Hospital Website Wiretapping Settlements

The Meta Pixel tracker was exposed many years ago for its nefarious practices of obtaining health-related information about patients from hospital websites, and I wrote about it here on June 25, 2022.

However, Meta/Facebook was not the only bad actor. Google and many other companies had also been known to “wiretap” hospital websites to collect protected health information (PHI). As a result, the Office of Civil Rights issued statements on the matter, along with warnings to hospital systems about the use of these online tracking technologies. I wrote about it here on July 23, 2023.

To summarize the legal issues, there is a healthcare-specific law called the Health Insurance Portability and Accountability Act (HIPAA) which prohibits healthcare providers from sharing PHI with third parties. This law appears to have been repeated violated by the implementation of tracking technologies on hospital websites.

Yesterday I received a Notice of Proposed Class Action Settlement in which Kaiser Foundation Health Plan, Inc. reached a proposed settlement of claims related to their disclosure of patients’ confidential personal information due to third-party software code. The Consolidated Master Class Action Complaint specifically mentions Quantum Metric, Twitter, Adobe, Microsoft Bing, and Google as “Third Party Wiretappers” on paragraph 4 (page 2) and states that it is not limited to just these companies.

In paragraph 261 (page 74), it specifically mentions that Meta/Facebook and Google Analytics have been implicated in this specific tracking activity of personal health information.

There have been other lawsuits against other healthcare delivery organizations and resultant settlements. I used ChatGPT to help me identify some of them which include University of Tennessee Medical Center & Margaret Mary Community Hospital, Pomona Valley Hospital Medical Center, Louisiana Children’s Medical Center, Reid Health, MarinHealth, and Eisenhower Medical Center to name some lawsuits in which Meta Pixel was specifically implicated. I have not done comprehensive research, but I suspect that there are many others in which other third party wiretappers are named. If you were a Kaiser patient between November 2017 and May 2024, and if you haven’t received notification about the Kaiser Privacy Breach Settlement, visit https://kaiserprivacysettlement.com to learn more.

Online Tracking Technologies

In a previous “Hospital Websites and Meta Pixel” post, I discussed how the Meta Pixel tracker was found on many hospital websites, including appointment scheduling pages and password-protected patient portals. This could result in Meta (the parent company of Facebook) obtaining protected health information (PHI) which would violate the law, namely the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

A few days ago, the Office for Civil Rights (OCR, a federal agency under the U.S. Department of Health and Human Services) and the Federal Trade Commission (FTC) issued a press release to warn hospital systems that “the use of online tracking technologies that may be integrated into their websites or mobile apps that may be impermissibly disclosing consumers’ sensitive personal health data to third parties.”

It also links to a joint letter that was sent to approximately 130 hospital systems and telehealth providers whose intent was to emphasize potential risks around the use of online tracking technologies. The letter specifically names Meta/Facebook Pixel and Google Analytics as examples of online trackers that can “gather identifiable information about users as they interact with a website or mobile app, often in ways which are not avoidable by and largely unknown to users.”

Although no enforcement activity was mentioned, it concluded by recommending the following: “To the extent you are using the tracking technologies described in this letter on your website or app, we strongly encourage you to review the laws cited in this letter and take actions to protect the privacy and security of individuals’ health information.”

In December 2022, the OCR had issued guidance for the use of online tracking technologies and specifically mentioned that “Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules.”

It is clear that healthcare provider organizations have been put on notice about patient privacy and security requirements under HIPAA law. It will be interesting to see if there are any officially documented violations that result in enforcement action.

Hospital Websites and Meta Pixel

Meta (the company formerly known as Facebook) is in the hot seat again, this time in conjunction with many hospitals and health systems across the country. A tracker called the Meta Pixel was discovered on many hospital websites, bringing into question once again how much you can trust third parties with your sensitive information. According to an article by The Markup, 33 of Newsweek’s top 100 hospitals in the country were sending sensitive data to Facebook via Meta Pixel as of June 15, 2022. The Meta Pixel tracker was found on multiple areas of hospital websites including appointment scheduling pages and password-protected patient portals. The information included medications, allergies, search terms for how doctors were found (e.g., “pregnancy termination”), and other data. Details of how The Markup obtained this information are provided here.

