Mental health startup exposes the personal data of more than 3 million people

Excerpts from an article by Sean Lyngaas, CNN

WashingtonCNN — 

A mental health startup exposed the personal data of as many as 3.1 million people online. In some cases, possibly sensitive information on mental health treatment was leaked, according to a company statement and a Department of Health and Human services filing.

Cerebral, a California-based firm that connects people suffering from anxiety and depression with mental health professionals via video calls, said it discovered the “inadvertent” data exposure more than three years after it started using “pixels” – a common method that companies and advertisers use to track user behavior for marketing purposes.

The company determined in January that tracking pixels had been sharing client and user data to “third-party platforms” and “subcontractors” that it didn’t name, according to a privacy notice near the bottom of its website.

Cerebral said it was unaware of any misuse of the protected health information that was disclosed. But privacy advocates have for years warned that such data troves can be used to aggressively market products at consumers and infringe on their privacy.

Cerebral said in its public statement that it had disabled the tracking pixels on its platforms and stopped sharing data with subcontractors “not able to meet all HIPAA [Health Insurance Portability and Accountability Act] requirements.”

“It is important to note that Cerebral never impermissibly transmitted clinician generated notes or clinician communications,” the company told CNN.

Cerebral spokesperson Chris Savarese did not respond to emailed questions about which and how many platforms and contractors to which the company disclosed the client health information.

Some analysts argue that the broader market for data tracking tools is out of control. A group of conservative Catholics has spent millions of dollars to buy mobile data that identified priests who used gay dating and hookup apps, the Washington Post reported this week