More Than One-Fourth of Healthcare Websites Fail Core Privacy Tests

Posted by Steve Alder

A recent study conducted by Datatrue on the most visited U.S. websites found that more than 4 in 10 websites failed its core privacy tests. The study was conducted on the top 242 most visited U.S. websites between October 12 and 13, 2026. The websites spanned several sectors, including 50 healthcare websites. Datatrue found a clear gap between what website visitors are offered in terms of privacy and what they are provided.

For the study, Datatrue assessed each of the websites three times with the Global Privacy Control (GPC) signal switched on. This is a browser setting that instructs websites that the visitor does not want to have their data sold or shared. Datatrue assessed whether there was any ad tracking – the sending of visitor data to ad tech firms, social media companies, or audience data or ID companies; whether there was a clear option available to website users to opt out of tracking, such as “reject all” or “only accept essential” tracking options; and if session replay was started upon landing on the site. Session replay records clicks and scrolls before the visitor has made any choice, allowing the site owner to replay the visit later.

Across all sectors represented in the study, healthcare performed best overall for website visitor privacy, with the lowest levels of ad tech. Healthcare websites had a median of 1.5 ad companies per site and the lowest percentage of sites (28%) failing Datatrue’s core data privacy tests. The next best sector was media with a 40% failure rate. Healthcare sites also had the second-lowest rate of session replay on arrival (18%), ahead of media (12%)

The study found that while hospital sites had low levels of ad tech, they often failed to respect visitor choices. Out of the 50 sites, 18 were found to contact ad or social media companies before visitors were given a choice. Out of those 18 sites, 14 did nothing when GPC was switched on, 2 sites cut some of the tracking, and only 2 sites stopped all tracking. With only a 7% drop in ad domains with GPC enabled, healthcare performed worst out of all sectors.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Similar to other sectors, healthcare performed poorly for failing to provide web visitors with an obvious opt-out option. Out of the 50 healthcare sites, 32 had no opt-out option, 7 had an opt-out option that wasn’t obvious, and 11 had an obvious opt-out choice. Out of the 50 sites, 9 started session replay on arrival before giving visitors a choice.

The study confirmed that perfect user privacy is possible, although it is rare, as only 3 sites out of the 242 tested passed all core privacy tests. Respecting visitor privacy matters as regulators have started to take action, with California having imposed financial penalties for privacy failures. Datatrue recommends giving visitors a clear choice on-screen upon site arrival; ensuring that every tag that shares or sells data is switched off if GPC is enabled; holding session replay until consent is given by a visitor; removing any ad tracking code that is no longer used; and testing what a page sends when a visitor rejects tracking to make sure that their choice is honored.

The post More Than One-Fourth of Healthcare Websites Fail Core Privacy Tests appeared first on The HIPAA Journal.

Vendor Incident Affects 341,000 Blueberry Pediatrics Patients

Posted by Steve Alder

Blueberry Pediatrics, a telemedicine service provider that offers subscribers access to board-certified pediatricians, has been affected by a data security incident involving a third-party tool called Metabase. The incident resulted in the theft of the sensitive data of 340,915 individuals.

Metabase, a business intelligence and data visualization platform used by more than 100,000 organizations, was found to contain a critical vulnerability. On August 22, 2026, Blueberry Pediatrics learned that the vulnerability had been exploited by a hacker who obtained a copy of patient data. Metabase was also used by Photon, a prescription service provider used by Blueberry Pediatrics, that exposed a subset of the same information. On August 24, 2026, Photon advised Blueberry Pediatrics that the vulnerability had also been exploited by a different threat actor, who also obtained a copy of patient data.

Blueberry Pediatrics has analyzed the impacted data and determined that the stolen data included patient information such as names, dates of birth, health plan names and policy numbers, medical records, dates of service, medical codes, and charges for services. Individuals impacted by the incident at Photon had their names, addresses, phone numbers, email addresses, member IDs, and/or medication information compromised. Blueberry Pediatrics has confirmed that photos and videos provided by patients were stored separately and were not compromised in the incident, and financial information and Social Security numbers were not involved.

Blueberry Pediatrics said immediate action was taken when it was notified about the vulnerability by Metabase and applied the patch to fix the vulnerability within hours; however, a threat actor already had access to its data. The access was immediately blocked, and after patching, passwords and security protocols were changed. Additional steps have been taken to harden security, including strengthening authentication controls, increasing the frequency of security reviews, and implementing an additional monitoring and escalation process for critical vendor vulnerabilities.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Because the same data was exposed in multiple incidents, some of the affected individuals are likely to receive more than one breach notice. The data breach is not currently shown on the HHS Office for Civil Rights breach portal; however, the Oregon Attorney General was informed that 340,915 individuals were affected. The Texas Attorney General received two breach reports, one involving the information of 60,581 state residents and the other affecting 7,249 state residents.

The post Vendor Incident Affects 341,000 Blueberry Pediatrics Patients appeared first on The HIPAA Journal.

Government Initiative Provides Free Cybersecurity Upgrades and Security Services to Rural Hospitals

Posted by Steve Alder

Small and rural healthcare providers lack the resources they need to make essential improvements to their information security programs to defend against cyberattacks. One of the biggest criticisms of the proposed update to the HIPAA Security Rule was the cost of implementation, especially for small, rural, and other underserved healthcare providers, who simply do not have the spare funds to make the required improvements or, in many cases, the staff to implement them.

While the proposed HIPAA Security Rule update attracted considerable criticism, a healthcare cybersecurity bill was unanimously passed by the Senate that calls for Congress to provide grants to underserved hospitals to help them make vital improvements to cybersecurity. The bill has been sent to the House; however, if it is passed and is signed into law by the President, Congress would need to approve the funding, so it could be many months before any grants are made available.

Some help may be on the way for rural hospitals in the meantime. On Monday, the White House Office for the National Cyber Director (ONCD) announced the Project Lifeline 250 initiative. Similar to the Project Watershed 250 project announced in Texas in late August to help state water and wastewater companies implement cybersecurity tools, Project Lifeline 250 is a pilot program to help rural hospitals make essential upgrades to cybersecurity, such as replacing vulnerable legacy systems that are easy targets for cybercriminals.

Project Lifeline 250 is a six-month pilot program that will provide free hardware upgrades and cybersecurity services to rural hospitals through partnerships with IT and cybersecurity companies such as Abnormal AI, Cisco, Cyera, Forescout Technologies, Infoblox Security Solutions, Microsoft, Palo Alto Networks, ServiceNow, Trelix, and Zscaler. Those companies have agreed to provide hardware and services to rural hospitals in South Carolina, allowing them to upgrade basic cybersecurity defenses free of charge. They include providing assistance with the identification and upgrading of vulnerable legacy technology, implementing AI-powered detection and response services, and providing backup drives to help the hospitals maintain critical services in the event of a cyberattack.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Similar to the Project Watershed 250 initiative, Project Lifeline 250 will be tested in a single state before a planned nationwide rollout. “Project Lifeline 250 connects the world-leading American industry with rural hospitals and uses the greatest American tools and capabilities to defend hospital networks; deploy physical backup devices after an initial incident to ensure an impacted hospital can still provide critical care; and identify high-risk and legacy devices and replace them,” said South Carolina Governor Henry McMaster, at the launch of the initiative at Newberry Health on Monday. While the announcement has been made, it was light on detail. It is unclear when the initiative will commence or how it will be funded if it is rolled out nationwide.

The post Government Initiative Provides Free Cybersecurity Upgrades and Security Services to Rural Hospitals appeared first on The HIPAA Journal.