A health-tech SaaS vendor allegedly used patient data from 25,000 people for marketing, research, and conferences without authorization. When an executive discovered the violations, the company allegedly delayed breach notifications while negotiating contract renewals, then fired the people who raised concerns. The case is not a HIPAA enforcement action. It is a wrongful termination suit. But the underlying facts are a roadmap for how BAA obligations can destroy a SaaS vendor’s customer relationships, and potentially the business itself.
Verily Life Sciences is a subsidiary of Alphabet, Google’s parent company. It operates under Alphabet’s “Other Bets” category. The company launched in 2015 out of Google’s X lab and has pivoted through glucose monitors, pandemic response, and precision health over the past decade. Its diabetes and hypertension business, Onduo, provided a digital chronic disease management program to enterprise clients, including Walgreens Boots Alliance, Highmark Health, Quest Diagnostics, and Delta Air Lines. Patients enrolled through their employers or insurers and shared sensitive health information, including diagnoses, treatments, and outcomes, through the Onduo platform.
All of those clients are HIPAA-covered entities. Verily, as the technology vendor processing protected health information on their behalf, operated as a business associate under HIPAA. Each client relationship was governed by a Business Associate Agreement that strictly limited how Verily could use patient data. The BAAs reportedly prohibited the use of protected health information outside of direct patient care.
According to the lawsuit, Verily did not honor those limits.
What the Lawsuit Alleges
In January 2022, Ryan Sloan, Onduo’s chief commercial officer, and Julia Feldman, Onduo’s general counsel, discovered that Verily had been using protected health information from Onduo patients without authorization. The data had been used in research studies, marketing campaigns, press releases, and presentations at national conferences. These uses were not authorized under the BAAs governing each client relationship.
Sloan and Feldman escalated the issue to Verily’s privacy officer, general counsel, and board secretary. Between January and March 2022, an internal investigation confirmed the violations. The investigation found breaches of 14 separate Business Associate Agreements with Verily’s covered-entity clients, spanning the period from 2017 to 2021. More than 25,000 patients in the Onduo diabetes program were affected.
Under the HIPAA Breach Notification Rule, a business associate must notify its covered-entity clients no later than 60 days after discovering a breach. Since Sloan made the discovery in January 2022, notification was due by the end of March 2022.
According to the complaint, that did not happen. The lawsuit alleges that Verily’s leadership decided to delay the decision of notifying the covered entities. In June 2022, rather than disclosing the breaches, Verily allegedly began negotiating new Business Associate Agreements that would permit broader future use of patient data, without disclosing that the existing agreements had already been violated.
In August 2022, during a contract renewal negotiation with Highmark Health, Verily allegedly represented that it was in compliance with HIPAA at all times. The company knew that HIPAA breaches had occurred involving Highmark Health’s patient data. The same month, Verily terminated Feldman (Onduo’s general counsel) and another employee who was aware of the breaches.
When Sloan raised the issue again in October 2022 with Verily’s then-chief revenue officer, she allegedly defended the company’s decision not to disclose the breaches, stating that doing so would negatively affect public relations.
In November 2022, Verily allegedly suppressed a press release about positive results from the Onduo diabetes program because the release might draw attention to the marketing studies that had violated the BAAs. The company removed the press release from its website and instructed employees not to mention it again.
Sloan was terminated in January 2023 while on family medical leave to care for his critically ill mother.
What This Case Actually Is (and Isn’t)
This is not a HIPAA enforcement action. It is a wrongful termination and retaliation lawsuit. HIPAA does not provide a private right of action. Individuals cannot sue for HIPAA violations, and neither can former employees. Only the HHS Office for Civil Rights and state attorneys general can bring HIPAA enforcement actions.
Sloan’s claims are employment claims: he alleges he was fired in breach of his employment contract for raising HIPAA violations in good faith. The court will evaluate whether Verily improperly terminated him, not whether HIPAA was actually violated.
