Facebook parent company Meta faces a class-action lawsuit following disclosure that a tracking tool installed on hospitals’ websites has been allegedly collecting patients’ protected health information (PHI)—including details about their medical conditions, prescriptions and doctor’s appointments—and sending it to Facebook.
The investigation, conducted by The Markup, tested the websites of Newsweek’s top 100 hospitals in America and found the tracker Meta Pixel on one-third of them. Although Facebook and Meta almost certainly are not covered by HIPAA, the hospitals involved are covered, and some experts speculated that this form of data-sharing may be a HIPAA violation.
Rebecca Herold, president of SIMBUS360 and CEO of The Privacy Professor, said based on information publicly available about The Markup’s investigation, it appears PHI input into hospital websites and portals is being sent to Facebook by the Meta Pixel tracker.
Covered entities (CEs) are responsible for the PHI they collect from their patients and insureds, Herold said, adding, “Meta Pixel is a data leak vulnerability that creates significant risk of unauthorized PHI sharing.” She urged CEs and business associates (BAs) to take steps to identify and remove Meta Pixel and other trackers from their websites immediately.
David Harlow, chief compliance and privacy officer at Insulet Corporation, agreed that “to the extent a hospital passes along PHI in one form or another to Facebook, as detailed [in The Markup investigation], that could be a HIPAA violation.” The regulatory definition of PHI is quite broad and may include any health information associated with any identifier, including an IP address, he said.