Healthcare Data Leakage: Detecting and Remediation of Meta Pixel HIPAA Violations

---
title: Potential PHI Leak via Meta Pixel - Network Connection
id: 9e2f8c41-1a3b-4c5d-9e6f-1a2b3c4d5e6f
status: experimental
description: Detects outbound network connections to Facebook/Meta Pixel tracking endpoints from internal healthcare networks or web servers. While Facebook may be allowed for business, tracking endpoints from patient portal hosting subnets warrant investigation.
references:
  - https://www.hipaajournal.com/memorial-healthcare-services-pixel-settlement/
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|endswith:
      - 'facebook.com'
      - 'connect.facebook.net'
      - 'www.facebook.com'
    DestinationPort: 443
  filter_main_generic_browsing:
    # Exclude generic workstations if necessary, focus on web servers or kiosks
    SourceIp|contains:
      - '192.168.10.' # Example: Web Server Subnet
  condition: selection and not filter_main_generic_browsing
falsepositives:
  - Legitimate marketing team access or authorized social media management
level: medium
---
title: Potential PHI Leak via Google Analytics - Proxy
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects POST requests to Google Analytics measurement protocol which could be used to exfiltrate structured PII/PHI.
references:
  - https://support.google.com/analytics/answer/10213565
author: Security Arsenal
date: 2026/04/14
tags:
  - attack.exfiltration
  - attack.t1567.001
logsource:
  category: proxy
  product: null
detection:
  selection:
    RequestMethod: 'POST'
    cs-host|endswith:
      - 'google-analytics.com'
      - 'analytics.google.com'
    cs-uri-query|contains:
      - 'en=' # Event Name parameter
      - 'ea=' # Event Action parameter
  condition: selection
falsepositives:
  - Authorized web analytics usage
level: low

// Hunt for pixel tracking beacons in Proxy Logs (CommonSecurityLog)
let TrackingDomains = dynamic([
    "connect.facebook.net", "www.facebook.com/tr", 
    "www.google-analytics.com", "analytics.google.com",
    "static.ads-twitter.com", "analytics.tiktok.com"
]);
CommonSecurityLog
| where RequestURL has_any (TrackingDomains)
| where RequestMethod in ("POST", "GET")
| extend ParsedUrl = parse_url(RequestURL)
| extend QueryParams = ParsedUrl["Query"]
| where QueryParams has_any ("ph", "pn", "em", "uid", "cid") 
    // Common abbreviations for phone number, patient name, email, user ID, client ID that might indicate PII mapping
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, UserAgent, BytesSent, BytesReceived
| order by TimeGenerated desc

-- Hunt for Meta Pixel scripts in IIS Web Root directories
SELECT FullPath, Mtime, Atime, Size
FROM glob(globs="/*", root="C:\\inetpub\\wwwroot")
WHERE 
    -- Read file content (limit to reasonable sizes to avoid crashing)
    Size < 10000000
    AND read_file(filename=FullPath) =~ "fbq\('init'"
    OR read_file(filename=FullPath) =~ "connect.facebook.net/en_US/fbevents.js"
    OR read_file(filename=FullPath) =~ "https://www.googletagmanager.com/gtag/js"

# Audit IIS Web Roots for Third-Party Tracking Scripts
# Requires Administrative Privileges

$WebRoots = @("C:\inetpub\wwwroot", "D:\websites")
$SignaturePatterns = @(
    "fbq('init",             # Meta Pixel Init
    "connect.facebook.net",  # Meta Pixel Source
    "fbevents.js",           # Meta Pixel Library
    "googletagmanager.com",  # Google Tag Manager
    "analytics.tiktok.com"   # TikTok Pixel
)

$Results = @()

foreach ($Root in $WebRoots) {
    if (Test-Path $Root) {
        Write-Host "Scanning directory: $Root" -ForegroundColor Cyan
        
        # Get all .html, .js, .aspx, .php files
        $Files = Get-ChildItem -Path $Root -Recurse -Include *.html, *.js, *.aspx, *.php, *.cshtml -ErrorAction SilentlyContinue
        
        foreach ($File in $Files) {
            $Content = Get-Content -Path $File.FullName -Raw -ErrorAction SilentlyContinue
            
            if ($Content) {
                foreach ($Pattern in $SignaturePatterns) {
                    if ($Content -like "*$Pattern*") {
                        $Results += [PSCustomObject]@{
                            File      = $File.FullName
                            Pattern   = $Pattern
                            Detected  = $true
                            Timestamp = Get-Date
                        }
                        break # Once a file is flagged, move to next to save time
                    }
                }
            }
        }
    }
}

if ($Results.Count -gt 0) {
    Write-Host "ALERT: Tracking scripts detected!" -ForegroundColor Red
    $Results | Format-Table -AutoSize
    # Export to CSV for compliance review
    $Results | Export-Csv -Path "C:\Temp\PixelAudit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
} else {
    Write-Host "No known tracking signatures found in specified paths." -ForegroundColor Green
}