Healthcare Data Breaches Spark Wave of Class Action Lawsuits in Tennessee A series of class action lawsuits in state and federal courts are targeting major healthcare corporations for exposing patients’ personally identifiable information (PII) and protected health information (PHI). On June 11, three plaintiffs filed a lawsuit in Davidson County Circuit Court against CareNow, an urgent care provider with over 20 locations in Middle Tennessee and a subsidiary of HCA Healthcare, the nation’s largest for-profit hospital operator. The complaint alleges that CareNow secretly shared patient data with Google and third-party marketing firms via tracking technologies embedded in its online appointment platform. The plaintiffs claim this violated HIPAA laws, allowing advertisers to link patients’ health data with their Google accounts for targeted advertising. The lawsuit details that patients were repeatedly prompted to complete CAPTCHAs until they accepted first-party cookies, enabling Google to track and transmit their data including appointment details, physician names, treatment requests, and IP addresses without consent. The complaint argues that CareNow knowingly profited from these disclosures, exposing patients to risks such as workplace discrimination and insurance denial. HCA Healthcare has denied the allegations, stating it will vigorously defend its position. Separately, 12 class action lawsuits were filed in June in the U.S. District Court for the Middle District of Tennessee against XSolis, a Franklin-based healthcare AI company. The suits stem from a January 20 breach in which hackers accessed 1.4 million patients’ PII and PHI, including medical records and Social Security numbers. Plaintiffs allege XSolis failed to encrypt or redact sensitive data, leading to a preventable breach that heightens risks of identity theft and financial fraud. XSolis’ Dragonfly platform, which uses AI to evaluate patient care needs, was reportedly compromised in the attack. Both cases highlight growing legal scrutiny over healthcare data security and the consequences of unauthorized data sharing.