"[Blue Cross] encouraged patients to use the Web Properties to communicate their private information, acquire insurance, identify in-network healthcare providers based on the specific treatment or services they are interested in via the “Find a Doctor” search bar, access information about their insurance coverage, submit claims, pay bills, view records, and more," the class action said. "Despite this, [Blue Shield] purposely installed tracking technologies on its web properties and programmed them to surreptitiously share its patients’ private and protected communications."

Counsel for the plaintiff, Dean Sharp, Adam Polk, Simon Grille and Isabel Velez of Girard Sharp did not respond to a request for comment.

The class action claimed this violated the Health Insurance Portability and Accountability Act, the California Invasion of Privacy Act, the California Confidentiality of Medical Information Act, the Unfair Competition Act, and the Electronic Communications Privacy Act.

Blue Shield, in a press release on Wednesday, stated that between April 2021 and January 2024, Google Analytics shared "protected health information" with Google Ads. Blue Shield said this data might have been used for personalized ads.

"We want to reassure our members that no bad actor was involved, and to our knowledge, Google has not used the information for any purpose other than these ads or shared protected information with anyone," the press release said.

The insurance company also stated it "severed" its connection with Google Analytics and Google Ads in January 2024.

"Upon discovering the issue, Blue Shield immediately initiated a review of its websites and security protocols to ensure that no other analytics tracking software is impermissibly sharing members’ protected health information," the press release said.

Related: Change Healthcare sued by CareFirst BlueCross BlueShield over last year’s data breach

The lawsuits referred specifically to Google having tracking abilities on the Blue Shield website, but it did not rule out the possibility of other third parties having similar access.

Blue Shield also said the information shared included things like an insurance plan name, type or group number, addresses, gender, family size, medical claim service date, providers, patient name, financial responsibility data, and "Find a Doctor" search results. It claimed Social Security numbers, driver's license numbers and credit card or banking information was not disclosed.

While Blue Shield characterized this scenario discovered on Feb. 11 as a data breach, the lawsuits contested that characterization and referred to it as a data disclosure.

"[Blue Shield] voluntarily shared information with Google," the complaint claimed. "While characterized as a 'data breach,' no hacker or 'bad actor' obtained unauthorized access to [Blue Shield]'s web properties."

The class claimed its data and information was tracked and shared without its consent.

"Patients do not anticipate that their trusted healthcare and insurance provider will send their private information to social media and marketing companies for future exploitation and targeted marketing," the complaint said.

In response to the lawsuits, Blue Shield's senior manager of Media Relations, Mark Seelig, said the insurance company "does not comment on pending litigation."

"We understand receiving a notice such as this can create concern, and we regret that member personal information may have been shared without authorization," the press release said. "Blue Shield takes the security of member information very seriously, and we are committed to maintaining their privacy."