Hospital Website Wiretapping Settlements

The Meta Pixel tracker was exposed many years ago for its nefarious practices of obtaining health-related information about patients from hospital websites, and I wrote about it here on June 25, 2022.

However, Meta/Facebook was not the only bad actor. Google and many other companies had also been known to “wiretap” hospital websites to collect protected health information (PHI). As a result, the Office of Civil Rights issued statements on the matter, along with warnings to hospital systems about the use of these online tracking technologies. I wrote about it here on July 23, 2023.

To summarize the legal issues, there is a healthcare-specific law called the Health Insurance Portability and Accountability Act (HIPAA) which prohibits healthcare providers from sharing PHI with third parties. This law appears to have been repeated violated by the implementation of tracking technologies on hospital websites.

Yesterday I received a Notice of Proposed Class Action Settlement in which Kaiser Foundation Health Plan, Inc. reached a proposed settlement of claims related to their disclosure of patients’ confidential personal information due to third-party software code. The Consolidated Master Class Action Complaint specifically mentions Quantum Metric, Twitter, Adobe, Microsoft Bing, and Google as “Third Party Wiretappers” on paragraph 4 (page 2) and states that it is not limited to just these companies.

In paragraph 261 (page 74), it specifically mentions that Meta/Facebook and Google Analytics have been implicated in this specific tracking activity of personal health information.

There have been other lawsuits against other healthcare delivery organizations and resultant settlements. I used ChatGPT to help me identify some of them which include University of Tennessee Medical Center & Margaret Mary Community Hospital, Pomona Valley Hospital Medical Center, Louisiana Children’s Medical Center, Reid Health, MarinHealth, and Eisenhower Medical Center to name some lawsuits in which Meta Pixel was specifically implicated. I have not done comprehensive research, but I suspect that there are many others in which other third party wiretappers are named. If you were a Kaiser patient between November 2017 and May 2024, and if you haven’t received notification about the Kaiser Privacy Breach Settlement, visit https://kaiserprivacysettlement.com to learn more.

Eleven Table Tennis Adapters

I’ve been playing Eleven Table Tennis (ETT) on the Meta Quest 2 for more than a year. I’ve previously written about ETT personality profiles, how the game addresses latency to produce near-real time gameplay and how to revert to an older version of ETT.

Although the Quest 2 adapters work quite well for me, many players have recommended that I use a table tennis adapter to more realistically simulate the holding of a real table tennis paddle. There are many adapters to choose from, and the first consideration seems to be whether you want to use a traditional shakehand grip (which looks roughly similar to how you might shake someone’s hand) or penhold grip (which is popular among Chinese players). I prefer the penhold grip and will share my experience with 2 different adapters.

The first adapter I bought was the AMVR adapter which has received good reviews. The Quest controller mounts securely, and I never worried about the controller flying off the adapter. There is an AMVR adapter setting that comes standard with ETT, so configuration is easy. However, after playing for a while, I felt that my forearm was getting sore due to the setup being top-heavy. After a week or so, I decided to return the AMVR adapter and try something different.

Many players have recommended the SolidSlime adapter, so I decided to give it a try. The Quest controller is mounted closer to the handle, so the weight distribution feels more natural than the AMVR adapter. For me, this is the major improvement over the AMVR adapter. The SolidSlime adapter comes with a couple of thumbscrews that are used to clamp the Quest controller in place. Despite fully tightening the screws, I still get a small amount of movement/shake in my controller, although I can’t say that it noticeably affects gameplay. There is also an in-game setting for this adapter, so configuration is quick and simple. This is the adapter that I plan to stick with for the time being.

I must admit that with both the AMVR and SolidSlime adapters, I have not played as well as compared with the Quest controllers alone. However, I have played with the Quest controller far longer than I have played with an adapter, so I plan to give it some more time and see if my game improves.

Finally, it appears to me that the SolidSlime adapter is 3D printed. If you have a 3D printer and want to experiment with some different adapters, you can find several Quest table tennis adapters on Thingiverse.

