The Indiana provider says pixels used to collect information about website users may have transferred certain types of patient information since 2017.
Community Health Network said it discovered on September 22 that the configuration of certain pixels on its digital properties allowed for a broader scope of patient information collection and transfer to third-party vendors, such as Meta and Google, than it realized.
WHY IT MATTERS
Companies that provide online tracking tools have been accused in class-action lawsuits of allegedly targeting ads to people based on information regarding their health that was collected through healthcare system websites and patient portals.
Community announced November 16 on its website that it launched an investigation into its own data-tracking practices and hired a third-party forensic team.
"That investigation confirmed that third-party tracking technologies were installed on Community's website, including the MyChart patient portal and on some of our appointment scheduling sites," the health network said in the statement.
"When we learned of this, we immediately began working with our service providers to disable and/or remove certain technologies from our websites and applications as we continued our internal investigation in hopes of better understanding the nature of the information that these technologies were collecting and transmitting."
Community also said that the investigation has not found evidence that misuse or fraud has occurred as a result of the breach, and it "cannot say with certainty what information was involved."
The data could be computer IP address; dates, times and/or locations of scheduled appointments; information about an individual's healthcare provider; type of appointment or procedure scheduled; communications through MyChart – which may have included first and last name and medical record number; information about whether an individual had insurance and if an individual had a proxy MyChart account, and the name of the proxy.
"We have no indication that any Social Security numbers, financial account numbers or debit/credit card information was collected by or transmitted through the third-party tracking technologies at any time," Community said.
Continue reading here.
About the Author
Follow on Twitter Follow on Linkedin Visit Website More Content by CynergisTek, Inc.