That distinction matters for how you read the case, but it does not diminish its relevance for SaaS vendors. The underlying factual allegations, whether ultimately proven or not, describe a pattern that any B2B SaaS company handling regulated data needs to understand. And the case survived Verily’s motion to dismiss and its attempt to force arbitration. A federal judge in San Francisco found in September 2025 that the allegations were sufficient to proceed. The case remains active, with its most recent filing in February 2026.
Why This Matters for SaaS Founders (Even If You Don’t Touch Healthcare Data)
The Verily case is about HIPAA and BAAs. But the structural lesson applies to any SaaS vendor that processes customer data under contractual restrictions. If your DPA, BAA, or data processing terms limit how you can use customer data, and you use it in ways those terms do not authorize, you have breached the agreement. The specific regulation (HIPAA, GDPR, CCPA, FERPA) does not change the contractual mechanics.
Here’s why the Verily pattern is particularly dangerous for SaaS vendors.
The BAA Is a Contract, Not Just a Compliance Checkbox
Most SaaS founders encounter the BAA (or DPA, or data processing addendum) as a procurement requirement. The enterprise customer sends you their template, you negotiate a few terms, you sign it, and you move on to implementation. The document goes into a folder.
The BAA is a legally binding contract that defines exactly what you can and cannot do with your customer’s data. If the BAA says you may use protected health information only for the purpose of providing services to the covered entity, then using that data for your own research, marketing, product development, or conference presentations is a breach. Not a regulatory violation (though it may be that too). A breach of contract.
Your customer can sue you for breach of the BAA without HIPAA being involved at all. They do not need to go through the HHS Office for Civil Rights. They do not need to prove a HIPAA violation. They need to prove you violated the terms of the agreement they signed with you. That is a standard contract claim.
The Verily allegations describe exactly this: a vendor that used customer data in ways the BAA did not authorize. The data went into research studies, marketing materials, press releases, and conferences. Whether any of those uses were independently valuable or well-intentioned is irrelevant. The BAA did not permit them.
Breach Notification Delay Compounds the Exposure
The HIPAA Breach Notification Rule requires a business associate to notify affected covered entities within 60 days of discovering a breach. Verily allegedly delayed notification for months while negotiating contract renewals with the very clients whose data had been compromised.
This is the single most damaging allegation in the complaint from a customer-relationship perspective. If you breach your BAA and promptly notify your customer, you have a compliance failure that may be remediable. If you breach your BAA, conceal it, and continue negotiating new contracts while representing that you are in compliance, you have converted a compliance failure into a trust failure. The customer can no longer rely on anything you tell them about your data practices.
For SaaS vendors, the lesson is that breach notification obligations in your DPA or BAA are not optional, and they are not negotiable in the moment. If you discover that your product has handled customer data in a way that violates your agreement, the notification clock starts. Delaying to assess the business impact, to restructure the agreement, or to avoid public relations consequences does not stop the clock. It makes the eventual disclosure worse.
AI Makes This Pattern More Likely, Not Less
The Verily breaches allegedly occurred between 2017 and 2021, before the current wave of AI integration. But the pattern is directly relevant to the AI-enabled SaaS landscape.
When your product incorporates AI features that process customer data, the boundary between “providing services to the customer” and “improving your own product” becomes harder to maintain. AI systems that learn, adapt, or improve from processing customer data are doing something the customer may not have authorized. If your BAA or DPA limits data use to “providing the services,” and your AI uses customer data to improve model performance, train new capabilities, or generate insights for product development, you may be in breach.
This is the same dynamic at the center of the ConverseNow case (covered in the first post in this series), where the court focused on whether the vendor used customer data for its own purposes. The difference is that ConverseNow is being sued by end users under a wiretapping statute. The Verily pattern is about the vendor’s relationship with its own customer. Both cases turn on the same question: did the vendor use data in ways the governing agreement did not authorize?
For SaaS vendors adding AI features to products that process customer data under a DPA or BAA, the practical question is whether your data processing terms were drafted for deterministic software and have not been updated for AI. If your DPA says you process data “solely for the purpose of providing the services” and your AI pipeline retains, analyzes, or learns from that data for any other purpose, you have a gap between what your agreement says and what your product does. That gap is the Verily pattern.
