More Than One-Fourth of Healthcare Websites Fail Core Privacy Tests

Posted by Steve Alder

A recent study conducted by Datatrue on the most visited U.S. websites found that more than 4 in 10 websites failed its core privacy tests. The study was conducted on the top 242 most visited U.S. websites between October 12 and 13, 2026. The websites spanned several sectors, including 50 healthcare websites. Datatrue found a clear gap between what website visitors are offered in terms of privacy and what they are provided.

For the study, Datatrue assessed each of the websites three times with the Global Privacy Control (GPC) signal switched on. This is a browser setting that instructs websites that the visitor does not want to have their data sold or shared. Datatrue assessed whether there was any ad tracking – the sending of visitor data to ad tech firms, social media companies, or audience data or ID companies; whether there was a clear option available to website users to opt out of tracking, such as “reject all” or “only accept essential” tracking options; and if session replay was started upon landing on the site. Session replay records clicks and scrolls before the visitor has made any choice, allowing the site owner to replay the visit later.

Across all sectors represented in the study, healthcare performed best overall for website visitor privacy, with the lowest levels of ad tech. Healthcare websites had a median of 1.5 ad companies per site and the lowest percentage of sites (28%) failing Datatrue’s core data privacy tests. The next best sector was media with a 40% failure rate. Healthcare sites also had the second-lowest rate of session replay on arrival (18%), ahead of media (12%)

The study found that while hospital sites had low levels of ad tech, they often failed to respect visitor choices. Out of the 50 sites, 18 were found to contact ad or social media companies before visitors were given a choice. Out of those 18 sites, 14 did nothing when GPC was switched on, 2 sites cut some of the tracking, and only 2 sites stopped all tracking. With only a 7% drop in ad domains with GPC enabled, healthcare performed worst out of all sectors.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Similar to other sectors, healthcare performed poorly for failing to provide web visitors with an obvious opt-out option. Out of the 50 healthcare sites, 32 had no opt-out option, 7 had an opt-out option that wasn’t obvious, and 11 had an obvious opt-out choice. Out of the 50 sites, 9 started session replay on arrival before giving visitors a choice.

The study confirmed that perfect user privacy is possible, although it is rare, as only 3 sites out of the 242 tested passed all core privacy tests. Respecting visitor privacy matters as regulators have started to take action, with California having imposed financial penalties for privacy failures. Datatrue recommends giving visitors a clear choice on-screen upon site arrival; ensuring that every tag that shares or sells data is switched off if GPC is enabled; holding session replay until consent is given by a visitor; removing any ad tracking code that is no longer used; and testing what a page sends when a visitor rejects tracking to make sure that their choice is honored.

The post More Than One-Fourth of Healthcare Websites Fail Core Privacy Tests appeared first on The HIPAA Journal.

Vendor Incident Affects 341,000 Blueberry Pediatrics Patients

Posted by Steve Alder

Blueberry Pediatrics, a telemedicine service provider that offers subscribers access to board-certified pediatricians, has been affected by a data security incident involving a third-party tool called Metabase. The incident resulted in the theft of the sensitive data of 340,915 individuals.

Metabase, a business intelligence and data visualization platform used by more than 100,000 organizations, was found to contain a critical vulnerability. On August 22, 2026, Blueberry Pediatrics learned that the vulnerability had been exploited by a hacker who obtained a copy of patient data. Metabase was also used by Photon, a prescription service provider used by Blueberry Pediatrics, that exposed a subset of the same information. On August 24, 2026, Photon advised Blueberry Pediatrics that the vulnerability had also been exploited by a different threat actor, who also obtained a copy of patient data.

Blueberry Pediatrics has analyzed the impacted data and determined that the stolen data included patient information such as names, dates of birth, health plan names and policy numbers, medical records, dates of service, medical codes, and charges for services. Individuals impacted by the incident at Photon had their names, addresses, phone numbers, email addresses, member IDs, and/or medication information compromised. Blueberry Pediatrics has confirmed that photos and videos provided by patients were stored separately and were not compromised in the incident, and financial information and Social Security numbers were not involved.

Blueberry Pediatrics said immediate action was taken when it was notified about the vulnerability by Metabase and applied the patch to fix the vulnerability within hours; however, a threat actor already had access to its data. The access was immediately blocked, and after patching, passwords and security protocols were changed. Additional steps have been taken to harden security, including strengthening authentication controls, increasing the frequency of security reviews, and implementing an additional monitoring and escalation process for critical vendor vulnerabilities.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Because the same data was exposed in multiple incidents, some of the affected individuals are likely to receive more than one breach notice. The data breach is not currently shown on the HHS Office for Civil Rights breach portal; however, the Oregon Attorney General was informed that 340,915 individuals were affected. The Texas Attorney General received two breach reports, one involving the information of 60,581 state residents and the other affecting 7,249 state residents.

The post Vendor Incident Affects 341,000 Blueberry Pediatrics Patients appeared first on The HIPAA Journal.