It is common knowledge to many individuals, particularly those who have watched The Social Dilemma, that Meta tracks personal information for its users. So why is the discovery of Meta Pixel such a big deal? In healthcare, a law called the Health Insurance Portability and Accountability Act (HIPAA) prohibits “covered entities” like hospitals from sharing “protected health information” (PHI) with third parties like Meta.

A covered entity is an individual, organization, or agency that transmits personally identifiable information. It includes health care providers, health plans, and health care clearinghouses. The hospitals that were found to have Meta Pixel installed on their websites are covered entities.

PHI (a.k.a. “Individually identifiable health information” or “personally identifiable health information” or other variations) is defined as information, including demographic data, that relates to:

• the individual’s past, present or future physical or mental health or condition,
• the provision of health care to the individual, or
• the past, present, or future payment for the provision of health care to the individual,

and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual.

In other words, HIPAA law is written in a way that individuals and organizations who have access to patient information are expected to keep it private and only use it when necessary to deliver patient care, handle payment, or perform other permitted administrative functions. According to The Markup:

“I am deeply troubled by what [the hospitals] are doing with the capture of their data and the sharing of it,” said David Holtzman, a health privacy consultant who previously served as a senior privacy adviser in the U.S. Department of Health and Human Services’ Office for Civil Rights, which enforces HIPAA. “I cannot say [sharing this data] is for certain a HIPAA violation. It is quite likely a HIPAA violation.”

Meta Pixel has been the subject of several class action lawsuits in several states. Results have been mixed, and you read more about them in the “Legal Implications” section of the article by The Markup. Meanwhile, as patients and as users of technology, we have to ask ourselves if we trust social media and if we trust our hospitals to safeguard our health information.

COVID-19 Digital Health Credentials

If you’ve received one of the COVID-19 vaccines, you might have realized that there are many ways to prove that you have been vaccinated. First there is the physical “COVID-19 Vaccination Record Card” with the logos from the U.S. Department of Health and Human Services and Centers for Disease Control at the upper right. Here’s mine:

If you received your shot at a location where you normally receive healthcare, you might also be able to access your immunization records through a patient portal. Here’s what mine looks like from a desktop-based web browser. Note that it unfortunately does not list the dates, and there was a data entry error because for my second shot, I asked that it be injected into my RIGHT arm.

In some cases, your local city or county may have partnered with a 3rd party health information technology company to provide you with a digital version of your vaccination record that can be added to a mobile wallet. Los Angeles County has partnered with Healthvana on this effort, and I received a text message that my vaccination record was available to be added to my mobile wallet. Here are screenshots from my iPhone to illustrate what it looks like to retrieve my vaccine information from a mobile web browser and what the record looks like in Apple Wallet:

As if there weren’t enough options, if you have an iPhone and a healthcare provider that supports interoperable patient data through a “Blue Button” download, you could transfer your vaccination information and other health records to your Apple Health app. Follow these instructions to add your health data to Apple Health. Here’s what my immunization record looks like in Apple Health, both in human-readable summary view as well as the underlying data:

There is much discussion about vaccine passports nowadays which has given rise to many questions. Can we do it? Should we do it? Is it even legal? Without getting into a lengthy debate, suffice it to say that technologies have already been around for many years, and we’ve already been implementing digital health credentials to varying degrees for quite some time. For me, adding data related to COVID-19 vaccination simply represents a more comprehensive picture of my overall health data.

In addition to the discussion about vaccine credentials or passports, perhaps a bigger challenge is to figure out whether we can all agree on a common method to share health data. There is a saying that goes something like this: “The great thing about health IT standards is that there are so many of them to choose from.”

ECG on Apple Watch Series 4

You may be aware that there is a new ECG app on the Apple Watch Series 4. An Apple Support page provides instructions on how to use the app and interpret the results. Since I'm a doctor and a geek, I'll try to provide a little more context about the Apple Watch ECG capabilities in layman's terms.

The Apple Watch ECG tracing (a portion of mine is pictured above) is a subset of what is formally known as a "12-lead ECG" that might be used in doctor's offices and hospitals. A full 12-lead ECG might look something like this:

It's called a 12-lead ECG because there are 12 combinations of the leads that are placed on a patient's body, with each lead representing the electrical signals between 2 points on the body. Those 12 leads are I, II, III, aVR, aVL, aVF, V1, V2, V3, V4, V5, and V6. The placement of those 12 leads on a patient's body and the understanding of the differences between those leads are beyond the scope of this blog, but suffice it to say that in certain scenarios, it is important to look at ECG tracings from multiple leads to tell what is going on.

