Community Health Network notifies data breach involving tracking code

Indiana-based healthcare system Community Health Network, with more than 200 sites and affiliates throughout Central Indiana, has reported unauthorized data access involving third-party tracking technologies to the US Department of Health and Human Services.

According to reports, the nonprofit health system used third-party tracking codes from tech companies like Google and Facebook to track user trends, but it was later found that the tools were gathering more information than the health system “had ever intended.” It also notified 1.5 million users of the data breach.

Community Health Network claimed that it used the tracking tools to better understand how patients and users interacted with the website. Notably, tracking pixels on hospital websites and even inside password-protected patent portals have Facebook’s parent company Meta under fire.

After becoming aware of issues with third-party tracking codes, the Community launched an internal investigation and hired a forensic company to conduct a thorough technical analysis of the technologies used on its websites and applications.

The Community Health Network started deactivating and removing specific technologies from its websites and applications after discovering that third-party technology was installed on its patient portal and some appointment scheduling websites.

On September 22, it was found that certain technologies could be set up in a way that allowed a wider range of data to be gathered and sent to each corresponding third-party tracking technology vendor, such as Facebook and Google. This data included IP addresses, the locations and times of appointments, communications from MyChart, and more.