Kroger target of class-action lawsuits claiming it shared customers' health care data

Kroger Co. is the target of two class-action lawsuits filed by online pharmacy customers accusing it of improperly sharing health information.

The lawsuits against downtown Cincinnati-based Kroger (NYSE: KR), the nation’s largest operator of traditional supermarkets, were filed Nov. 10 and Nov. 13 in U.S. District Court in Cincinnati. They seek unspecified damages totaling more than $5 million.

The plaintiffs, known only as Jane Doe in the court filing, claim Kroger released health information to Facebook parent Meta and others without the patients’ knowledge or consent, according to the lawsuits. They claim Kroger did this by installing tracking tools on its website that enabled health care information patients entered on the website so they could get prescriptions filled to be shared with Meta and others.

That information was not anonymous and was personally identifiable, the lawsuits state. The data revealed medications and details about health care the patients sought. Customers didn’t know their information was being tracked and shared, according to the filings.

“(The) defendant has essentially planted a bug on patients’ web browsers that forced them (to) disclose private and confidential communications to third parties,” the plaintiff said in the Nov. 10 lawsuit. “Kroger’s utilization of the tracking tools to secretly track and share with third parties its users’ communications on its website is the electronic equivalent of looking over the shoulder of each visitor for the entire duration of their website interaction.”

Kroger officials couldn’t be reached for comment.

The Jane Doe plaintiff in one case is from Hamilton County while the plaintiff in the other case lives in Ohio's Franklin County, the lawsuits said.

The tracking tools on Kroger’s website, according to the court filings, automatically send Meta data on information customers have supplied to the website. It also tracks and shares their activity on the website. Meta could then use the information to target ads to specific Facebook users.

This sharing of information violates Health Insurance Portability and Accountability Act (HIPAA) laws and breaks Kroger customers’ expectation that their health care information is to remain confidential, the lawsuits said.

The class of plaintiffs includes any customers who used Kroger’s website or app and as a result had their private information disclosed to third parties.

The plaintiff seeks an amount to be determined by the court to cover actual and punitive damages and to stop Kroger from sharing the data. Each lawsuit said the total amount of damages being sought exceeds $5 million.

Grocery and retail giant Costco also was targeted by a similar lawsuit in October. That case, which claims Costco shared medical information with Meta, is still pending.

Kroger, Cincinnati's largest public company, is in the midst of trying to get federal regulatory approval for its planned $24.6 billion acquisition of Boise, Idaho-based Albertsons Cos. Inc., the nation’s second-largest operator of traditional supermarkets. The companies have nearly 5,000 stores combined. They have agreed to sell 413 stores and as many as 650 to resolve antitrust issues in overlapping markets such as Denver, Los Angeles, Phoenix and Seattle.

Kroger expects the deal to close in the first quarter next year.