Cigna Group headquarters in Bloomfield, Connecticut. Credit: JHVEPhoto/Adobe Stock
A California resident is suing three subsidiaries of Cigna and other parties in a state court in Sacramento, California, over allegations that the company's use of website tracking tools violated her privacy.
The plaintiff, Myriah Avalos, is seeking to represent a class that would consist of all California residents who entered personal medical information into Cigna's website before January 2015.
Recommended For You
The plaintiff says Cigna's use of traffic trackers from entities such as Meta, Pinterest, Snapchat and The Trade Desk violated the California Confidentiality of Medical Information Act and other state data privacy laws.
The plaintiff is not accusing Cigna of making a special effort to share web users' data with other entity.
The plaintiff is asserting that simply letting a user's medical information, such as descriptions of symptoms, flow into the trackers without getting a user's permissions violates California law.
The trackers in place on Cigna's website before January 2025 "covertly tracked, intercepted and recorded the class's mouse movements, clicks, keystrokes (such as text entered into a search box or information box), web addresses (i.e., "URLs") of individual pages visited, and/or other electronic communications in real time," according to the Avalos complaint.
The information "was not aggregated or deidentified, nor were the trackers prohibited from using this information for their own benefit," the plaintiff told the court.
The suit does not distinguish between people who had individual health coverage from Cigna, people enrolled in employer health plans insured or administered by Cigna, or people with no coverage insured or administered by Cigna.
Related: Key California lawmaker calls for tight health privacy rules for AI patient data collection
The plaintiff will need to go through the discovery process to know how many people belong to the class, according to the complaint.
In addition to citing the medical information confidentiality act, the plaintiff also cites the California Consumer Privacy Act, the California Invasion of Privacy Act and general California competition and business laws.
The backdrop: California's Confidentiality of Medical Information Act imposes a penalty of up to $1,000 per ordinary violation per individual, or actual damages, and up to $2,500 per negligent disclosure of medical information.
Other health coverage providers affected by recent suits based at least in part on California's medical information confidentiality act include the SAG-AFTRA health plan, which covers entertainment industry workers and their relatives, and Blue Shield of California.
Law firm perspectives: Attorneys at WilmerHale reported in 2023 that California health information privacy suits are part of large waves of web-tracking suits filed in California.
Many suits are filed in California because of the state's wiretapping and anti-hacking laws, the attorneys wrote.
Data privacy attorneys at Ogletree Deakins noted in a 2024 analysis of California privacy laws that the medical information confidentiality act supplements the federal Health Insurance Portability and Accountability Act health information privacy standards.
"No breach of confidentiality takes place until an unauthorized person views the medical information," the attorneys wrote. "It is the medical information, not the physical record (whether in electronic, paper, or other form), that is the focus of the act."
© Touchpoint Markets, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more inforrmation visit Asset & Logo Licensing.
Allison Bell
Allison Bell, a senior reporter at ThinkAdvisor and BenefitsPRO, previously was an associate editor at National Underwriter Life & Health. She has a bachelor's degree in economics from Washington University in St. Louis and a master's degree in journalism from the Medill School of Journalism at Northwestern University. She can be reached through X at @Think_Allison.
