Novant Health data breach: what happened and what to do

In 2022 Novant Health told patients that a tracking pixel on its website sent some of their data to Meta. HHS lists 1,362,296 people. Email addresses, IP addresses, phone numbers and treatment details may have been involved. No Social Security numbers.

View all 13,177 breaches

Breach date: 17 Jun 2022
Made public: 14 Aug 2022
Affected: 1,362,296
Data exposed: Email addresses, IP addresses, Phone numbers, Medications, Treatment information
Last updated: 30 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Novant Health, a hospital system in the Carolinas, told patients in August 2022 that a tracking pixel on its website had sent some of their information to Meta, the company behind Facebook. The pixel (a small piece of code advertisers use to measure how well ads work) was set up for a 2020 Facebook ad campaign and also ran on the MyChart patient portal. Novant has said it removed the pixel after it found the problem, and that it determined on June 17, 2022 that sensitive information may have been disclosed.

This wasn't a break-in. Nobody stole a database. The information went to Meta through the pixel, and what was sent depended on what each person did on the site.

Sources checked: ocrportal.hhs.gov, securityweek.com, healthitsecurity.com

Last verified against the official page: 30 Oct 2026

How we research this Report an error

How many people and what was exposed

Novant reported the incident to the U.S. Department of Health and Human Services as affecting 1,362,296 people. According to reporting on its notice, the information may have included email addresses, IP addresses, phone numbers, and details such as appointment type and date, medications and other treatment information. Novant has said financial information and Social Security numbers weren't affected, and that it has no evidence anyone acted on the data.

What that means for you

Contact details and the fact that you were a patient are enough to make phishing and text scams believable. Expect messages that mention appointments, billing or your patient account. Because Social Security numbers weren't involved, identity theft is a lower risk here than in most health breaches, but the usual care with unexpected messages applies.

The company's response

Novant removed the pixel, notified patients and the media, posted a notice on its website, revised its policies and offered complimentary credit monitoring, according to HHS's summary. HHS's Office for Civil Rights gave Novant technical assistance on the HIPAA Breach Notification Rule.

What to do if you were in it

1

Treat messages about your care with suspicion

Your email and phone number may be linked to Novant. Don't click links or call numbers in unexpected texts or emails about appointments or bills. Go to the patient portal or call the number on your card.
2

Read the notice you got and use any credit monitoring offered

Novant offered complimentary credit monitoring. If you received a letter, follow its instructions to enroll. The FTC recommends taking free monitoring if it's offered.
3

Check your insurer's statements

Look at explanation of benefits statements for treatment you didn't receive and report anything odd to your insurer.
4

Consider a credit freeze

A freeze is free and blocks most new accounts in your name. Place it separately at Equifax, Experian and TransUnion. It's optional here, since Social Security numbers weren't involved.
5

Check whether your email or phone is in this and other breaches

Run a free Serus scan to see which breaches include your email or phone number. Serus alerts you when you show up in a new one.

Official filings

U.S. Department of Health and Human Services , filed 14 Aug 2022 : 1,362,296 people

Timeline

17 Jun 2022
The breach happened
14 Aug 2022
The company made it public
14 Aug 2022
Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the Novant Health breach?

Novant notified the people it determined were affected. If you used its website or MyChart around the time of the 2020 campaign and got no letter, ask Novant directly.

What was exposed?

Reporting on the notice lists email addresses, IP addresses, phone numbers, appointment details, medications and other treatment information. Novant said financial information and Social Security numbers weren't affected.

Was this a hack?

No. The data went to Meta through a tracking pixel on Novant's site, not through a criminal break-in. Novant says it has no evidence the data was acted on.

Should I change my password?

Passwords weren't reported as exposed. There's no need unless you reuse your patient portal password elsewhere, in which case a unique one is a good idea anyway.