US hospitals send sensitive information to Facebook

Many hospitals have a so-called Metapixel on their site, which collects data for Meta, Facebook’s parent company. This writing tech site The Markup based on its own research into the top hundred hospitals in the United States.

When patients pressed a button to book an appointment with their doctor, the site sent information to Meta. This information was in turn linked to the patient’s personal IP address. Such an IP address indicates approximately where you live, although an IP address cannot very accurately indicate where you are.

Disease information transmitted

The type of data transmitted by the pixel differed from site to site. For example, a hospital in Cleveland informed Meta of the name of the patient’s doctor and the search term used to find the doctor.

Other sites, for example, passed on the name of the condition for which someone was seeking treatment. A number of hospital sites even had the pixel embedded into the patient portal, sharing details about medication use, allergies, and doctor appointments.

Metapixel Research

For the research, The Markup used information from Pixel Hunt, an initiative in which users can voluntarily install extensions that check whether a site has a Metapixel and what exactly Pixel is collecting. The markup notified hospitals of the privacy issue. Not all sites have removed their metapixels yet.

Just like in Europe, in the United States, it is illegal for medical authorities to share patients’ personal information with third parties. The hospitals appear to have made no attempt to obtain patient consent for this transfer of information.

As of 2020, Meta has had a system to filter health information from its data collection. However, according to a leaked document, the company faces significant problems to get an overview of the type of data stored by their own systems, so it is not certain that it is possible to delete this type of sensitive information.