How Covered California sent patient’s personal health data to LinkedIn

By Tomas Apodaca and Colin Lecher CalMatters The website that lets Californians shop for wellness insurance under the Affordable Care Act coveredca com has been sending sensitive material to LinkedIn forensic testing by CalMatters has revealed As visitors filled out forms on the website trackers on the same pages narrated LinkedIn their answers to questions about whether they were blind pregnant or used a high number of prescription medications The trackers also monitored whether the visitors commented they were transgender or attainable casualties of domestic abuse See the details on our Github repo Related Articles DOGE cuts hit SJSU UC Berkeley UCSF Researcher says I don t know that they understood what I was doing El Camino Soundness breaks ground on rehab hospital in Sunnyvale Cancer Aid Group s Lafayette expansion reflects a different approach to recovery care How changes to Regional Clinical Center s trauma care heavily impacted vitality services in Santa Clara County Stanford analysis When measles could return if vaccination rates continue to fall Covered California the organization that operates the website removed the trackers as CalMatters and The Markup informed this article The organization commented they were removed due to a marketing agency transition in early April In a report Kelly Donohue a spokesperson for the agency verified that information was sent to LinkedIn as part of an advertising campaign Since being informed of the tracking all current advertising-related tags across our website have been turned off out of an abundance of caution she added Covered California has initiated a review of our websites and information precaution and privacy protocols to ensure that no analytics tools are impermissibly sharing sensitive consumer information Donohue commented adding that they would share additional findings as they become available taking any necessary approaches to safeguard the precaution and privacy of consumer details When an individual indicated they were pregnant the information was sent to LinkedIn via the Insight Tag Visitors who filled out robustness information on the site may have had their details tracked for more than a year according to Donohue who stated the LinkedIn campaign began in February CalMatters observed the trackers directly in February and March of this year It established the bulk ad trackers including the Meta pixel tracker as well as all third-party cookies have been removed from the site as of April Since more than million Americans have signed up for wellness insurance through state exchanges like Covered California They were set up under the Affordable Care Act signed into law by President Barack Obama years ago States can either operate their exchange websites in partnership with the federal ruling body or independently as California does Covered California operates as an independent entity within the state establishment Its board is appointed by the governor and Legislature In March Covered California released that after four years of increasing enrollment a record of nearly million people were covered by wellbeing insurance through the activity In all the organization explained about one in six Californians were at one point enrolled through Covered California Between and the uninsured rate fell from to according to the organization the largest drop of any state during that time period This coincided with a series of eligibility expansions to Medi-Cal the state s strength insurance initiative for lower-income households Experts expressed alarm at the idea that those millions of people could have had sensitive vitality input sent to a private company without their knowledge or consent Sara Geoghegan senior counsel at the Electronic Privacy Information Center explained it was concerning and invasive for a robustness insurance website to be sending evidence that was wholly irrelevant to the uses of a for-profit company like LinkedIn It s unfortunate she revealed because people don t expect that their fitness information will be collected and used in this way The LinkedIn Insight Tag CalMatters and The Markup in latest months scanned for trackers on hundreds of California state and county regime websites that offer services for undocumented immigrants using Blacklight an automated tool developed by The Markup for auditing website trackers CalMatters detected that Covered California had more than trackers on its site Out of more than of the governing body sites the average number of trackers on the sites was three Covered California had dozens more than any other website we examined On coveredca com trackers from well-known social media firms like Meta collected information on visitor page views while lesser-known analytics and media campaign companies like email marketing company LiveIntent also followed users across the site But by far the majority sensitive information was transmitted to LinkedIn While certain of the content sent to LinkedIn was relatively innocuous such as what pages were visited Covered California also sent the company detailed information when visitors selected doctors to see if they were covered by a plan including their specialization The site also communicated LinkedIn if someone searched for a specific hospital When an individual selected a medicinal provider the information was sent to LinkedIn via the Insight Tag In addition to demographic information including gender the site also shared details with LinkedIn when visitors selected their ethnicity and marital status and when they explained coveredca com how often they saw doctors for surgery or outpatient medicine When an individual selected their ethnicity the information was sent to LinkedIn via the Insight Tag LinkedIn like other large social media firms offers a way for websites to easily transmit figures on their visitors through a tracking tool that the sites can place on their pages In LinkedIn s event this tool is called the Insight Tag By using the tag businesses and other organizations can later target advertisements on LinkedIn to consumers that have already shown interest in their products or services For an e-commerce site a tracker on a page might be able to note when someone added a product to their cart and the business can then send ads for that product to the same person on their social media feeds A wellbeing care marketplace like Covered California might use the trackers to reach a group of people who might be interested in a reminder of a deadline for open wellbeing insurance enrollment for example In its comment Covered California noted the usefulness of these tools saying the organization leverages LinkedIn s advertising platform tools to understand consumer behavior and deliver tailored messages to help them make informed decisions about their wellbeing care options When an individual indicated they were a victim of domestic abuse or spousal abandonment the information was sent to LinkedIn via the Insight Tag Trackers can also be valuable to the social media companies that offer them In addition to driving ad sales they provide an opportunity to gather information on visitors to websites other than their own On its informational page about the Insight Tag LinkedIn places the burden on websites that employ the tag not to use it in risky situations The tag should not be installed on web pages that collect or contain Sensitive Records the page advises including pages offering specific health-related or financial services or products to consumers LinkedIn spokesperson Brionna Ruff commented in an emailed report Our Ads Agreement and documentation expressly prohibit customers from installing the Insight Tag on web pages that collect or contain sensitive records including pages offering health-related services We don t allow advertisers to target ads based on sensitive input or categories Legal recourse Collection of sensitive information by social media trackers has in previous instances led to removal of the trackers lawsuits and scrutiny by state and federal lawmakers For example after The Markup in revealed the Department of Guidance sent personal information to Facebook when students applied for college financial aid online the department turned off the sharing faced questions from two members of Congress and was sued by two advocacy groups who sought more information about the sharing Other stories in the same series about trackers known as the Pixel Hunt also led to changes and blowback including a crackdown by the Federal Business Commission on telehealth companies transmitting personal information to companies including Meta and Google without user consent and proposed class action lawsuits over information shared through trackers with drug stores healthcare providers and tax prep companies LinkedIn is already facing multiple proposed class-action lawsuits related to the collection of diagnostic information In October three new lawsuits in California courts alleged that LinkedIn violated users privacy by collecting information on health appointment sites including for a fertility clinic Social media companies tracking practices have underpinned the tremendous expansion of the tech industry but meager web users are aware of how far the tracking goes This absolutely contradicts the expectation of the average consumer Geoghegan commented In California a law called the California Confidentiality of Curative Information Act governs the privacy of anatomical information in the state Under the act consumers must give permission to a few organizations before their biological information is disclosed to third parties Companies have faced litigation under the law for using web tracking technologies although those suits have not consistently been triumphant Geoghegan explained current protections like these don t go far enough in helping consumers protect their sensitive records This is an exact example of why we need better protections she mentioned of LinkedIn receiving the evidence This is sensitive vitality information that consumers expect to be protected and a lack of regulations is failing us