Novant Health notifies patients of possible disclosure of protected health information
WILMINGTON, NC (WWAY) — A Novant Health incident tracing back to May of 2020 is just now coming to light.
Novant Health recently began mailing letters to some of its patients following possible disclosure of protected health information (PHI) resulting from an incorrect configuration of a pixel, an online tracking tool.
In May of 2020, Novant Health says they launched a promotional campaign to connect more patients to the Novant Health MyChart patient portal, with the goal of improving access to care through virtual visits and provide increased accessibility to counter the limitations of in-person care.
This campaign involved Facebook advertisements and a Meta (Facebook parent company) tracking pixel placed on the Novant Health website to help understand the success of those efforts on Facebook. In this case, the pixel was configured incorrectly and may have allowed certain private information to be transmitted to Meta from the Novant Health website and MyChart portal, according to a press release.
Novant Health says once they made the discovery, they disabled and removed the pixel as a precaution and began an investigation to learn whether, and to what extent, information was transmitted.
Based on that investigation, Novant Health determined on June 17, 2022, that it was possible sensitive information or PHI might have been disclosed to Meta, depending upon a user’s activity within the Novant Health website and MyChart portal.
This information potentially included an impacted patient’s: demographic information such as email address, phone number, computer IP address, and contact information entered into Emergency Contacts or Advanced Care Planning; and information such as appointment type and date, physician selected, button/menu selections, and/or content typed into free text boxes.
The information did not include Social Security numbers or other financial information unless it was typed into a free text box by the user.
Novant Health says the letter sent to each patient will specifically state whether such financial information may have been involved.
The health organization is sending letters to all potentially impacted patients, including some who are patients of independent physicians and facilities who use the Novant Health MyChart medical record. Novant Health says they have also implemented more structure, governance and policies around the use of pixels and is taking actions to ensure this does not happen again.
New Hanover Regional Medical Center patients are not impacted by this incident, according to Novant Health.
