WakeMed Notifies Patients of Potential Data Privacy Incident

RALEIGH, N.C. (October 14, 2022) – Protecting the privacy and security of patient health information is and always has been one of WakeMed’s highest priorities. In support of WakeMed’s core principles of demonstrating transparency, accountability, integrity, and honesty, the health system is notifying some patients of the potential that select data entered by visitors to two specific WakeMed websites may have been transmitted to Facebook (now Meta) in error.

WakeMed, like most companies, uses technology and software for website optimization and to improve the user experience. One way to collect anonymous user information is through a “pixel,” which is a piece of software code that helps measure user activity online. A pixel serves “cookies” when a user visits a website, which allows certain activities on that website to be tracked and analyzed.

In March 2018, WakeMed placed pixel, provided by Facebook, on its website (www.wakemed.org) and on the WakeMed MyChart patient portal (https://mychart.wakemed.org). WakeMed intended that the pixel collect anonymous data that would help WakeMed better connect members of our community with WakeMed’s MyChart patient portal, thereby improving access to their health care, and to help improve the WakeMed website.

Unfortunately, the pixel’s software code may have also transmitted some of the information entered into the MyChart patient portal and appointment scheduling page back to Facebook.

Depending on the user’s activity, the data that may have been transmitted to Facebook could have included information such as: email address, phone number, and other contact information; computer IP address; emergency contact information; information provided during online check-in, such as allergy or medication information; COVID vaccine status; and information about an upcoming appointment, such as appointment type and date, physician selected, and button/menu selections. The information did not include Social Security numbers or other financial information unless it was entered into a free text box by the user.

While WakeMed has been unable to determine whether Facebook actually collected or used any of the information sent from its pixel, as a precaution, WakeMed is notifying all individuals who logged into a WakeMed MyChart account and/or scheduled an appointment on the WakeMed website between March 2018 and May 2022. The pixel was not placed on the MyChart mobile app, and no information shared/entered through the app was transmitted.

WakeMed proactively disabled Facebook’s pixel in May 2022 and has no plans to use it in the future without confirmation that the pixel no longer has the capacity to transmit potentially sensitive or identifiable information.

WakeMed has initiated a comprehensive review of our policies and procedures related to gathering website user data and will make changes as needed to enhance privacy and prevent a situation like this from happening in the future.

At this time, WakeMed is unaware of any improper use or attempted use of any patient information by Meta or any other third party. According to its terms and conditions, Meta has policies and filters that block sensitive personal data from being incorporated into its advertising programs and does not use any such information.

Individuals who have questions or would like more information can email info@wakemed.org.

###

For Additional Information:

WakeMed Health & Hospitals


Kristin Kelly | Phone: 919-350-5921


Email: krkelly@wakemed.org