Hospitals Told Facebook Your Appointment

Last updated: November 8, 2026. Based on The Markup's reporting from June and September 2022. This article describes historical findings. Hospitals' tracking practices may have changed since then.

In June 2022, The Markup tested the websites of Newsweek's top 100 U.S. hospitals. On 33 of them, reporters found a tracking tool called the Meta Pixel sending Facebook a packet of data whenever someone clicked a button to schedule a doctor's appointment. The data included doctor names, conditions or search terms, and an IP address. When combined with other data such as cookies or hashed identifiers in some browsers, an IP address can help link activity to a specific individual or household.

On some hospital booking pages, the pixel also sent contact details entered into the form, including name, email, phone number, city, and zip code.

The Markup also found the Meta Pixel installed inside the password-protected patient portals of seven health systems. On five of those, it documented the pixel sending Facebook data about real patient volunteers, including the names of their medications, descriptions of their allergic reactions, and details about their upcoming doctor's appointments.

After the reporting, many hospitals removed the tracker. As of Sept. 15, 2022, 28 of the 33 hospitals had removed the Meta Pixel from doctor booking pages or blocked it from sending patient information to Facebook, and at least six of the seven health systems had removed it from their portals.

If you're wondering what was sent, how it happened, and what you can do now, this guide explains the findings, the hospitals' responses, and how to disconnect future activity on Meta platforms.

#Watch: Hospitals told Facebook your appointment

This video walks through what The Markup found and how the Meta Pixel worked on hospital websites.

#What The Markup found

On June 16, 2022, The Markup published "Facebook Is Receiving Sensitive Medical Information from Hospital Websites," an investigation by Todd Feathers, Simon Fondrie-Teitler, Angie Waller, and Surya Mattu.

#The test

The Markup tested the websites of Newsweek's top 100 hospitals in America. On 33 of them, reporters found the Meta Pixel, a tracking tool, sending Facebook a packet of data whenever a person clicked a button to schedule a doctor's appointment.

The data was connected to an IP address, an identifier that's like a computer's mailing address. When combined with other data such as cookies or hashed identifiers in some browsers, an IP address can help link activity to a specific individual or household.

#What the pixel sent on booking pages

Here are specific examples from The Markup's June 2022 report:

University Hospitals Cleveland Medical Center: Clicking the "Schedule Online" button on a doctor's page prompted the Meta Pixel to send Facebook the text of the button, the doctor's name, and the search term used to find her: "pregnancy termination."

Froedtert Hospital, Wisconsin: Clicking the "Schedule Online Now" button for a doctor prompted the Meta Pixel to send Facebook the text of the button, the doctor's name, and the condition selected from a dropdown menu: "Alzheimer's."

Scripps Memorial Hospital: Clicking the "Finish Booking" button on a doctor's page caused the pixel to send Facebook not just the name of the doctor and her field of medicine but also the first name, last name, email address, phone number, zip code, and city of residence entered into the booking form. The Meta Pixel hashed those personal details before sending them to Facebook, but The Markup was able to reverse most of their hashed test information using a free online tool. Meta explicitly uses hashed information to link pixel data to Facebook profiles.

Brigham and Women's Faulkner Hospital: Clicking the "Request Appointment" button on a doctor's page caused the Meta Pixel to send Facebook the text of the button, the doctor's name, and the doctor's field of medicine.

#What the pixel sent from patient portals

The Markup also found the Meta Pixel installed inside the password-protected patient portals of seven health systems. On five of those systems' pages, reporters documented the pixel sending Facebook data about real patients who volunteered to participate in the Pixel Hunt project, a collaboration between The Markup and Mozilla Rally.

The data sent from portals included the names of patients' medications, descriptions of their allergic reactions, and details about their upcoming doctor's appointments.

Here are specific examples from The Markup's June 2022 report:

Piedmont Healthcare, Georgia: When a real patient logged in to the MyChart portal, the Meta Pixel installed in the portal told Facebook the patient's name, the name of their doctor, and the time of their upcoming appointment, according to data collected by the participant's Mozilla Rally browser extension.

Novant Health, North Carolina: When a Pixel Hunt participant (real patient volunteer) used the MyChart portal, the pixel told Facebook the type of allergic reaction the patient had to a specific medication. The Markup also created their own MyChart account through Novant Health to further investigate. In The Markup's own test account, clicking one button prompted the pixel to tell Facebook the name and dosage of a medication in the health record, as well as any notes entered about the prescription. The pixel also told Facebook which button The Markup's reporters clicked in response to a question about sexual orientation.

