WakeMed notifies patients: Private medical data may have been sent to Facebook
WakeMed has alerted patients about a potential breach in data privacy.
According to a notification sent out by WakeMed last week, some patients who visited two specific WakeMed websites may have had select data transmitted to Facebook – now Meta – in error.
In March 2018, WakeMed placed a pixel, provided by Facebook, on their website and on their MyChart patient portal.
"Unfortunately, the pixel’s software code may have also transmitted some of the information entered by visitors into the MyChart patient portal and appointment scheduling page back to Facebook," wrote WakeMed in a release on their website.
WakeMed says they have not been able to determine whether Facebook actually collected or used any of the information sent from its pixel. As a precaution, WakeMed says they are notifying all individuals who logged into a WakeMed MyChart account or scheduled an appointment on the WakeMed website between March 2018 and May 2022.
WakeMed says depending on a user's activity, Facebook may have received data such as:
- Allergy or medication information
- COVID vaccine status
- Upcoming appointments, including type of appointment and physician selected
- Information provided during online check-in
- Email address
- Phone number
- Computer IP address
- Emergency contact
WakeMed says the information did not include Social Security numbers or other financial information unless it was entered into a free text box by the user.
In June, WakeMed was among four health care systems that sent sensitive patient information to Facebook. The potential information included patients' health conditions, allergies and sexual orientations.
Why was WakeMed collecting patient data?
According to WakeMed, the pixel was originally intended to collect anonymous data that would help WakeMed better connect members of their community with WakeMed’s MyChart patient portal, thereby improving access to their health care, and to help improve the WakeMed website.
"It is a standard practice for companies to use various technologies to collect data on the general demographics, interests, and behaviors of visitors to their websites," WakeMed wrote.
WakeMed proactively disabled Facebook’s pixel in May 2022, and has no plans to use it in the future without confirmation that the pixel no longer has the capacity to transmit potentially sensitive or identifiable information.
At this time, WakeMed says it is unaware of any improper use or attempted use of any patient information by Meta or any other third party. According to its terms and conditions, Meta has policies and filters that block sensitive personal data from being incorporated into its advertising programs and does not use any such information.
