LifeStance Pays $3M and Bans Trackers for 5 Years

Almost every healthcare pixel settlement of the past three years ended the same way: a common fund, a pro rata split, a denial of wrongdoing, no obligation to behave differently afterwards. The LifeStance deal breaks the pattern with a commitment to discontinue every third party tracking tool that is not fully HIPAA compliant, for five years. That is a remedy, not a price.

Key Takeaways

• LifeStance Health Group has agreed to stop using every third party tracking tool other than fully HIPAA compliant ones for five years, per terms reported by HIPAA Journal.
• The LifeStance fund totals $3,027,874.44, split into subclasses of $1,203,405.00 and $1,824,469.44 covering March 1, 2020 to April 30, 2023.
• Banner Health's separate settlement pays $20 plus a one year CyEx Privacy Shield Pro membership to roughly 1,028,000 MyBanner portal users from June 1, 2020 to November 22, 2023.
• Judge Mark Pittman's June 2024 order vacating OCR tracking guidance reached only unauthenticated public webpages, so patient portals like MyBanner were never covered.
• A Health Affairs study of 3,747 nonfederal acute care hospitals found third party tracking on 98.6% of their websites, with Alphabet the most common recipient.

What Did Banner Health Agree To?

A $20 cash payment and a one year privacy monitoring membership for roughly 1,028,000 people, with no commitment about future tracking. McCulley, et al. v. Banner Health, in the District Court for Weld County, Colorado, covers anyone who logged into the MyBanner patient portal between June 1, 2020 and November 22, 2023. The complaint alleges pixels and analytics tools disclosed information to Meta Platforms and Google LLC.

The economics: $20 per class member, attorneys' fees and expenses up to $3,750,000 with administration costs included, and $2,500 service awards to each of eight class representatives. Claims close September 5, 2026; the fairness hearing is September 10. Banner Health denies any wrongdoing and liability.

What Banner does not agree to is anything about tomorrow. The class period ends in November 2023, and nothing in the settlement addresses the tracking stack running now. That silence is the norm, and it is why the sector keeps producing near identical cases — the weakness we flagged when hospital pixel settlements crossed $100 million in aggregate.

What Makes the LifeStance Deal Different?

The injunctive relief. Montana Strong, et al. v. LifeStance Health Group Incorporated, in the US District Court for the District of Arizona, establishes a $3,027,874.44 fund: $1,203,405.00 for online booking tool users and $1,824,469.44 for the broader patient population, over a class period of March 1, 2020 to April 30, 2023. Objections were due August 31, 2026, claims close September 29, 2026, and final approval is set for October 16, 2026.

Then comes the term that rarely appears: LifeStance has discontinued, or will discontinue, all third party tracking tools other than those fully compliant with the HIPAA Rules, for five years from the effective date. LifeStance denies all claims and contentions in the lawsuit — and has still bound itself operationally for half a decade.

Context makes five years look larger. Among five providers that settled pixel class actions earlier this cycle, the strongest injunctive term came from Penn Medicine, which stopped using the Meta Pixel and agreed to forgo analytics and advertising tools for at least two years. Emanate Health, Bayhealth, Mount Sinai Medical Center of Florida and Concord Hospital accepted no forward looking restrictions at all. LifeStance's commitment is two and a half times Penn Medicine's, on a fund a third the size.

Why Didn't the 2024 OCR Ruling Kill These Cases?

Because that ruling only touched unauthenticated public webpages, and both cases centre on logged in patients. In June 2024, US District Judge Mark Pittman vacated the portion of OCR's tracking guidance treating an IP address plus a visit to a public health condition page as protected health information, finding HHS had acted in clear excess of its authority. HHS dropped its appeal that August.

Much of the coverage read that as the end of pixel exposure for hospitals. It was not. As HIPAA Journal noted when the guidance was struck down, the ruling does not change OCR's position on authenticated pages such as patient portals. MyBanner is one. LifeStance's online booking tool sits on the same side of the line.

The 2024 win narrowed federal risk on marketing pages and left the portal alone — which is where plaintiffs' firms were already looking. State law covers the rest: wiretap theories under statutes like CIPA carry this fact pattern into courts that never needed OCR's view, as our roundup of pixel lawsuits brought as wiretapping claims traces.

How Common Is the Underlying Problem?

Near universal, by the only large scale measurement available. University of Pennsylvania researchers led by Ari Friedman and Matthew McCoy examined 3,747 nonfederal acute care hospital websites and found third party tracking on 98.6% of them, Alphabet by far the most common recipient. Published in Health Affairs, the study drew on 2021 data — the year both class periods here were already running.

Set that against settlement volume. Fewer than a hundred providers have settled publicly; roughly 3,700 had trackers running. That untested pool is why 2026 filings moved down market to community hospitals and specialty clinics — and Allina Health's $12.5 million agreement, reported this year, shows the ceiling has not dropped.

What This Means for Your Inbox

The LifeStance term does not say "web pixels." It says third party tracking tools — a category covering the open and click tracking wired into appointment reminders, billing notices and patient newsletters. Healthcare marketing platforms embed the same invisible one pixel images retail senders use, and the metadata returned (open time, IP derived location, device, mail client) is what these complaints call disclosure without consent.

An appointment reminder from a psychiatry practice, opened at 11pm on a home network, is not a neutral event. That link between sender identity and recipient behaviour is what makes a pixel valuable to a marketer and hazardous under a wiretap statute, which is why the same theory now targets ordinary commercial email in the California litigation over email pixels and CIPA.

Note the asymmetry. Whether a hospital strips the Meta Pixel from its portal is the hospital's call, made years after your data moved. What happens to the pixel in the email it sends you is decided in your own client, before the request leaves the device.

What Compliance Teams Should Do Now

Four moves, ordered by how fast they cut exposure:

• Inventory tags behind authentication first. The 2024 vacatur bought relief on public pages only. Portal, scheduling and bill pay flows carry the surviving risk — and they are the flows named in both settlements.
• Treat email as in scope. Open and click tracking in patient communications sits inside the same "third party tracking tools" phrasing a plaintiff will read expansively.
• Model the injunctive term, not just the fund. A five year operational restriction carries a budget line and a marketing cost. Boards briefed only on settlement dollars get the smaller number.
• Assume discovery may decide for you. Court ordered disclosures about what platforms received from health pixels are reshaping these cases, as in the prescription pixel discovery fight involving Google and Meta.

Looking Ahead

The Banner and LifeStance filings arrive in a market that has already priced cash settlements as a cost of doing business. Injunctive terms are different in kind: they survive the cheque clearing.

Watch whether LifeStance's five years becomes a benchmark plaintiffs' counsel ask for by default. If it does, the calculation shifts from what a settlement costs to what a tracking stack costs to keep — and the litigation starts changing behaviour rather than pricing it.