A new class action targets Oregon Clinic, the physician-owned practice with about 50 locations around Portland, over the analytics and advertising code on oregonclinic.com. Anyone who used the site to look up a specialist or reach the patient portal could fall within the proposed class — the complaint says those searches were copied to Google and Meta as they happened.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. Oregon Clinic has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
A proposed class action accuses Oregon Clinic, P.C. of relaying its patients' website activity to Google and Meta through tracking code embedded on oregonclinic.com. The complaint, R.G. v. Oregon Clinic, P.C. (Case No. 3:26-cv-01666, U.S. District Court for the District of Oregon, Portland Division), was filed on August 10, 2026 by a Portland patient proceeding under her initials, on behalf of a proposed nationwide class and an alternative Oregon class.Oregon Clinic is a physician-owned medical practice with roughly 50 locations across the Portland metropolitan area, and it is a HIPAA-covered entity. According to the complaint, the analytics and advertising scripts on its website — Google Analytics, Google Tag Manager, Google's DoubleClick ad platform and the Meta Pixel — caused each patient's browser to duplicate what the patient was doing on the site and send that copy to the tracking company at the same moment. Oregon Clinic has not yet responded to the complaint, and the allegations are unproven.
What the Complaint Says the Trackers Sent
The most detailed allegation in the complaint concerns the site's "Find a Doctor" search. A patient looking for care picks a specialty, a location and, if they want, a preferred physician gender, then selects a doctor from the results. The complaint says that each of those selections was copied to Google as the patient made it, and it reproduces network traffic that it says shows a single transmission carrying the specialty searched (obstetrics and gynecology, in the example), the physician's name, the gender filter and the identity of the site the patient was on.Riding along with that data, according to the complaint, were the identifiers that make it personal. The complaint points to the Oregon Clinic Google Analytics property ID, the cid value that Google Analytics uses to recognize a returning browser, the first-party _ga cookie, DoubleClick's IDE and DSID cookies, and Meta's c_user and fr cookies — the first of which, the complaint says, corresponds to a Facebook profile ID. The complaint alleges that combination let Google and Meta connect the medical search to a specific account holder rather than an anonymous visitor, and that the _ga cookie reached Google even for visitors whose browsers were set to block third-party cookies, because it is served as a first-party cookie.
Beyond the doctor search, the complaint alleges the same tracking captured other things patients did on the site: searching locations, going to pay a bill, and navigating to the MyChart patient portal. It also alleges the site presented no cookie banner, so visitors were never offered a chance to accept or decline third-party cookies before they were set.
Why the Complaint Says a Doctor Search Is Health Information
Oregon Clinic's site is largely public — a visitor does not have to log in to search for a specialist — and the complaint spends considerable space arguing that the disclosures were regulated anyway. It leans on federal guidance, including a 2022 bulletin from the U.S. Department of Health and Human Services and a follow-up letter HHS sent jointly with the Federal Trade Commission in 2023, which told healthcare providers that tracking technology on unauthenticated pages can still touch protected health information. HHS's position, as the complaint frames it, is that information tying an identifiable person to a covered provider is protected precisely because it signals that the person is seeking or receiving care there.The complaint also alleges that Google does not sign the business associate agreement HIPAA requires before a vendor can handle protected health information for a covered entity, quoting Google's own analytics documentation telling covered entities not to use the product for any purpose involving protected health information. On that basis it alleges Oregon Clinic had neither a business associate agreement nor the written patient authorization HIPAA requires for marketing disclosures. HIPAA has no private right of action, so the complaint uses it as a standard of care rather than a cause of action.
Who Is Covered by the Proposed Class?
The complaint proposes a nationwide class of all individuals residing in the United States who are or were patients of Oregon Clinic or any of its affiliates and who used the Oregon Clinic website in conjunction with their medical care. In the alternative, it proposes an Oregon class defined the same way but limited to Oregon residents.Excluded are Oregon Clinic itself, its officers, directors, affiliates and successors, and the judge assigned to the case. The complaint estimates the class runs to hundreds of thousands of people and says members are identifiable from Oregon Clinic's own records. No class has been certified yet, so the definitions and eligibility could change as the case proceeds — or the case could be dismissed.
