...
By Jasmine Laws
Reporter
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
California Representative Kevin Kiley has called for an investigation after the state's handling of sensitive health information came under scrutiny following a report that data entered by residents on the state's health insurance marketplace was shared with LinkedIn.
In a letter exclusively shared with Newsweek, the Republican asked the Department of Health and Human Services to launch an investigation into the issue "due to Covered California's blatant disregard for privacy and the law."
"This is incredibly disturbing," Kiley also wrote on X, formerly Twitter.
Read More on News
Covered California, which runs the state's marketplace coveredca.com, shared sensitive personal data with LinkedIn, a subsidiary of Microsoft, through embedded tracking tools on the website, the nonprofit news organization The Markup reported on Monday.
Covered California confirmed the data transmission in a news release later that day, stating that "some sensitive data was inadvertently collected by the tags, including first names, the last four digits of Social Security numbers, and other sensitive health information like pregnancy status."
It added that all advertising-related tags on the website had been turned off as a "precautionary measure," and that it would review the extent of the data shared.
Newsweek reached out to Health Secretary Robert F. Kennedy Jr. and California Governor Gavin Newsom's offices via email outside of regular working hours on Wednesday.
Why It Matters
Concerns over personal data have grown in recent months after it was revealed that the government's Department of Government Efficiency had worked to gain access to the Social Security Administration's data systems, which hold sensitive personal information about approximately 70 million Americans.
California's sharing of sensitive data with LinkedIn will likely raise similar concerns about threats to Americans' privacy.
...
What To Know
Trackers on coveredca.com, which was created under the Affordable Care Act, captured users' answers to questions about blindness, pregnancy, high prescription use, gender identity and experiences with domestic abuse, The Markup reported.
The data was then transmitted to LinkedIn using Insight Tag, which uses code to track how visitors interact with websites.
Covered California said in a statement that it "leverages LinkedIn's advertising platform tools to understand consumer behavior." However, LinkedIn notes on its website that Insight Tag "should not be installed on web pages that collect or contain Sensitive Data."
The LinkedIn campaign trackers began in February 2024 and were removed "due to a marketing agency transition" in early April, Covered California told CalMatters.
Covered California had more than 60 trackers on its site, compared to the average of three on other government sites, CalMatters reported.
What People Are Saying
Covered California said in a news release on Monday: "Covered California is reviewing its entire website and information security and privacy protocols to ensure that no analytics tools are impermissibly collecting or sharing sensitive consumer information. The LinkedIn Insight tags are no longer active and, as a precautionary measure, all active advertising-related tags across the CoveredCA.com website have been turned off.
"Covered California is committed to safeguarding the confidential information and privacy of its consumers. The organization will share additional findings from this investigation as they become available."
Covered California also told Newsweek: "Covered California is continuing to actively investigate the matter and is engaging an independent third-party digital forensics firm to support our review."
California Representative Kevin Kiley, on X: "California's Obamacare website tracked users' personal health information—such as pregnancy and prescription drug use—and sent it to LinkedIn for a 'marketing campaign.' We are asking Secretary Kennedy to investigate for HIPAA violations."
Representative Kiley said in a letter sent to Kennedy and shared with Newsweek: "Every American should have confidence that their personal health information (PHI) is private. That is why the Health Insurance Portability and Accountability Act of 1996 (HIPAA) was enacted, to make sure PHI was not given away without a patient's consent. Unfortunately, a forensic investigation into Covered California, a California state government entity that operates the state's Affordable Care Act (ACA) exchange, was found to have transmitted PHI to LinkedIn."
What Happens Next
The Department of Health and Human Services has not yet responded publicly to Kiley's call for an investigation.
If it is a breach of unsecured protected health information, the regulated entity may be obligated under the Health Insurance Portability and Accountability Act (HIPAA) to report the breach to the Department of Health and Human Services.
Update 04/30/25, 12:10 p.m. ET: This article has been updated after receiving a letter from the office of Representative Kiley.
Update 05/06/25, 02:59 a.m. ET: This article has been updated following comment from Covered California.
View 0 Comments
Submit Correction
View Editorial & AI Guidelines