Novant Health notified patients Aug. 12 that their protected health information may have been improperly disclosed because of a Facebook tracking tool used in a May 2020 marketing campaign.
In May, Novant Health launched a promotional campaign involving Facebook advertisements and a Meta tracking pixel which was placed on the health system's website, according to a press release from Novant.
The tracking tool was intended to help Novant Health track the campaign's success, but ended up allowing certain private information to be transmitted to Facebook's parent company Meta from the Novant Health website and MyChart patient portal. Novant discovered the possible disclosures June 17.
Novant Health said the pixel was configured improperly which allowed Meta to obtain patient information such as email addresses, phone numbers, computer IP addresses, contact information, appointment details and content typed into free text boxes. Social Security numbers and financial information wasn't included unless it was typed into a free text box.
Novant Health said it sent letters to 1.3 million patients who could have been affected by the pixel misconfiguration. Novant is unaware of any improper use or attempted use of patient data by Meta or other third parties, the health system said.
Chicago-based Northwestern Memorial Hospital, UCSF Medical Center, Meta, Facebook, Instagram and Dignity Health are currently facing lawsuits regarding the tracking tool, which allegedly shares sensitive patient health data with the social media companies.
The Markup conducted an investigation into Facebook's tool and found it was installed at 33 health systems.