Mount Sinai Medical Center of Florida, a not-for-profit teaching hospital in Miami Beach, has agreed to a proposed $220,000 settlement in Boggiano v. Mount Sinai Medical Center of Florida, Case No. CACE-26-006904-09, filed April 27, 2026 in Broward County Circuit Court. The court-authorized notice describes a disclosure of protected health information and confidential communications "to third-parties via tracking, analytics, and/or advertising technologies on the Website and Patient Portal," covering everyone who accessed either between June 10, 2021 and September 18, 2025 — a class period of 1,561 days. Preliminary approval came June 12, 2026. The final approval hearing is October 13, 2026, and the hospital has not admitted wrongdoing.
The claim was not brought under HIPAA. HIPAA has no private right of action. It was brought under Florida's Security of Communications Act, a 1969 wiretap statute, and that is the part that generalizes past healthcare.
Why a wiretap statute reaches a web page
Section 934.10 gives any person whose electronic communication is intercepted a civil action for "liquidated damages computed at the rate of $100 a day for each day of violation or $1,000, whichever is higher," plus punitive damages and attorney fees. Per person.
Florida courts spent years rejecting this theory. In Jacome v. Spirit Airlines (Fla. Cir. Ct. 2021), a state court held that session-replay technology did not capture the "contents" of a communication, and federal courts followed. That changed on March 6, 2025, when the Middle District of Florida declined to dismiss an FSCA claim in W.W. v. Orlando Health, No. 6:24-cv-1068 — finding, per Sidley's summary of the ruling, that pixel tracking was different because it allegedly transmitted content revealing a "substantive message" about the plaintiff's health concerns.
The court drew a legal line on a technical distinction, and the technical distinction is right. Session replay captures interaction events: clicks, movements, keystrokes. An analytics or advertising tag captures page identity. It runs as first-party JavaScript inside your document, so it reads document.location.href and document.title directly and ships them as request parameters — dl and dt in a Google Analytics 4 collect call. It never touches the DOM, and calling it a "pixel" understates what it has access to.
On a marketing site that transmits /services/cardiology. On a portal it transmits whatever your router put in the path.
The practice: inventory outbound requests from authenticated routes, then constrain them
The obvious cheap fix does not work. Referrer-Policy is irrelevant here, because browsers already default to strict-origin-when-cross-origin and the URL is not leaving in the Referer header. It is leaving in a request body assembled by a script running in your page.
The control that matches the failure is a Content Security Policy scoped to authenticated routes, deployed in report-only mode first:
Content-Security-Policy-Report-Only:
default-src 'self';
script-src 'self' https://cdn.example.com;
connect-src 'self' https://analytics.example.com;
img-src 'self' data:;
report-uri /csp-report
Report-only blocks nothing. What it produces is a continuously updated inventory of every third-party origin your logged-in pages contact — including tags added next quarter by someone who has never met you. That is the actual problem. A tag manager exists so that shipping a tag does not require a deploy, a code review, or a change ticket; nothing in the pipeline that watches code ever sees it. It is the same shape as PLCs reachable through cellular modems that never entered the network inventory: the asset arrived by a route that bypassed the process which would have found it.
Two costs, both real. Report-only generates a large volume of reports in week one and somebody has to triage them into an allowlist; budget a day. And the first time you flip a route to enforcing, something breaks — usually a marketing tag whose owner will escalate, because tightening connect-src also breaks conversion attribution. Sequence it: report-only across the whole site, enforce on authenticated routes only, leave the marketing pages permissive.
If you cannot ship CSP this quarter, two things still help. Keep identifiers and clinical or account context out of URL paths and query strings on authenticated routes — put them in POST bodies or behind opaque IDs — which shrinks what any script can read. And make publish rights in the tag manager a reviewed list with a named owner, since that list is the actual deploy permission for this code.
What to check this week
- Open your own portal in a clean browser profile, filter the network panel to third-party origins, and read the full request URLs. What is in the parameters?
- Which of those origins can you name an owner and a business reason for?
- Who currently holds publish rights in your tag manager, and when was that list last reviewed?
- Do your authenticated URLs contain anything that would be sensitive on its own, without a body?
- If someone asked which URLs were transmitted to third parties over the last four years, could you answer? Most teams cannot, for the same reason six days of database access looked like an eight-hour outage — the record was never being kept.
The settlement notice defines a class period, not a proven interval during which any specific technology was running; as of August 19, 2026, nothing public establishes what was deployed when. The exposure it describes does not depend on those details, and neither does the check.
North InfoSec runs AI-assisted penetration testing and security assessments, including review of client-side and third-party code paths. northinfosec.com