Cerebral, a telehealth startup that provides virtual mental health services, has admitted to sharing the private health information of over 3.1 million patients in the US with advertisers and social media companies including Facebook, Google, and TikTok.
The company disclosed the security breach in a filing with the federal government. Cerebral collected and shared a vast amount of personal and health information including names, phone numbers, email addresses, dates of birth, IP addresses, and mental health assessments.
Cerebral’s security lapse was the result of the real-time sharing of patients’ data with tech giants through embedded trackers and other data-collecting code within its apps. The startup’s approach to data collection and sharing is covered under the US health privacy law, HIPAA.
Despite the obligations under HIPAA, Cerebral did not obtain explicit consent from patients before sharing their data. Users who accepted the app’s terms of use and privacy policies were unwittingly consenting to tracking and data sharing.The startup has reportedly disabled the tracking feature in its apps. However, the social media platforms that received the data are not obligated to remove it.
The ease with which third-party companies can obtain and utilize sensitive patient information without proper consent demonstrates the vulnerability of patients’ data in telehealth startups. It is essential to have more stringent data protection measures to ensure patient privacy and safety.
