The federal government has warned hospitals that using third-party analytics tools on their websites could violate HIPAA, and more than 20 hospitals are facing class-action lawsuits over the use of these tools. But a recent analysis found that hospitals are doing a poor job of fixing their websites and preventing patient data collection.

Three senators recently introduced legislation that would ban the use of health data for advertising and marketing purposes. The proposed legislation comes amid media reports claiming that data brokers are selling social media companies patients’ location data, as well as reports that hospitals and digital health startups are collecting patients’ online data and sharing it with tech giants such as Facebook and Google.

In 2022, the healthcare sector is on track to meet or exceed the more than 50.4 million patient records that were breached last year. As we look ahead to 2023, increasing cybersecurity budgets will be a necessity for healthcare organizations, despite their tight financial circumstances.

ECRI recently issued an alert warning hospitals about the cybersecurity risks associated with the use of third-party analytics tools, such as Meta Pixel, Google Analytics and Adobe Analytics. When providers install these tools on their websites and patient portals, they may be exposing patient data — which tech companies can use to target medical-related ads to consumers as they browse the Internet.

Meta developed software to analyze and connect insights across millions of scientific papers, according to a description of the company on Chan Zuckerberg Initiative’s Facebook page.