Methodist Hospitals Illegally Shared Patient Medical Data Without Consent

Why You Should Care

Your personal health data should remain strictly confidential when you log into a secure hospital portal to view medical records or communicate with doctors. Hospital networks systematically deployed hidden tracking software that diverted this private medical information to commercial tech entities without patient consent!!!!!!!!

• If you have used an online patient portal provided by a regional health system in Indiana or Illinois, your private medical browsing and health interactions may have been intercepted.
• Healthcare providers attempted to shield themselves from accountability by falsely claiming they operated as federal agents under government mandates, an argument federal courts flatly rejected.

TL;DR Summary

The Scheme: Intercepting Patient Portals

Hospital systems deployed commercial tracking tools inside private web portals designed for electronic health records (digital versions of patients’ paper charts). Rather than operating secure and isolated digital environments, these networks allowed tracking algorithms to harvest patient interactions.

• Patients accessed online portals to view medical information and communicate with providers as encouraged by federal Meaningful Use Program (a regulatory framework establishing objectives for electronic health record adoption) guidelines.
• Embedded software code automatically captured and transmitted user activities and health data to third-party technology platforms without authorization or disclosure! Not super great for people who want to remain relatively anonymous, I’m sure you’ll agree.

The Cover-Up: Hiding Behind Federal Authority

Faced with lawsuits in state courts, hospital networks attempted to manufacture a jurisdictional escape hatch. They argued that federal health technology incentive programs transformed private hospitals into federal instrumentalities.

• Defendants removed state-level consumer protection and wiretapping lawsuits to federal courts by claiming they were acting under direct orders from the Department of Health and Human Services.[cite: 3, 5]
• Federal appellate judges dismantled this defense, establishing that compliance with federal regulations and the collection of financial incentives amounts to standard industry regulation rather than delegation of a basic governmental task.[cite: 9, 10]

Legal Receipts: Judicial Findings

Federal appellate review firmly rejected the hospital systems’ attempts to evade accountability, ruling that private web development does not constitute governmental work.

• The Seventh Circuit Court of Appeals ruled: “When the health care providers construct and operate their patient portals, they are not doing the government’s business. The patient portals are private websites designed by private actors.”
• The court emphasized that “regulation does not turn a private entity into a public actor,” confirming that accepting federal electronic health record incentives does not delegate sovereign authority.

What Now? Action Steps for Patients

As these consolidated cases return to state courts for substantive proceedings, patients retain rights to challenge unlawful digital surveillance of confidential medical records.

• ■ Monitor class action developments regarding health data privacy lawsuits filed against regional hospital networks in Indiana and Illinois.
• ■ Review privacy settings and data-sharing permissions on any patient portals or health system applications you currently utilize.
• ■ Report unauthorized medical data disclosures to state regulatory authorities and consumer protection agencies.

Sources

• Court Ruling: United States Court of Appeals for the Seventh Circuit, Nos. 23-3159, 23-3175, 23-3363 & 23-3385, Brian Elkins et al. v. Southeastern Indiana Health Management Inc., decided October 20, 2026.
• Statutory Reference: Federal Officer Removal Statute, 28 U.S.C. Section 1442(a)(1).
• Statutory Reference: Health Information Technology for Economic and Clinical Health (HITECH) Act, Pub. L. No. 111-5, 123 Stat. 264.
• Federal Regulation: Medicare and Medicaid Programs; Electronic Health Record Incentive Program, 75 Fed. Reg. 44,314.