A 12-lead ECG can reveal many different kinds of findings, such as:

• Arrhythmias: atrial fibrillation, atrial flutter, ventricular tachycardia, ventricular fibrillation, Wolf-Parkinson-White syndrome, sick sinus syndrome (tachy-brady syndrome), atrioventricular nodal reentrant tachycardia, multifocal atrial tachycardia, wandering atrial pacemaker, 1st/2nd/3rd-degree atrioventricular block, premature atrial contractions, premature ventricular contractions, long QT syndrome, asystole, and many others
• Ischemia (insufficient supply of oxygen to heart muscles): unstable angina and acute myocardial infarction (heart attack)
• Structural abnormalities: cardiac aneurysms, dextrocardia, congenital heart defects, hypertrophic obstructive cardiomyopathy, atrial septal defects, and others
• Miscellaneous: hyperkalemia, hypokalemia, hypercalcemia, hypocalcemia, digoxin effect, pericarditis, and many others

The Apple Watch Series 4 (and presumably beyond) can identify normal sinus rhythm (i.e., a normal rhythm that is found in healthy hearts) and atrial fibrillation (an abnormal heart rhythm in which there is no predictable periodicity to the heartbeats and the notable absence of a certain kind of electrical signal known as a P wave on the ECG), but it cannot currently identify any other problems such as the partial list above.

After demonstrating success with the detection of atrial fibrillation, I think it would be fairly straightforward for Apple to identify several other kinds of arrhythmias (from the partial list above) on a Series 4 Apple Watch simply by updating the software, and I predict that we will see this capability sometime soon. However, it makes a lot of sense to start with identifying atrial fibrillation because it is one of the most common cardiac arrhythmias, has potentially serious consequences if left undetected and untreated, and is fairly straightforward to computerize its detection on ECG.

That being said, there are some conditions such as detecting heart attacks that are unlikely to be performed on an Apple Watch because a heart attack results in ECG changes in some leads but not others, depending on its location. That is why we use all 12 leads to look for signs of ischemia in all regions of the heart. The Apple watch ECG tracing is more or less equivalent to lead I on a 12-lead ECG. It is essentially a 1-lead ECG or a "telemetry strip" reading.

I hope this sheds some light on the Apple Watch ECG app's current capabilities and limitations. Tim Cook recently stated, "if you zoom out into the future, and you look back, and you ask the question, 'What was Apple's greatest contribution to mankind,' it will be about health." With Apple's introduction of HealthKit (June 2014), the Health app (June 2014), ResearchKit (March 2015), CareKit (March 2016), and now the ECG app (December 2018), I think Apple is in an excellent position to do just that.

Force-Refresh Data on iOS Health App

I use the iOS Health app on my iPhone from time to time to review my walking + running distances. I've written in the past about distance tracking accuracy here and about a strange issue here. I also want to highlight that I find it inconvenient at times when I launch the Health app, only to find that it has yet to update walking + running distances from the past several hours. Example:

      

In the screenshot on the left, notice that the time is 5:27 PM and that no walking or running activity has been registered since 7:00 AM. At this time, the total distance is 0.59 miles. Tapping on "Show All Data" yields the screenshot in the middle, and it shows that the total distance for the day is actually 5 miles. Tapping on "Back" takes us back to the original Walking + Running Distance screen which now displays recorded distances from 8:00 AM to 5:27 PM, including the 5 total miles spread throughout the day.

This issue has occurred on my iPhone for the past several months, and only recently did I discover that navigating to the "Show All Data" screen forces a refresh. Maybe this is a bug that can be fixed in a future release.

Inconceivably Regular Activity

The Apple iOS Health app on my phone (iPhone 6 Plus, iOS 12.0.1) suits my simple needs. It tracks my walking + running distance and lets me view my activity data in increments of days, weeks, months, and even years. Since I don't use any GPS-enabled apps to accurately track my distances, I've compared known running distances against Apple Health and have found it to be fairly accurate. However, something strange happened the other day. I noticed that Health was registering just under 0.2 miles/hour for every hour of the day:

      

On October 24 (left image), the Health app correctly logged the distances that I logged at 7 AM and 8 AM as I walked my child to school and walked back home. Then at 4 PM, it began recording distances of just under 0.2 miles/hour for the remainder of the day. This continued for all 24 hours of October 25 (center image) and lasted until 9 AM on October 26 (right image).

