Doe et al v. Veradigm, Inc.
Summary
This July 6, 2026 memorandum opinion from the U.S. District Court for the Northern District of Illinois denied Veradigm's motion to dismiss a putative class action alleging that Veradigm disclosed patients' protected health information to Google via tracking tools on patient portals. The court found the operative complaint plausibly alleged disclosure of PHI and adequately pleaded claims under the ECPA and related state-law theories; the court did not decide the merits of those claims.
Litigation Status
Procedural Posture
Plaintiffs filed a second amended complaint alleging disclosure of PHI via Google tracking tools on Veradigm patient portals; defendant moved to dismiss (Dkt. 44); the court issued a Memorandum Opinion and Order denying the motion to dismiss (filed July 6, 2026).
Reported Holding
The district court denied Defendant Veradigm's motion to dismiss the second amended complaint, concluding that plaintiffs plausibly alleged that Veradigm disclosed protected health information (PHI) via Google tracking tools on its patient portals and that plaintiffs stated a claim under the Electronic Communications Privacy Act and related state-law claims.
What the Court Decided
The court denied the defendant's motion to dismiss, finding plaintiffs adequately alleged disclosure of PHI through Google digital marketing/tracking tools on Veradigm-hosted patient portals and that the operative complaint sufficiently pleaded claims under the ECPA, Illinois common-law negligence, and the California Invasion of Privacy Act (as to the California subclass).
What the Court Did Not Decide
The court did not resolve the merits of the underlying allegations, determine liability on the claims, decide class certification, or enter final judgment; it decided only the defendant's Rule 12(b)(6) motion to dismiss.
Significance
Generally viewed as plaintiff-favorable. Characterizations of significance describe how the matter has generally been discussed in tracked public sources; individual holdings are often narrow, procedural, or fact-specific, and this page does not state or imply broader holdings than the sources support.
What This Page Does and Does Not Say
This page reports what our tracked public sources say about this matter — including, where identified, the procedural posture (for example, a ruling on a motion to dismiss is not a final merits decision). It does not report legal conclusions beyond those sources, does not predict outcomes, and does not constitute legal advice.
Technologies at Issue
- Google Analytics
- Google tracking tools
- first-party cookies
- patient portals
Third parties named or identified in tracked sources: Veradigm (defendant), Google (third-party tracking vendor referenced).
Statutes Invoked
- 18 U.S.C. § 2511 (Electronic Communications Privacy Act)
Claims Asserted
- Electronic Communications Privacy Act (18 U.S.C. § 2511)
- Illinois common-law negligence
- California Invasion of Privacy Act (CIPA)
What This Matter May Mean for Website Operators
For operators using similar technologies, the recurring factual questions in matters like this one are what page URLs and query strings analytics tools share with third parties. Our scanner tests these behaviors empirically.
Because this matter is pending, anything reported here is procedural — allegations and interim rulings, not final determinations.
Detection of a similar technology on a website is an informational risk indicator, not a legal conclusion, and nothing in this section is legal advice.
Related Intelligence
Sources
About This Page
Publisher: Inspection-Ready Institute, Inc. (DBA Crandall Consulting), an independent website compliance and risk consultancy. We are not a law firm and nothing on this page is legal advice.
How this content is produced: Facts are extracted from publicly available sources — court and government materials, recognized legal press, professional analysis, and industry reports — by our litigation intelligence engine, stored with full source provenance, and rendered from the database. Risk guidelines are computed by a deterministic formula, never by an AI model directly. See the full methodology.
Limitations: Counts labeled "Tracked" reflect matters identified in our source set and are not official court statistics. We report what courts decided and did not decide; we do not predict outcomes.
Corrections: If you believe anything on this page is inaccurate, contact us via the contact page and we will review the underlying sources promptly.
Is Your Website Creating Hidden Tracking Risk?
Scan your site for third-party tracking and potential wiretap exposure. Free, no account required.
Scan My Website