3M Advocate Aurora Health Patients Face PHI Exposure Tied to Tracking Pixels

October 20, 2022 – Advocate Aurora Health notified 3 million patients of a data breach that resulted in potential protected health information (PHI) exposure. The breach stemmed from the nonprofit health system’s use of Google and Meta (Facebook’s parent company) tracking pixels, which are commonly used tools that allow organizations to track website visitor activity. In August, North Carolina-based Novant Health notified 1.3 million patients that the use of Meta pixel code on its website also potentially exposed PHI. Background As previously reported, a co-published report by The Markup and STAT discovered that the Meta pixel tracker was being used on hundreds of hospital websites. While the use of pixels is common, the report found the pixel installed inside multiple password-protected patient portals and scheduling forms. With the tracker present, packets of data were allegedly sent to Facebook whenever someone clicked a button to schedule a doctor’s appointment. Facebook allegedly received highly sensitive protected health information (PHI), including medical conditions and doctors’ names, which could all be linked to the user’s unique IP address. READ MORE: Democratic Leaders Question Meta on Data Privacy PracticesNovant Health’s notification noted that Facebook’s terms and conditions state that “they have policies and filters that block…
Read More