What Your Legal Stack Needs to Address
Audit your data use against your BAA and DPA commitments. This is the most basic step and the one most frequently skipped. Read the data processing terms you have signed with each customer. Identify every way your product actually uses their data. If there is a use that falls outside what the agreement authorizes, you have two options: stop the unauthorized use, or amend the agreement with the customer’s informed consent. What you cannot do is continue the unauthorized use and hope nobody notices.
Update your data processing terms for AI. If your product now includes AI features that were not contemplated when the original DPA or BAA was signed, the agreement needs to be updated. The update should describe the specific AI processing activities (inference, model improvement, anonymized aggregation), identify which activities are included in the standard service and which require separate authorization, and give the customer the ability to opt out of any use beyond the immediate service. The AI series on this blog covers the specific drafting in detail.
Implement breach notification procedures before you need them. Your DPA or BAA contains a notification timeline (typically 60 days under HIPAA, 72 hours under GDPR). You need an internal process that triggers when someone discovers a potential breach, routes it to the right decision-maker, and ensures notification happens within the contractual timeframe. The process cannot depend on someone deciding whether the business impact justifies disclosure. If the breach occurred, the notification is required. The Verily allegations describe what happens when notification is treated as a discretionary business decision rather than a contractual obligation.
Do not represent compliance you cannot support. If you know your data practices have not conformed to your BAA or DPA, do not represent otherwise during contract renewals, sales conversations, or security questionnaires. The Verily complaint alleges the company represented HIPAA compliance to Highmark Health during a contract renewal while knowing a breach had occurred involving Highmark’s data. That allegation transforms a data handling failure into an affirmative misrepresentation. Misrepresentation during a contract negotiation carries its own legal consequences independent of the underlying breach.
Protect the people who raise compliance concerns. The Verily complaint alleges that the general counsel who discovered the breaches was terminated in August 2022, along with another employee who was aware of them. Sloan, who continued to raise the issue, was terminated in January 2023. Regardless of the merits of those terminations, the sequence creates an inference of retaliation that is independently actionable. If an employee discovers that your product is handling data in a way that violates your customer agreements, your response determines whether you have a remediable compliance issue or a whistleblower lawsuit. The correct response is to investigate, remediate, and notify. The incorrect response is to terminate the people who raised the concern.
The Through-Line
The first post in this series covered the ConverseNow pattern: a SaaS vendor processing end-user communications faces wiretapping claims when consent is absent. The second covered the Sharp HealthCare pattern: regulated data compounds the exposure, and fabricated compliance documentation creates a record integrity crisis.
The Verily pattern is different. It is about what happens inside the vendor’s own customer relationships when data practices drift from what the agreements authorize. There is no end-user class action. There is no wiretapping statute. The claim is simpler: the vendor signed agreements limiting how it would use customer data, and then used the data in ways those agreements did not permit.
For SaaS founders, this is the most common of the three patterns and the easiest to fall into. You sign a DPA during procurement. You build new features. Those features process customer data in ways the original DPA did not contemplate. Nobody updates the agreement. The gap between what your DPA says and what your product does widens with every release.
The Verily case is the extreme version of what happens when that gap goes unaddressed. But the lesson applies at every scale: your data processing terms are a promise about how you will handle customer data. If your product has changed since you made that promise, the promise needs to change too.
This is the third post in the AI Privacy Litigation series. Previous: AI Scribes, Fabricated Consent, and Regulated Data: What the Sharp HealthCare Case Means for SaaS Vendors. Next: Algorithmic Discrimination and the SaaS Vendor: Mobley v. Workday at Class Certification.
For the contractual framework, see the AI-Enabled SaaS series, particularly Customer Data and AI Training and Contracting With Your LLM Provider.
No Boiler provides self-service legal document generation and educational content. This material and our service is not a substitute for legal advice. Please have a qualified attorney review any documents before relying on them. No Boiler is not a law firm, and communications with us do not create an attorney-client relationship or carry any expectation of confidentiality. Use of our platform and content is governed by our Terms of Service and Privacy Policy.