Virtually all hospital websites—some 98.6%—contain the third-party tracking code snippets, “pixels,” leading to transfers of information to large technology companies, social media companies, advertising firms and data brokers, a study published in Health Affairs found.^[1]

In addition, hospitals operating within health systems, hospitals with a medical school affiliation, and hospitals serving more urban patient populations all exposed visitors to higher levels of tracking, according to the study, which sought to assess the prevalence and quantity of third-party tracking across the website home pages of all U.S. acute care hospitals.

“Our results demonstrate that across the websites of 3,747 nonfederal acute care hospitals in the U.S., third-party tracking is ubiquitous and extensive, with hospital website home pages initiating a median of sixteen third-party data transfers,” the study’s authors wrote. The study was conducted by a team from the University of Pennsylvania.

“In addition, our analysis of a random sample of hospital websites revealed no substantial difference between the amount of third-party tracking on hospital home pages and condition-specific web pages. Thus, despite being subject to HIPAA’s stringent privacy measures for protected health information [PHI], nearly all hospitals allow third parties to capture data about how patients and other users navigate their websites,” the study found.

In fact, pixel use across HIPAA covered entities’ (CEs’) websites has caught the attention of the HHS Office for Civil Rights (OCR). OCR Director Melanie Fontes Rainer said in March that CEs should bring themselves into compliance with the HIPAA Privacy Rule as quickly as possible; OCR’s goal is voluntary compliance.^[2]