#The scale of the issue

The 33 hospitals The Markup found sending patient appointment details to Facebook collectively reported more than 26 million patient admissions and outpatient visits in 2020, according to the most recent data available from the American Hospital Association.

The Markup's investigation was limited to just over 100 hospitals. The data sharing likely affected many more patients and institutions than were identified.

#What hospitals did after the reporting

After The Markup's June 2022 investigation published, many hospitals removed the tracker.

According to The Markup's Sept. 19, 2022 follow-up article by Todd Feathers and Simon Fondrie-Teitler, "Meta Faces Mounting Questions From Congress on Health Data Privacy as Hospitals Remove Facebook Tracker":

• As of Sept. 15, 2022, 28 of the 33 hospitals had removed the Meta Pixel from their doctor booking pages or blocked it from sending patient information to Facebook.

• At least six of the seven health systems had also removed the pixels from their patient portals.

The Markup reached out to the institutions who removed the pixel from their websites after the investigation published in June. As of Sept. 19, 2022, three institutions had responded: Sanford Health, El Camino Health, and Henry Ford Health.

#Novant Health sent breach notifications

One health system, North Carolina-based Novant Health, mailed data breach notifications to 1.3 million customers following The Markup's report.

In the breach notification, Novant Health stated the pixel was added as part of a promotional campaign to encourage use of Novant's MyChart patient portal, but "the pixel was configured incorrectly and may have allowed certain private information to be transmitted to Meta."

On Sept. 16, 2022, Novant amended its data breach notification post to state that Meta informed the provider that it "generally" filtered out patients' sensitive medical information and that it did "not have information to return or destroy."

#Scripps removed the pixel after The Markup's inquiry

Scripps Memorial Hospital did not respond to The Markup's questions, but it did remove the Meta Pixel from the final webpages in the appointment booking process after The Markup shared its findings with the hospital.

#What Meta said

Meta, quoted by The Markup in June 2022, said its systems are designed to filter out potentially sensitive health data they detect.

The Markup could not confirm whether the data referenced in its story was in fact removed before being stored by Meta.

However, a joint investigation with Reveal found that Meta's sensitive health information filtering system didn't block information about appointments a reporter requested with crisis pregnancy centers.

#How the Meta Pixel works

The Meta Pixel (also called the Facebook Pixel) is a small piece of code that websites can add to their pages. When someone visits a page with the pixel, it sends information to Facebook about the visit.

Here's how it works:

1. A website adds the pixel. A hospital or business adds the Meta Pixel code to its website.

2. The pixel sends events. An event is a specific action, like viewing a page, clicking a button, or completing a form. The pixel sends these events to Facebook.

3. The pixel sends identifiers. Along with the event, the pixel sends information that can identify the user, such as an IP address or email address if available.

4. Facebook may link the event to a user account. When sufficient identifiers are available, such as cookies or other matching data, Facebook can use them to help link the event to a Facebook user account.

#Why IP addresses matter

An IP address is like a computer's mailing address. When combined with other data such as cookies or hashed identifiers in some browsers, an IP address can help link activity to a specific individual or household.

When a hospital website sent Facebook an IP address along with appointment details, Facebook could use it with other data to help connect that activity to a person's Facebook account, even if the person didn't provide their name or email on the hospital website.

#How to disconnect future activity on Facebook and Instagram

If you use Facebook or Instagram, Meta offers a setting to disconnect future activity that businesses send to Meta from your account.

Per the Meta Help Center, this setting can be found in Accounts Center under "Your information and permissions" and is called "Your activity off Meta technologies." The setting allows you to manage or disconnect future activity that businesses send via tools like the Meta pixel.

Sources:

• Meta Help Center, "Manage your future activity off Meta technologies": https://www.facebook.com/help/1224342157705160
• Meta Help Center, "Review your activity off Meta technologies": https://www.facebook.com/help/2207256696182627

#What this does and doesn't do

Per the Meta Help Center, this setting manages how your account is connected to activity that businesses report via Meta business tools.

What the setting affects: Disconnecting your activity off Meta technologies affects the association between your account and activity that businesses send via tools like the Meta pixel. This applies to both past and future activity sent by businesses.