The Legal Claims
The complaint pleads six counts: breach of fiduciary duty and confidentiality, violation of the federal Electronic Communications Privacy Act, negligence, invasion of privacy by intrusion upon seclusion, breach of implied contract, and unjust enrichment.The wiretap count is the one that carries fixed statutory damages. The plaintiff alleges Oregon Clinic intentionally intercepted, disclosed and used patients' electronic communications, and that it did so for the purpose of committing an unlawful act — pointing to HIPAA, Oregon's protected health information statutes at ORS 192.553 and following, Oregon's computer crime statute at ORS 164.377, the state's interception statute at ORS 165.540, and the physician-patient privilege at ORS 40.235. Under the ECPA the complaint seeks the greater of $100 per day of violation or $10,000, plus punitive damages and attorney fees.
The remaining counts seek actual, consequential and nominal damages, disgorgement of what Oregon Clinic allegedly gained in cheaper and better-targeted advertising, and an injunction stopping further disclosures. All of it is tied to unproven allegations; no court has found Oregon Clinic liable, and no money has been awarded.
Is There a Settlement or Claim Form?
No. This is a freshly filed lawsuit, not a settlement.• There is no settlement fund.
• There is no claim form.
• There is no payout and no deadline to act.
For any money to be distributed, the case would first have to survive the motions Oregon Clinic is expected to file, then win class certification, and then either settle or prevail — a process that can take years and may not succeed. Healthcare tracking cases of this shape have produced settlements before, including the Duke MyChart patient portal settlement and the Duly Health tracking-pixel settlement, but each case turns on its own facts. If a class is ever certified here and a settlement or judgment results, a formal process with its own eligibility rules and deadlines would be announced.
Frequently Asked Questions
Is there an Oregon Clinic settlement or claim form?
No. This is a newly filed class action complaint, not a settlement. There is no settlement fund, no claim form, and no payout. Oregon Clinic has not been found liable, no class has been certified, and there is nothing to claim at this time.
What does the Oregon Clinic website tracking lawsuit allege?
The complaint alleges that Google Analytics, Google Tag Manager, DoubleClick and the Meta Pixel embedded on oregonclinic.com duplicated patients' website activity and sent it to Google and Meta. The example described in the complaint is the "Find a Doctor" search: the specialty selected, the physician chosen, the location and the preferred physician gender, transmitted alongside cookie identifiers that the complaint says let Google tie the activity to a specific account holder. The complaint also alleges that clicks toward the MyChart portal, bill payment and location searches were relayed the same way. These are unproven allegations.
Who could be covered by the proposed class?
The complaint proposes a nationwide class of people in the United States who are or were patients of Oregon Clinic or its affiliates and who used the Oregon Clinic website in connection with their medical care, with an alternative Oregon-only class. No class has been certified, so the definitions could change as the case proceeds — or the case could be dismissed.
What laws does the Oregon Clinic lawsuit invoke?
The complaint pleads six counts: breach of fiduciary duty and confidentiality, violation of the federal Electronic Communications Privacy Act, negligence, invasion of privacy by intrusion upon seclusion, breach of implied contract, and unjust enrichment. It also points to HIPAA and to Oregon statutes covering protected health information, computer crime, interception of communications, and the physician-patient privilege as the standards Oregon Clinic allegedly fell short of. HIPAA itself carries no private right of action.
What should Oregon Clinic patients do now?
There is nothing to claim right now because there is no settlement. Patients who used oregonclinic.com can follow the case for updates. If a class is ever certified and a settlement or judgment results, a formal process with its own eligibility rules and deadlines would be announced. This page is informational and is not legal advice.
Sources
• Class Action Complaint, R.G. v. Oregon Clinic, P.C., No. 3:26-cv-01666 (D. Or., filed August 10, 2026).• Electronic Communications Privacy Act, 18 U.S.C. § 2510 et seq.
• Oregon Revised Statutes §§ 192.553–192.581 (protected health information), § 164.377 (computer crime), § 165.540 (interception of communications), § 40.235 (physician-patient privilege).
• U.S. Department of Health and Human Services, "Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates" (bulletin, as revised).
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
