The crackdown on pixel tracking in telehealth is a warning for every startup

Healthcare startups are scrambling to reassess how their web sites and apps are constructed, and the way third events could, inadvertently or not, be placing sufferers’ protected well being data in danger.

In March, U.S. psychological well being startup Cerebral admitted it shared the non-public well being data of greater than 3 million customers with Fb, Google, TikTok and different advert giants by way of so-called monitoring pixels. These near-invisible bits of code are usually embedded in net pages to share details about customers’ exercise, typically for analytics. Cerebral stated these trackers inadvertently collected delicate consumer knowledge because it started working in October 2019.

In its disclosure to the U.S. Division of Well being and Human Companies (HHS), Cerebral stated that following a evaluation of its code, it “decided that it had disclosed sure data which may be regulated as protected well being data underneath [the Health Insurance Portability and Accountability Act],” or HIPAA, because it’s generally referred to. This data included sufferers’ telephone numbers, IP addresses, insurance coverage data, psychological well being evaluation responses and related medical knowledge.

This knowledge lapse is the third-largest breach of well being knowledge in 2023, in accordance with the HHS, which is investigating the breach. Nonetheless, whereas Cerebral’s lapse ranks among the many most severe and damaging, the breach is only one of many at present being investigated by HHS — and this record is prone to develop.

Extra casualties

Final yr, a joint investigation by STAT and The Markup found that dozens of hospital web sites and telehealth startups have been sharing sufferers’ medical data with advertisers and tech giants.