Advocate Aurora Health said it installed "pixels" on its website that may have breached the medical data of as many as 3 million patients.
The health system, dually headquartered in Downers Grove, Ill., and Milwaukee, said it implemented the tracking tools to better understand patient behaviors but that the data may have been sent to Google or Facebook parent company Meta.
"We have disabled and/or removed the pixels from our platforms and launched an internal investigation to better understand what patient information was transmitted to our vendors," Advocate Aurora Health said in a statement.
The hospital group said that out of "an abundance of caution," it is assuming that all patients with a MyChart account, including users of the LiveWell app, or who used scheduling widgets through Advocate Aurora Health may have been affected. The system said it doesn't believe Social Security numbers or financial information were involved.
Health systems have been disabling the pixels after they were found to be potentially sharing patient data with tech companies. Some patients have sued hospitals and health systems over the issue.
The breach was submitted to the HHS Office of Civil Rights on Oct. 14.