Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
FIRST ON FOX: House Republicans are taking a stand against California’s public health insurance exchange, Covered California, by sending a formal letter that presses for clarity regarding claims of private patient data being shared with third-party entities. This initiative comes in the wake of accusations that sensitive health information has been leaked as part of a marketing strategy.
The letter, led by several members of the House Energy and Commerce Committee, seeks direct answers from Covered California, which is responsible for administering public health insurance to millions of residents in California. Republicans have raised concerns about reports indicating that the exchange shared private patient data with major companies such as LinkedIn and Google.
“Maintaining the confidentiality of health information is a fundamental responsibility for organizations functioning within the health insurance landscape,” the letter asserts. Signed by five influential Republican members, it highlights that federal privacy laws, particularly the Health Insurance Portability and Accountability Act, dictate strict expectations for how entities like Covered California should manage sensitive patient information.
In addition to federal standards, California law mandates that consumers must grant consent before their medical details can be disclosed to external organizations.
OVER 8 MILLION PATIENT RECORDS LEAKED IN HEALTHCARE DATA BREACH
The letter expresses alarm over recent reports and public documents that cast doubt on whether Covered California has adhered to these crucial privacy standards and whether current oversight mechanisms are effective at preventing unauthorized disclosures. The inquiry arises after public outcry in late April, when allegations suggested that Covered California transmitted sensitive patient data to LinkedIn via numerous tracking tools present on its website. Responding to the criticism, the health exchange removed these trackers shortly thereafter.
This backlash followed a thorough investigation by two nonprofit organizations, which revealed that Covered California’s website was disseminating answers to sensitive inquiries—ranging from pregnancy status to prescription drug usage—without patient consent or knowledge. This also included the sharing of demographic and other private information, with Covered California conceding that Social Security numbers were also disclosed.
Over 60 active tracking scripts were reportedly operating on the Covered California website, according to findings by Cal Matters, one of the organizations involved in the investigation. Notably, this number dramatically contrasts with the average of merely three trackers identified on over 200 government websites that were reviewed in the same study.
After Cal Matters published their findings and sparked public concern, Covered California stated that the tracking tools were part of a marketing initiative that began in February 2024. The organization promptly removed the trackers once data-sharing issues came to light in April.
5.5 MILLION PATIENTS’ INFORMATION EXPOSED BY MAJOR HEALTHCARE DATA BREACH
In a public statement issued following the Cal Matters report, Covered California explained that it utilized LinkedIn’s advertising platform, including LinkedIn Insight Tags, which are designed to monitor how users navigate the website. This tool helps the exchange understand consumer behavior and tailor messaging to enable informed decisions regarding health care options. Covered California acknowledged that some sensitive information was inadvertently collected, including first names, the last four digits of Social Security numbers, and critical health-related data.
In an ongoing effort to enhance data privacy, Covered California is conducting a review of its entire website to ensure that no further analytical tools are improperly collecting or disseminating sensitive patient information.
Amid the unfolding incidents, a class-action lawsuit was lodged against LinkedIn and Google shortly after Cal Matters exposed the potential data-sharing concerns. The suit accuses these tech giants of facilitating software that enables unauthorized interception of communications from Covered California’s clients.
The correspondence from House Republicans is the latest push aimed at increasing scrutiny on the California health program. Lawmakers are demanding detailed responses to inquiries regarding data-sharing practices, specifically concerning the duration in which information was allegedly exchanged with LinkedIn, in addition to the current safeguards Covered California has implemented to protect patient data.
BLUE SHIELD EXPOSED 4.7 MILLION PATIENTS’ HEALTH DATA TO GOOGLE
Chairman Brett Guthrie emphasized the need for transparency regarding patient data security, stating, “Americans deserve assurance that their health information is secure and treated with the utmost care.” He expressed hope that California would act responsibly and provide clear information regarding this significant data security breach as investigations progress.
Rep. Jay Obernolte, another key figure in the House Energy and Commerce Committee, added, “The unauthorized sharing of sensitive health data with third-party advertisers—self-reported pregnancy status, prescribed medications, and Social Security details—is particularly concerning. We are pursuing answers because Californians deserve accountability and transparency when their privacy is compromised.”
When contacted for comments, Covered California confirmed receipt of the congressional letter and mentioned that it is currently reviewing the requests made by lawmakers. The organization has committed to providing a response by the specified deadline of July 1. Both Google and LinkedIn declined to comment on the matter.
Raising the Stakes for Data Privacy
This situation underscores a growing tension between state-run health programs and the need for stringent data privacy protections. As concerns surrounding data leaks and unauthorized sharing grow, public trust becomes increasingly fragile. This incident may catalyze broader discussions about how healthcare organizations manage sensitive information in the evolving digital landscape.
The implications of this case could extend beyond California, potentially prompting other states to reevaluate their own data privacy practices and policies. As various stakeholders integrate technology into healthcare, vigilance and accountability will remain crucial in safeguarding patient information.
