VA Senator Expresses Health Data Privacy Concerns in Letter to Meta

Senator Mark R. Warner (D-VA) expressed significant health data privacy concerns surrounding the Meta pixel tracking tool in a letter to Meta CEO Mark Zuckerberg.

As previously reported, the tool has faced scrutiny in the healthcare sector since a report co-published by The Markup and STAT found it present on hundreds of hospital websites. Companies commonly use tracking tools on their websites for marketing and tracking user activity, but the report found that sensitive health data was getting transmitted back to Facebook in the process.

Advocate Aurora Health recently notified 3 million patients of a data breach stemming from the use of tracking pixels. In August, Novant Health notified 1.3 million patients that the use of Meta pixel code also potentially led to unauthorized disclosure of protected health information (PHI).

“I am troubled by the recent revelation that the Meta Pixel was installed on a number of hospital websites – including password-protected patient portals – and sending sensitive health information to Meta when a patient scheduled an appointment online,” Warner wrote.

Warner also noted that the Meta pixel previously faced scrutiny over its use on the Federal Student Aid (FSA) office. The Markup reported that the pixel had been sending data from the Free Application for Federal Student Aid (FAFSA) to Meta.

“Meta’s own business guidelines state that the company ‘[doesn’t] want websites or apps sending [Meta] sensitive information about people,’ including sensitive health information,” the letter stated.

“Yet, in this most recent case and as we have seen previously, Meta is continuing to access this highly sensitive information.”

Warner posed a series of questions to Meta surrounding its tracking pixel and how the company handles sensitive information. Specifically, the Senator asked Meta how it handles sensitive information that it receives from third parties that violate its business guidelines.

In addition, Warner probed Meta on its practices and asked how, or if, the company has updated its filtering system to better identify sensitive health information and what steps Meta is taking to safeguard health information.

“Where required by law, does Meta always comply with any and all notification requirements when the Meta Pixel handles or transmits protected information, in the manner and time required by such laws?” Warner asked.

Warner requested responses from Meta by November 3.