UPMC denies suit’s charges that sites share data with private firms

A UPMC web-based tool meant to help patients identify a doctor who fits their needs, along with other sites used by the Pittsburghbased health giant, may have routinely diverted patient names and medical records to private companies, according to a six-count civil lawsuit filed in the Allegheny County Common Pleas Court.

In a statement, UPMC said the allegations were baseless and that the health system would vigorously defend itself against the claims.

Philadelphia-based Shepherd, Finkelman, Miller &

Shah LLP and Simmons Hanly Conroy of New York City filed the lawsuit. Simmons Hanly was co-counsel in an almost identical lawsuit filed in June against Sutter Health, a large nonprofit health system in California. That lawsuit was dismissed in Sacramento Superior Court on Jan. 29 because the complaint did not allege that patients’ personal medical history, diagnosis or cancer was revealed.

Simmons Hanly officials did not return calls seeking comment.

Specifically, the two women who are the plaintiffs in the UPMC lawsuit, identified as Jane Doe I and Jane Doe II, allege that the health system’s Find a Doctor, MyUPMC patient portal, and other sites are embedded with tracing codes that can redirect the user’s personal information and the contents of communications to third parties.

Diversion of patient information is part of an advertising barter transaction between UPMC and third parties, according to the lawsuit, which claims breach of medical provider-patient confidentiality, unfair trade and business practices and identity theft.

The lawsuit alleges that patient inquiries to UPMC’s Find-A-Doctor website, for example, are redirected to at least 15 third parties — including Microsoft, Google and Facebook — for marketing purposes.

The suit, which is requesting class-action status, seeks “reasonable royalties” for the misappropriation of personally identifiable patient data, damages and legal fees as set by a jury.

UPMC denied the allegations. “UPMC rigorously protects the medical information our patients have entrusted to us and complies fully with all laws, rules and regulations governing such information,” according to the statement issued by the health system.