Meta Pixel Tracking in Hospitals: Patient Data Sent to Facebook Without Consent

Investigative reporting by The Markup revealed that Meta Pixel tracking code was installed on the websites of 33 of the top 100 hospitals in America, transmitting sensitive patient data to Facebook. The tracking pixel sent information about doctor appointments, health conditions searched, and patient portal interactions directly to Meta servers, linked to user IP addresses and Facebook identifiers. In some cases, data transmitted included specific health conditions, prescription information, and appointment details. HIPAA experts noted the transmissions likely violated federal health privacy law since patients never consented to sharing medical browsing data with a social media company. Multiple class-action lawsuits were filed, and the HHS Office for Civil Rights issued guidance clarifying that tracking technologies on patient-facing pages create HIPAA liability. Several hospital systems removed Meta Pixel only after media exposure, having been unaware of what data the tracking code captured.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.