christopher Brown reports: Healthline Media LLP must face two claims of a proposed class action alleging it shared consumers’ health information with TikTok Inc. and Microsoft Corp. without consent in violation of the California Invasion of Privacy Act. Lead plaintiff Daniel Gliksman established that he had standing to sue in federal court, and adequately pleaded...

Michael J. Madderra, Sydney Reed Swanson, and Roshni Edalur of Morgan Lewis write: AI is increasingly being used to support diagnostics, medical imaging, and remote patient monitoring. While these tools can improve efficiency and expand access to care, they also raise important questions about privacy, transparency, bias, patient consent, and responsibility for clinical decisions. Key...

Libbie Canter, Elizabeth Brim, and Clare Mathias of Covington and Burling write: In what continues to be a busy year for genetic privacy developments, Rhode Island has joined the growing number of states regulating direct-to-consumer (“DTC”) genetic testing with its recently enacted genetic privacy law, S 2203. With S 2203, Rhode Island is the fifth...

Lauren Rankin writes: New York had the chance to make history in more arenas than basketball this June. Earlier this month, the New York Senate passed the Maternal Health, Dignity and Consent Act, becoming the first legislative chamber in the country to pass legislation that would require informed consent for drug testing of pregnant people. But despite that...

James Mann and David Saunders of McDermott Will & Schulte write: Readers may recall that last year, New York attempted to enact a health privacy law that was ultimately vetoed by the governor. Now, New York is back with another attempt that, after some modification from last year’s version, stands a chance of being signed by Governor Kathy Hochul. Like...

Russell Myers reports: A hospital worker at the private clinic where the Princess of Wales had abdominal surgery is set to face a criminal prosecution following an investigation into claims that the Princess’ medical records had allegedly been accessed by staff in 2024, it is understood. A total of three trusted employees, who worked at The...

Margaret Attridge reports: The Nevada Supreme Court granted a victory to reproductive health advocates and abortion providers Thursday, blocking enforcement of a 1985 state law restricting abortion for minors. Reversing a lower court’s denial of a preliminary injunction, an en banc panel of justices ruled Nevada Senate Bill 510 — passed in 1985, never enforced and...

Naomi Diaz reports: The American Hospital Association and Illinois Health and Hospital Association are urging the 7th U.S. Circuit Court of Appeals to reverse a lower court ruling in a website-tracking lawsuit against Evanston, Ill.-based Endeavor Health, formerly known as Edward-Elmhurst Health. In a May 27 amicus brief, the hospital groups said they support Endeavor Health and...

Dark patterns force patients to share their data with big healthcare networks, even when the privacy form they’re signing explicitly says they can opt-out. By: Alex Rosenblat When Paula Stannard, one of the federal government’s top healthcare privacy officials, visited her eye doctor this year, she was asked to sign a form, acknowledging she’d received...

Steve Alder reports: Tempus AI, a publicly traded healthcare artificial intelligence company, is facing multiple class action lawsuits over the alleged unauthorized collection and disclosure of genetic testing results, which were derived from genetic testing by Ambry Genetics Corporation (Ambry Genetics). Tempus AI used Ambry Genetics’ genetic database to train its AI models. Tempus AI...

Margaret Attridge reports: A federal judge Thursday indicated he would grant preliminary approval to a proposed $56 million class action settlement over a lawsuit that accused period tracking app Flo of sharing users’ highly sensitive information with third parties, including Google. “I have to get rid of this thing. No one has gotten paid. This...

There seem to be more news stories about data protection out of Kenya recently. This one appeared on CapitalFM: The Office of the Data Protection Commissioner (ODPC) has found St Luke’s Orthopaedic and Trauma Hospital liable for unlawfully disclosing a patient’s sensitive medical information and ordered it to pay Sh525,000 in compensation. In a ruling...

Cyrus Farivar reports: Several Californians sued Sutter Health and MemorialCare this week over allegations that an AI transcription tool was used to record them without their consent, in violation of state and federal law. The proposed class-action lawsuit, filed on Wednesday in federal court in San Francisco, states that, within the past six months, the plaintiffs received...