Mental Health Startup Cerebral Exposed Patient Data to Meta, Google, and TikTok.

03/13/2023 6:37 AM

235

mental-health-startup-cerebral-exposed-patient-data-to-meta,-google,-and-tiktok.

Cerebral Telehealth Startup Accidentally Shares Personal Information of Over 3.1 Million Patients with Google, Meta, and TikTok

Cerebral, a telehealth startup that gained popularity during the early stages of the pandemic, has recently disclosed that it inadvertently shared the personal information of over 3.1 million patients in the United States with social media giants Google, Meta, and TikTok. The company had been using tracking scripts, known as “pixels,” offered by Meta to third-party developers for advertising since October 2019.

Upon reviewing its software, Cerebral discovered that it had disclosed certain information that may be regulated as protected health information under the Health Insurance Portability and Accountability Act. This information includes patients’ names, phone numbers, birth dates, and insurance information. The company may have also exposed information collected through mental health self-assessments completed by patients to schedule counseling appointments. However, no social security numbers, bank information, or credit card numbers were shared by the company in the process, as stated by Cerebral.

After discovering the mishap, Cerebral acted swiftly to disable, reconfigure, and remove the tracking pixels that were responsible for exposing the data. The company has also strengthened its information security practices and technology vetting procedures to minimize the risk of similar incidents occurring in the future. The US Department of Health and Human Services is currently investigating the matter, following the Federal Trade Commission’s $1.5 million fine against GoodRx for sharing patient data with Meta and Google. Additionally, the agency announced earlier this month that it had reached a $7.8 million settlement with online counseling firm BetterHelp and was seeking to prohibit the company from sharing health information for ad targeting purposes.