What it does not do: Disconnecting the association between your account and off-Meta activity does not delete the underlying data that businesses have already sent to Meta. It does not control what businesses collect on their own websites or what they send to Meta.

#What this means for hospital websites in 2026

The Markup's investigation was published in 2022. This article describes historical findings.

As of November 2026, we cannot verify which hospitals currently use the Meta Pixel, whether any still send patient information to Facebook, or whether Meta's filtering systems have changed.

If you're scheduling an appointment on a hospital website or logging into a patient portal, consider:

1. Check the hospital's privacy policy. Look for sections on "third-party analytics," "advertising partners," or "tracking technologies."

2. Use browser extensions that block trackers. Extensions like Privacy Badger, uBlock Origin, or Ghostery can block tracking pixels from loading. Use them on hospital websites and patient portals.

3. Disconnect activity off Meta technologies. Use the setting in Accounts Center (described above) to manage the association between your account and activity that businesses send via the Meta pixel.

4. Ask your hospital. If you're concerned about what your hospital shares, contact its privacy office and ask whether it uses tracking pixels on its website or patient portal, and what data those pixels send to third parties.

#The difference between this and BetterHelp

This hospital case is distinct from the BetterHelp case. BetterHelp is an online therapy platform that, per the FTC's 2023 complaint, shared health data with advertising platforms. Read more about the BetterHelp case.

The hospital case involves hospital websites and patient portals, as documented by The Markup in 2022. These are separate incidents involving different entities, time periods, and types of services.

#The bigger picture: health data and tracking

The hospital case is part of a larger pattern of health data sharing. Health apps, symptom trackers, period apps, and now hospital websites have all been found sharing data with Facebook, Google, or other platforms.

If you're working on limiting health data sharing and removing your personal information from data brokers, hospital website tracking is part of the same issue. Our main guide, how to remove your personal information from the internet, covers the full process.

For more on health app tracking, see:

• Is My Period App Sharing My Data?
• Did BetterHelp Share Your Data With Facebook?

#Steps you can take today

1. Disconnect activity off Meta technologies. Use the setting in Accounts Center (described above) to manage the association between your account and activity that businesses send via the Meta pixel.

2. Use tracker-blocking extensions. Install Privacy Badger, uBlock Origin, or Ghostery. Use them when visiting hospital websites and patient portals.

3. Check your hospital's privacy policy. Look for what tracking technologies the hospital uses and what data it shares with third parties.

4. Use a separate email for sensitive sign-ups. If you're registering for a patient portal, use an email address that is not associated with your social media accounts to limit custom audience matching.

5. Clear cookies regularly. Or use a browser with built-in tracking protection like Firefox or Brave.

These steps take about 20 minutes the first time and a few minutes for each check-in. The goal is to reduce how much health data is shared with advertising platforms and data brokers.

UndoLeak erases your data from data brokers and keeps it off.

Run a free privacy check

---

#Sources

1. Todd Feathers, Simon Fondrie-Teitler, Angie Waller, and Surya Mattu, The Markup, "Facebook Is Receiving Sensitive Medical Information from Hospital Websites" (June 16, 2022): https://themarkup.org/pixel-hunt/2022/06/16/facebook-is-receiving-sensitive-medical-information-from-hospital-websites

2. Todd Feathers and Simon Fondrie-Teitler, The Markup, "Meta Faces Mounting Questions From Congress on Health Data Privacy as Hospitals Remove Facebook Tracker" (Sept. 19, 2022): https://themarkup.org/pixel-hunt/2022/09/19/meta-faces-mounting-questions-from-congress-on-health-data-privacy-as-hospitals-remove-facebook-tracker

3. Sara Morrison, Vox/Recode, "Meta is getting data about you from some surprising places" (June 17, 2022): https://www.vox.com/recode/23172691/meta-tracking-privacy-hospitals

4. Meta Help Center, "Manage your future activity off Meta technologies" (2026): https://www.facebook.com/help/1224342157705160

5. Meta Help Center, "Review your activity off Meta technologies" (2026): https://www.facebook.com/help/2207256696182627

6. Meta Help Center, "Account settings you will be able to manage in Accounts Center" (2026): https://www.meta.com/help/accounts-center/841741830388205/

---

Not affiliated with Meta, Facebook, or any hospital or health system mentioned.