Thriveworks, a national mental health services company, has agreed to a $1.9 million class action settlement resolving claims that it shared patients' private portal communications with unauthorized third parties [1]. The settlement was announced June 2, 2026, and class members may be eligible for cash payments from the fund [1].
The lawsuit centers on allegations that Thriveworks transmitted sensitive patient communications, made through its online portal, to outside parties without patients' knowledge or consent [1]. Mental health patients occupy a heightened category under state and federal privacy frameworks, including the Health Insurance Portability and Accountability Act, which imposes strict limits on the disclosure of protected health information. Patient portal messages, which often contain clinical details and treatment discussions, fall squarely within those protections. The claims against Thriveworks follow a broader pattern of litigation targeting telehealth providers over the use of third-party tracking technologies, pixels, and data-sharing integrations embedded in patient-facing platforms.
The settlement's announcement does not indicate a judicial finding of liability. Class members have not yet received formal notice of claim deadlines or distribution amounts, which will depend on the number of valid claims submitted against the $1.9 million fund [1]. The case is proceeding in federal jurisdiction, consistent with the class action framework under Rule 23 of the Federal Rules of Civil Procedure, though a court has not yet issued final approval [1].
The resolution signals continued litigation exposure for behavioral and mental health platforms that rely on third-party vendor integrations for analytics, advertising, or operational functions. Federal regulators, including the Federal Trade Commission and the Department of Health and Human Services Office for Civil Rights, have both issued guidance and taken enforcement actions against companies that share patient data through tracking technologies without adequate authorization. Private class action plaintiffs have pursued parallel tracks, often settling before courts reach the merits. The Thriveworks settlement, if approved, will add to a growing body of resolved claims that establish practical benchmarks for damages in this category of privacy litigation.