Obviously I did not really perform that activity at such a regular pace for 42 straight hours. I also did not place the phone on a vibrating surface or any other surface that was in motion for that time frame. In fact, I had a pretty normal routine where I left the phone on my desk while working and picked it up only to make phone calls, use mobile apps, or when leaving home.

The total distance of 4.5 miles on October 25 is a little on the low side since I walked my child to school (round trip of 1.75 miles) and ran/walked 3.75 miles (my usual route) which adds up to 5.5 miles, so maybe the app was simply not recognizing movement correctly for that 42-hour timespan. That being said, I suppose this could be within the margin of error of distance tracking without a GPS. Thinking about possible data corruption issues, I don't recall my iPhone crashing or being dropped during that time, nor had I experienced an unexpected shutdown due to complete battery drainage.

So I'm not quite sure what happened, but in the last 48+ hours (it's now October 28), the app appears to have returned to normal activity tracking. If you've seen this sort of strangely consistent recorded activity on your iOS Health app or even know why this is happening, let me know.

Sleepless on a Redeye

On Monday, February 12, I was scheduled to fly nonstop from Los Angeles to Indianapolis on American Airlines. We were on track for a 10:00 AM departure when we pulled away from the gate and began our taxi to the runway. However, we experienced delays due to a malfunctioning flight computer, and after an hour we returned to the gate because the aircraft was taken out of service. Although it was announced that another plane would be brought in, the airline changed its mind, cancelled the flight, and rebooked me on a redeye flight with a connection in Charlotte. Thanks American.

It was difficult to sleep on the flight. Although I was not checking the time, it seemed as if I slept in 10-15 minute intervals because I recall awakening continuously throughout the duration of the 5-hour flight. On February 14, I happened to browse my sleep data on my Apple Health app, and this is what I saw:

   

It appears that during the redeye flight, I did not satisfy the criteria for being "in bed" for any portion of the night, as depicted by the absence of a purple bar in the "Tue" column. For some reason, my Health app does not appear to track "In Bed" data on weekends, at least not from the past few months of data that I reviewed, but perhaps there is a way to change that in a setting somewhere. Also, there is a pink "Asleep" legend, and given that I have no "asleep" data, I assume that I am missing either the software or hardware that is required to capture this information. In any case, it made me wonder what the criteria are for considering a person to be "in bed". If anyone has insight into this, please let me know!

My Walking + Running Data on iOS 8

Since upgrading to iOS 8, I have been tracking my running data using Apple's Health app.  With my old iPhone 5 running iOS8, I had been manually entering my run distances--I know that I could pair the Health app with a variety of running apps to have the data tracked automatically, but I stopped using them because they exert a heavy toll on battery life (see my post on running apps for more).  After upgrading to my iPhone 6 Plus, I have enabled Fitness Tracking (Settings > Privacy > Motion & Fitness) and feel that my running distances are tracked fairly accurately with the motion sensors that consume far less energy than GPS.  Here's what my Walking + Running dashboard looks like:

Note the spike in activity during the March 28 to April 3 timeframe--that's when I went on a cruise (see this blog post for more) and ran on the ship's treadmill 1-2 times/day.  Speaking of treadmills, despite turning on the iPhone Fitness Tracking option, I still have to manually input my treadmill run distances because I don't carry my phone in my hands when I run on treadmills, so my phone is not able to estimate run distances.  Even if I did hold my phone while running on the treadmill, I wonder how accurate the data would be--perhaps I'll experiment with that scenario and blog about it later.

One thing I wish the Health app would do is to somehow differentiate between walking and running distances rather than merging them into a single "Walking + Running" distance.  I can understand why Apple did this for technical simplicity, but I personally don't consider my daily walking distances to count as exercise--rather, that is simply a byproduct of being alive (for me personally--I know that many people walk for exercise as well which is great).  Running, on the other hand, is what I prefer to track separately because I do it with the intent of improving fitness.

In any case, I am not really sure what I will do with this data in the future, but I expect that someone will write a cool app using HealthKit that will leverage personal health data to present insightful analytics and/or personalized recommendations to improve health and well-being.  Oh developer, where art thou?