A Fifth Circuit pixel tracking ruling and what counts as individually identifiable health information

Stop and consider: When was the last time you read the definition of individually identifiable health information (IIHI) as defined under the Health Insurance Portability and Accountability Act of 1996 (HIPAA)? Protected health information (PHI) is a subset of IIHI. As part of my practice, I review and think about the definition regularly.

Recently, the Fifth Circuit panel in Rachelle Rand, et al. v. Eyemart Express, LLC, Case No. 25-10784, Dkt. 72-1 (5th Cir. Oct. 23, 2026), considered the meaning and the scope of IIHI as part of a class action case involving allegations of federal and state wiretapping, breach of contract, and the tort of intrusion upon seclusion.

While HIPAA does not expressly provide a private cause of action for patients seeking to address wrongful disclosure of information (see Acara v. Banks, 470 F.3d 569, 570-71 (5th Cir. 2006) (alleging that the disclosure of PHI during a deposition without consent did not allow a private cause of action), HIPAA is often successfully used as the basis of a breach of contract claim (Aspen Am. Ins. Co. v. Blackbaud, Inc., 2023 WL 3737050 (N.D. Ind. May 31, 2023) (permitting a state-law breach of contract claim brought by a multistate health system of providers against a service provider), negligence claim (Bryne v. Avery Center for Obstetrics and Gynecology, P.C., 327 Conn. 540, 572, 175 A.3d 1 (2018) (resulting in a recovery of $853,000 in damages in connection with plaintiff’s physician’s practice’s 2005 release of medical records in response to a non-HIPAA compliant subpoena), and/or in a Wiretap Act claim (Rand).

First, how does HIPAA apply? The plaintiffs alleged that Eyemart Express, LLC (Eyemart) disclosed without the patient’s knowledge or consent, IIHI to Meta Platforms, Inc. (Meta) through the use of “pixels,” internet software tracking tools that collect and share information across websites.

Second, how is IIHI defined? HIPAA (45 CFR 160.103) defines IIHI as follows:

“Information that is a subset of health information, including demographic information collected from an individual, and:

1. Is created or received by a healthcare provider, health plan, employer, or healthcare clearinghouse; and
2. Relates to the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; or the past, present, or future payment for the provision of healthcare to an individual; and
3. That identifies the individual; or
4. With respect to which there is a reasonable basis to believe the information can be used to identify the individual.”

Third, how is PHI defined? PHI is a type of IIHI and means that with certain exceptions such as education records, it is IIHI that is “(i) [t]ransmitted by electronic media; (ii) [m]aintained in electronic media; or (iii) [t]ransmitted or maintained in any other form or medium.”

Equally as important are the eighteen (18) individual identifiers that can be used to identify an individual, which include everything from names and address to device identifiers and serial numbers to biometrics, and web universal resource locators (URLs). 45 CFR § 164.514(b)(2)(i).

In conclusion, the Fifth Circuit overturned the District Court’s case dismissal for the following reasons: (1) “IIHI is not so narrow that it applies only to specific prescription information”; (2) “the district court made several inferences about the figure’s contents in the light most favorable to Eyemart, rather than to Plaintiffs, making them impermissible at this stage”; and (3) “according to the Amended Complaint, the Pixel (and therefore Meta) received data about the vision products Plaintiffs viewed, their prescription eyewear purchases, their appointment details, and other IIHI.” (Opinion, pp. 16-18). The Fifth Circuit agreed that the Plaintiffs have standing to bring the case; however, they reversed the lower court’s dismissal that IIHI was not shared with either directly Eyemart or indirectly with Meta. Thus, further illustrating that HIPAA can be utilized in breach of contract, negligence, and/or wire tapping cases.

Rachel V. Rose, J.D., MBA, advises clients on compliance, transactions, government administrative actions and litigation involving health care, cybersecurity, corporate and securities law, as well as False Claims Act and Dodd-Frank whistleblower cases. She also teaches bioethics at Baylor College of Medicine in Houston. Rose can be reached through her website, www.rvrose.com.