Online Tracking Technologies

In a previous “Hospital Websites and Meta Pixel” post, I discussed how the Meta Pixel tracker was found on many hospital websites, including appointment scheduling pages and password-protected patient portals. This could result in Meta (the parent company of Facebook) obtaining protected health information (PHI) which would violate the law, namely the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

A few days ago, the Office for Civil Rights (OCR, a federal agency under the U.S. Department of Health and Human Services) and the Federal Trade Commission (FTC) issued a press release to warn hospital systems that “the use of online tracking technologies that may be integrated into their websites or mobile apps that may be impermissibly disclosing consumers’ sensitive personal health data to third parties.”

It also links to a joint letter that was sent to approximately 130 hospital systems and telehealth providers whose intent was to emphasize potential risks around the use of online tracking technologies. The letter specifically names Meta/Facebook Pixel and Google Analytics as examples of online trackers that can “gather identifiable information about users as they interact with a website or mobile app, often in ways which are not avoidable by and largely unknown to users.”

Although no enforcement activity was mentioned, it concluded by recommending the following: “To the extent you are using the tracking technologies described in this letter on your website or app, we strongly encourage you to review the laws cited in this letter and take actions to protect the privacy and security of individuals’ health information.”

In December 2022, the OCR had issued guidance for the use of online tracking technologies and specifically mentioned that “Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules.”

It is clear that healthcare provider organizations have been put on notice about patient privacy and security requirements under HIPAA law. It will be interesting to see if there are any officially documented violations that result in enforcement action.

Hospital Websites and Meta Pixel

Meta (the company formerly known as Facebook) is in the hot seat again, this time in conjunction with many hospitals and health systems across the country. A tracker called the Meta Pixel was discovered on many hospital websites, bringing into question once again how much you can trust third parties with your sensitive information. According to an article by The Markup, 33 of Newsweek’s top 100 hospitals in the country were sending sensitive data to Facebook via Meta Pixel as of June 15, 2022. The Meta Pixel tracker was found on multiple areas of hospital websites including appointment scheduling pages and password-protected patient portals. The information included medications, allergies, search terms for how doctors were found (e.g., “pregnancy termination”), and other data. Details of how The Markup obtained this information are provided here.

It is common knowledge to many individuals, particularly those who have watched The Social Dilemma, that Meta tracks personal information for its users. So why is the discovery of Meta Pixel such a big deal? In healthcare, a law called the Health Insurance Portability and Accountability Act (HIPAA) prohibits “covered entities” like hospitals from sharing “protected health information” (PHI) with third parties like Meta.

A covered entity is an individual, organization, or agency that transmits personally identifiable information. It includes health care providers, health plans, and health care clearinghouses. The hospitals that were found to have Meta Pixel installed on their websites are covered entities.

PHI (a.k.a. “Individually identifiable health information” or “personally identifiable health information” or other variations) is defined as information, including demographic data, that relates to:

• the individual’s past, present or future physical or mental health or condition,
• the provision of health care to the individual, or
• the past, present, or future payment for the provision of health care to the individual,

and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual.

In other words, HIPAA law is written in a way that individuals and organizations who have access to patient information are expected to keep it private and only use it when necessary to deliver patient care, handle payment, or perform other permitted administrative functions. According to The Markup:

“I am deeply troubled by what [the hospitals] are doing with the capture of their data and the sharing of it,” said David Holtzman, a health privacy consultant who previously served as a senior privacy adviser in the U.S. Department of Health and Human Services’ Office for Civil Rights, which enforces HIPAA. “I cannot say [sharing this data] is for certain a HIPAA violation. It is quite likely a HIPAA violation.”

Meta Pixel has been the subject of several class action lawsuits in several states. Results have been mixed, and you read more about them in the “Legal Implications” section of the article by The Markup. Meanwhile, as patients and as users of technology, we have to ask ourselves if we trust social media and if we trust our hospitals to safeguard our health information.