Advocate Aurora Health advocateaurorahealth.org Advocate Aurora Health data breach: what happened and what to do
In October 2022, Advocate Aurora Health reported that tracking technology on its websites sent patient information to outside recipients. It told HHS the incident affected 3,000,000 people. It said Social Security, financial account and card information was not involved.
View all 13,177 breaches- Breach date
- 14 Oct 2022
- Made public
- 14 Oct 2022
- Affected
- 3,000,000
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Advocate Aurora Health, a health system in Wisconsin and Illinois, reported to the US Department of Health and Human Services in October 2022 that web tracking technology had passed patient information to unauthorized recipients. The report counts 3,000,000 people. It wasn't a hack: the health system's own website setup shared the data.
What happened
Advocate Aurora used tracking pixels, small scripts from companies such as Meta and Google that measure how people use a site. Reporting on the notice says they were set up on patient-facing sites, including its patient portal, so details could reach those companies when someone was logged in to Facebook or Google. The health system disabled the pixels.
HHS later folded the report into an existing compliance review of the health system.
Sources checked: ocrportal.hhs.gov, healthcareitnews.com, securityweek.com
Last verified against the official page:
What was exposed
Press coverage of the notice describes appointment details, the patient's provider, the type of care, and IP address information. The health system said Social Security numbers and financial account or card information were not involved.
This kind of data won't open a bank account, but it links a person to a medical provider and a type of care. That's what makes a phishing text or call that mentions your doctor or an appointment sound real.
What to expect
There's nothing to reset on your side the way there is with a leaked password. The practical steps are about limiting tracking and watching for messages that use your health details.
What to do if you were in it
- 1
Expect messages that mention the breach
Don't click links in emails or texts about the breach or offering help with it. Go to the organization's site yourself or call the number on your own records.
- 2
Limit tracking in your browser
The notice advised patients to review privacy settings on Facebook and Google, and to block or delete cookies. A private browsing window also limits what carries over.
- 3
Check your health insurance statements
Read your explanation of benefits and question any care you didn't receive.
- 4
Check which other breaches include your details
Run a free Serus scan to see whether your email or phone appears in this or other breaches. Serus can't remove breach data, but it alerts you when your details turn up so you know when to act.
- 5
Report misuse
If someone opens accounts or files claims in your name, report it at IdentityTheft.gov to get a recovery plan.
Official filings
- U.S. Department of Health and Human Services , filed 14 Oct 2022 : 3,000,000 people
- U.S. Department of Health and Human Services , filed 16 Jul 2021 : 68,707 people
Timeline
-
Reported to U.S. Department of Health and Human Services
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Advocate Aurora Health breach?
The health system notified patients who used its patient sites while the pixels were active. If you got a letter or email, you were included.
What was exposed?
Reporting on the notice lists appointment details, provider and type of care, and IP address. The health system said Social Security, financial account and card information was not involved.
Do I need to freeze my credit?
Probably not, since identity numbers weren't involved. If you want extra protection, a freeze is free at the three credit bureaus.
Was this a hack?
No. The data went out through tracking code on the health system's own sites, which it then turned off.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- healthcareitnews.com/news/advocate-aurora-notifies-patients-potential-tracking-pixel-breach
- securityweek.com/data-3-million-advocate-aurora-health-patients-exposed-malformed-pixel/
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
