Web Trackers Shared Member PHI With Google Ads

Blue Shield of California is notifying health plan members that their protected health information was potentially shared for nearly three years with Google for advertising purposes because of the way Google Analytics online tracking tools were configured on the insurer’s websites.

See Also: A Modern Approach to Data Security

The nonprofit Blue Shield of California, which is an independent member of the Blue Shield Association, provides health insurance plans to nearly 6 million members. The company did not immediately respond to Information Security Media Group’s request for additional details about the incident, including the number of individuals potentially affected by the breach.

As of Thursday, the incident had not been posted to the U.S. Department of Health and Human Services’ HIPAA Breach Reporting Tool website listing health data breaches affecting 500 or more individuals.

Last April, another major health plan in California – Kaiser Foundation Health Plan – reported a similar incident to federal regulators involving the use of online tracking technologies on its websites and mobile applications. That health data breach – reported by Kaiser Foundation to HHS as an “unauthorized access/disclosure” incident – affected 13.4 million people.

The Kaiser Foundation incident was the second-largest HIPAA breach reported in 2024 to federal regulators, behind the record-breaking Change Healthcare ransomware hack that affected 190 million people.

Breach Details

Blue Shield of California in its breach notice said that on Feb. 11, it discovered that between April 2021 and January 2024, “Google Analytics was configured in a way that allowed certain member data to be shared with Google’s advertising product, Google Ads, that likely included protected health information.”

Blue Shield of California said the company “historically used the third-party vendor service, Google Analytics, to internally track website usage of members who entered certain Blue Shield sites. We were doing this to improve the services we provide to our members.”

But through these web tracking tools, Google may have used member data to conduct focused ad campaigns at individuals, Blue Shield of California said.

“We want to reassure our members that no bad actor was involved, and, to our knowledge, Google has not used the information for any purpose other than these ads or shared the protected information with anyone.”

The insurer said it “severed the connection” between Google Analytics and Google Ads on its websites in January 2024. “We have no reason to believe that any member data has been shared from Blue Shield’s websites with Google after the connection was severed.”

Nonetheless, “due to the complexity and scope of the disclosures, Blue Shield is unable to confirm whether any particular member’s specific information was affected,” the company said.

Information potentially shared with Google Ads includes patient name, insurance plan name, type and group number; city; ZIP code; gender; family size; Blue Shield-assigned identifiers for members’ online accounts; medical claim service date, service provider and patient financial responsibility. Also potentially shared were members’ ‘Find a Doctor’ search criteria and results, such as location, plan name and type, provider name and type, Blue Shield of California said.

“There was no disclosure of other types of personal information, such as Social Security numbers, driver’s license numbers, or banking or credit card information,” the insurer said.

Prior Warnings

Federal regulators have for several years warned healthcare sector entities about potential violations of HIPAA, Federal Trade Commission Act and other laws and regulations involving the use of web tracking tools in their websites, patient portals and mobile apps.

That includes the use of tracking tools that lead to impermissible disclosures of individuals’ PHI and other sensitive information with third-parties without their knowledge or consent (see: Feds Publicly Name 130 Healthcare Firms Using Web Trackers).

During the Biden administration, HHS’ Office for Civil Rights released guidance materials that warn about such potential HIPAA violations related to online trackers. So far, the agency has not issued an enforcement action in any web tracking cases (see: Tracker Backtrack: Feds Revise HIPAA Guidance on Web Tools).

But during the Biden administration, the FTC took several enforcement actions involving the use of trackers including at least two telehealth providers – BetterHelp and GoodRx – plus mobile fertility app vendor Premom. The cases involved the use of tracking tools that shared consumer’s sensitive health and personal information with third-party analytics and social media firms without individuals’ consent.

Besides the Kaiser Foundation incident, Blue Shield of California joins a long list of other HIPAA-regulated organizations that over the last few years have reported to HHS OCR major breaches involving the use of online trackers. Many of those other firms have faced proposed class action lawsuits related to those breaches.

That includes North Carolina-based healthcare provider Novant Health which last year agreed to pay $6.6 million to settle a consolidated class action lawsuit involving its use of tracking tools on its websites and patient portals (see: NC Health System Agrees to Pay $6.6M in Web Tracking Case).

Facebook parent company Meta also faces a proposed consolidated class action in a California federal court alleging it violated privacy law by collecting patient information via its Pixel tracker, including data on doctors, conditions and appointments (see: Judge Denies Meta’s 2nd Try to Dismiss Pixel Privacy Case).

Regulatory attorney Paul Hales of the Hales Law Group predicts that Blue Shield of California will soon be facing similar lawsuits related to its breach.

“Blue Shield of California is a ripe target for class action lawsuits. Plaintiff lawyers will take advantage of California’s strict privacy statutes,” he said.

“Privacy risks related to web tracking tools have been highly publicized since OCR issued a warning in 2022. Plaintiffs will no doubt argue that failure to address this issue is ‘egregious’ negligence,” he said.

Complicated Matters

Many, if not most healthcare companies that use web tracking tools are caught unaware of potential data privacy problems “because they either don’t fully know what their analytics tools are collecting, or they don’t know how to set up Google Analytics correctly,” said Ian Cohen, CEO of Lokker, a provider of online data privacy and compliance solutions. “Third-party data collection is complicated.”

The incident involving Blue Shield of California represents “a technical breach” where misconfigured analytics tools led to the unintended sharing of PHI with Google Ads, said Geoffrey Golliher, Lokker’s CTO.

“While Google’s internal policies provide a layer of protection by restricting the use of such data for personalized advertising, the initial transmission of sensitive information still poses compliance concerns under regulations like HIPAA,” he said.

Organizations can take steps to help avoid major data privacy blunders involving their use of trackers, Cohen said. “My overarching message to all companies, not just in healthcare, you must invest in a thorough privacy audit ASAP, get a gap analysis and set up ongoing processes to review at least monthly,” he said.

“This is a serious problem that is pervasive and complicated. You have to think beyond mere compliance.”

The use of Google web trackers by the healthcare sector is also especially risky from a HIPAA perspective because “Google does not represent Google Analytics as HIPAA-compliant and will not sign a business associate agreement with users,” Hales said.

“However, Google Analytics trackers are easy to find and remove,” Hales said. “IT companies created a market segment by removing tracking technology threats for HIPAA-regulated entities,” Hales contends.

Integrating Google Analytics with Google Ads in healthcare settings “presents both compliance challenges and built-in mitigations,” Golliher said. “While disconnecting these services is a prudent step, understanding Google’s internal policies can provide additional context on data protection measures.”