You are about to leave Risk Strategies website and view the content of an external website.
You are leaving risk-strategies.com
By accessing this link, you will be leaving Risk Strategies website and entering a website hosted by another party. Please be advised that you will no longer be subject to, or under the protection of, the privacy and security policies of Risk Strategies website. We encourage you to read and evaluate the privacy and security policies of the site you are entering, which may be different than those of Risk Strategies.
Capturing customer data is a popular practice, with websites using the information to generate revenue or conduct market research. One method of data capture known as “pixel tracking” involves collecting and tracking user information from web pages and marketing, newsletter, and transactional emails. Already in widespread use, pixel tracking has raised concerns in the healthcare industry due to the potential for indirect exposure of patients’ protected health information (PHI). A violation of privacy can run afoul of HIPAA regulations (Health Insurance Portability and Accountability Act).
Pixel tracking – also known as web beacon tracking or pixel tags – involves embedding a small bit of code into a web page or email that sends a request to a server when a user interacts with the content. This collects information such as the user's IP address, browser type, device details, and behavioral data. Marketers can use the information to analyze user behavior, personalize advertising, or measure an advertising campaign’s effectiveness.
Pixel tracking can result in HIPAA violations as it involves collecting and tracking user data that may include PHI. If healthcare organizations use pixel tracking techniques without sufficient safeguards, they can inadvertently expose patients' PHI, violating HIPPA standards and resulting in hefty fines, damage to the organization's reputation, and loss of patients' trust. Pixel tracking can also open the door to unauthorized third parties obtaining sensitive healthcare data, making patients vulnerable to identity theft and other forms of financial fraud.
The practice has prompted aggressive law firms to file lawsuits in an effort to hold healthcare organizations accountable for potential breaches of privacy. While some healthcare organizations may argue that they have met requirements, the ever-changing nature of HIPAA regulations requires increased vigilance. Hospitals must take proactive measures to ensure the security of patient data and prevent any further violations of privacy.
Amid growing concerns over privacy violations and data breaches, insurance carriers have started introducing policy exclusions that absolve them of any liability related to pixel or meta-pixel tracking. This move has raised the alarm for healthcare organizations, as they potentially could face expensive litigation costs.
To avoid such scenarios, organizations can implement the following proactive measures to mitigate possible pixel tracking litigation in compliance with the Office of Civil Rights (OCR) and Federal Trade Commission (FTC):
Healthcare organizations must communicate with their marketing teams and vendors to verify whether pixel tracking is being used to collect user data. Even if an organization uses third-party software, they are still liable if a patient's PHI is breached. While taking proactive measures can reduce the risk of litigation and breaches, audits conducted by legal teams can provide additional benefits for risks missed or unseen. Regularly meeting with a broker and staying informed of cyber renewals can assist healthcare organizations in their efforts to prevent litigation and protect patient privacy.
Want to learn more?
Find Allen on LinkedIn, here.
Connect with the Risk Strategies Cyber team at email@example.com.
About the author
Allen Blount leads the Cyber Team at Risk Strategies. He specializes in both cyber insurance and tech E&O (errors and omissions). Prior to this role, he spent 12 years with Zurich North America, gaining extensive experience as a Cyber and Professional Liability Underwriting Manager. Before his insurance career, he practiced law.