A Rutgers-led study found hospitals that use third-party tracking pixels on their websites were significantly more likely to experience data breaches.
Researchers at Rutgers Business School-Newark and New Brunswick analyzed 12 years of website data from 1,201 hospitals and found that 66% used third-party tracking pixels, according to the study published in PNAS Nexus. Hospitals using the technology were 46% more likely to experience a data breach, researchers found.
Tracking pixels are small pieces of code embedded in websites that collect information about user activity, such as browsing behavior and Internet Protocol addresses, and send that data to outside companies including Meta and Google. Hospitals commonly use the tools for marketing, analytics and monitoring public interest in certain diseases.
Unlike cookies, which users can block or delete, tracking pixels operate within a website’s code and generally begin transmitting information as soon as a webpage loads.
The study comes amid increasing regulatory scrutiny over hospitals’ use of tracking technologies. In December 2022, HHS issued guidance stating that IP addresses tied to visits to hospital webpages could qualify as protected health information under HIPAA.
The following year, HHS and the Federal Trade Commission sent warning letters to 130 healthcare providers regarding the use of online tracking technologies. The American Hospital Association later filed a lawsuit challenging the federal guidance, arguing it represented regulatory overreach, according to the release.
Researchers also pointed to recent high-profile incidents involving tracking pixels. Advocate Aurora Health, now part of Advocate Health in Charlotte, N.C., disclosed in 2022 that tracking technologies on its website exposed data from about 3 million patients. In 2023, Community Health Network in Indianapolis reported a similar breach affecting approximately 1.5 million patients.
Hilal Atasoy, PhD, an associate professor at Rutgers Business School-Newark and New Brunswick who led the study, said hospitals may not fully understand how many tracking tools are embedded in commercial software systems or the extent of the data being collected.
Despite growing attention from regulators, researchers found hospital use of tracking pixels continued to rise through 2023. Researchers also found hospitals that developed their own analytics software did not experience a corresponding increase in breaches because the data collected by their tracking tools was not shared with third parties. However, the study noted that only large, well-funded health systems typically have the resources to build custom software.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
