Gary M. Klinger Named Interim Co-Lead Counsel in Cerebral Class Action
by Brian Eckert
Milberg’s Gary M. Klinger has been appointed by a California federal judge to represent on an interim basis a proposed class of plaintiffs suing mental health platform Cerebral, Inc. over privacy violations.
Plaintiffs say Cerebral has been secretly sharing their private information, including protected health information, with tech giants. The case joins a growing list of telehealth company lawsuits alleging violations of patient data privacy and security.
Cerebral Admits to HIPAA Privacy Breach
Earlier this year Cerebral, a remote telehealth company that provides online treatment for mental health conditions such as ADHD, anxiety, bipolar, depression, and substance abuse, informed more than 3 million users that it shared protected health information through invisible ad trackers.
Cerebral said in a January 2023 privacy breach notice it “determined that it had disclosed certain information that may be regulated as protected health information (“PHI”) under HIPAA to certain Third-Party Platforms and some Subcontractors without having obtained HIPAA-required assurances.”
Out of an abundance of caution, we are providing free credit monitoring and encourage individuals to remain vigilant against incidents of identity theft and fraud and review their account statements.
Cerebral admitted in the notice that it had been using tracking technologies from Google, Meta, TikTok, and other third parties since 2019. In the process, users’ names, phone numbers, emails, dates of birth, IP addresses, client ID numbers, and insurance information may have been disclosed.
Also potentially disclosed to third parties was user data gathered through online mental health self-assessment tests used to book counseling appointments and other services. The actual information disclosed varies for each individual based on what was entered on the Cerebral platform, the company said.
A posting on the U.S. Department of Health and Human Services breach portal indicates that 3,179,835 people had their information exposed.
Cerebral, which calls itself a “a mental health telemedicine company that is democratizing access to high-quality mental health care for all,” has reportedly removed the offending trackers to prevent further disclosures and disabled third party data sharing to comply with HIPAA requirements.
Cerebral Class Action Lawsuits Consolidated
Cerebral’s admission that it shared users’ sensitive information with third parties was met with several class action lawsuits.
Milberg filed a class action complaint on March 10, 2023 that was later consolidated with several other similar lawsuits. The lawsuits cite violations of federal and California state law, including HIPPA and the California Invasion of Privacy Act, a statute that provides damages of $5,000 per violation, or triple damages, for loss of privacy. Under the HIPAA Privacy Rule, covered entities are prohibited from selling PHI for marketing purposes without obtaining a patient’s permission.
During his time as [Cerebral]’s patient, Plaintiff never consented to the use of his Private Information by third parties or to Defendant enabling third parties, including Facebook, Google, TikToK, and others to access or interpret such information.
According to Milberg’s complaint, plaintiff Barak Federman shared personal information with Cerebral that was “intercepted, viewed, analyzed, and used” by companies like Facebook, Google, and TikTok for targeted advertising purposes. Federman “reasonably expected that his communications with Cerebral through its website were “confidential, solely between himself and Defendant” and that Cerebral “willfully facilitated these interceptions” without his knowledge, consent, or express written authorization.
The lawsuits are among the latest actions aimed at curbing telehealth company data abuses. The FTC in February fined drug app Good Rx $1.5 million for sharing sensitive patient information with companies like Google and Facebook. FTC also recently announced a $7.8 million settlement with online counseling company BetterHelp for sharing customers’ health data with advertisers.
U.S. Senators have called on telehealth companies to protect their patients’ sensitive health data. Senators Amy Klobuchar and Susan Collins sent a letter to Cerebral expressing their concerns about the company’s information sharing practices. The letter notes that, in 2020 and 2021, Cerebral had more than 200,000 users.
Judge Appoints Klinger To Leadership Role
The judge overseeing the consolidated Cerebral class action lawsuits in U.S. District Court for the Central Division of California (IN RE: CEREBRAL, INC. PRIVACY PRACTICES) appointed Gary M. Klinger as Interim Class Counsel for all plaintiffs.
An order filed with the court on May 15, 2023 states that, in this role, Mr. Klinger is responsible for coordinating the work of preparing and presenting plaintiffs’ claims, supervising the efforts of plaintiffs’ counsel to ensure appropriate pretrial preparation, directing document filings, appearing at court hearings, facilitating communications between plaintiffs and defendant, and conducting settlement negotiations.
Mr. Klinger has settled more than thirty class actions involving privacy violations as lead or co-lead counsel and won hundreds of millions of dollars for his clients. Since 1965, Milberg attorneys have filed thousands of class action lawsuits and recovered billions of dollars.
