Healthcare Pixel Lawsuit Settlements: Detecting and Remediating Unauthorized Tracking Technologies on Patient Portals

---
title: Healthcare Portal Tracking Pixel Detection - Meta/Facebook
id: 8f3e2a91-4c5b-4d8e-9f1a-2b3c4d5e6f7a
status: experimental
description: Detects Meta Pixel (Facebook) tracking code firing on authenticated patient portal pages, potentially transmitting PHI to third parties.
references:
  - https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html
  - https://attack.mitre.org/techniques/T1189/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1189
logsource:
  category: proxy
  product: zeek
detection:
  selection:
    http.uri|contains:
      - 'facebook.com/tr'
      - 'connect.facebook.net'
      - 'facebook.net/signals'
  filter_public_pages:
    http.uri|contains:
      - '/about'
      - '/contact'
      - '/news'
      - '/careers'
      - '/locations'
  condition: selection and not filter_public_pages
falsepositives:
  - Legitimate marketing pages not requiring authentication
  - Public health education content
level: high
---
title: Healthcare Portal Google Analytics PHI Exposure
id: 9a4b3c82-5d6e-4f9a-0b1c-3d4e5f6a7b8c
status: experimental
description: Detects Google Analytics/Tag Manager requests from authenticated patient portal pages with potential PHI in URL parameters.
references:
  - https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1189
logsource:
  category: proxy
  product: zeek
detection:
  selection:
    http.uri|contains:
      - 'google-analytics.com/g/collect'
      - 'googletagmanager.com/gtm.js'
      - 'analytics.google.com'
  selection_phi_params:
    http.uri|contains:
      - 'patient'
      - 'appointment'
      - 'medical'
      - 'health'
      - 'portal'
      - 'mychart'
      - 'epic'
      - 'cerner'
  condition: selection and selection_phi_params
falsepositives:
  - Public health information pages without authentication
level: high
---
title: Session Replay Tool on Healthcare Portal
id: 1b2c3d4e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects session replay tools (Hotjar, FullStory, LogRocket) that may capture PHI from patient portal form inputs.
references:
  - https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1189
logsource:
  category: proxy
  product: zeek
detection:
  selection:
    http.uri|contains:
      - 'hotjar.com'
      - 'fullstory.com'
      - 'logrocket.com'
      - 'mouseflow.com'
      - 'clarity.ms'
  filter_public:
    http.uri|contains:
      - '/public'
      - '/about'
      - '/marketing'
  condition: selection and not filter_public
falsepositives:
  - Marketing and public education pages
level: critical

// Hunt for tracking pixels firing on authenticated patient portals
// Requires proxy/firewall logs ingested into Sentinel via CEF/Syslog

let tracking_domains = dynamic([
    "facebook.com/tr",
    "connect.facebook.net",
    "google-analytics.com",
    "googletagmanager.com",
    "analytics.google.com",
    "tiktok.com/i18n/pixel",
    "snap.licdn.com",
    "hotjar.com",
    "fullstory.com",
    "logrocket.com",
    "clarity.ms"
]);

let portal_paths = dynamic([
    "/portal",
    "/mychart",
    "/patient",
    "/appointment",
    "/health",
    "/medical",
    "/epic",
    "/cerner",
    "/followmyhealth"
]);

CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any (tracking_domains)
| where RequestURL has_any (portal_paths)
| project TimeGenerated, SourceIP, DestinationHostName, RequestURL, RequestMethod, DeviceAction
| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by RequestURL, DestinationHostName
| order by Count desc

// Alternative query for DNS-based detection of tracking pixel domains
// Useful when full URL logging is not available

let tracking_domains = dynamic([
    "facebook.com",
    "facebook.net",
    "google-analytics.com",
    "googletagmanager.com",
    "tiktok.com",
    "hotjar.com",
    "fullstory.com",
    "logrocket.com",
    "clarity.ms"
]);

DnsEvents
| where TimeGenerated > ago(7d)
| where Name has_any (tracking_domains)
| where ClientIP in (
    // Correlate with IPs that also accessed patient portal
    DnsEvents
    | where Name has_any ("portal", "mychart", "epic", "health")
    | distinct ClientIP
)
| summarize Count = count(), DistinctQueries = dcount(Name) by ClientIP, Name
| order by Count desc

-- Hunt for browser artifacts indicating tracking pixel execution on patient portals
-- Targets Chrome, Edge, and Firefox browser history

SELECT * FROM foreach(
    row={
        SELECT FullPath FROM glob(globs="C:/Users/*/AppData/Local/Google/Chrome/User Data/*/History")
    },
    query={
        SELECT 
            urls.url as URL,
            urls.title as PageTitle,
            datetime(epoch=urls.visit_time/1000000-11644473600) as VisitTime,
            urls.visit_count as VisitCount
        FROM sqlite(file=FullPath, query="SELECT url, title, visit_time, visit_count FROM urls WHERE url LIKE '%facebook.com/tr%' OR url LIKE '%google-analytics.com%' OR url LIKE '%hotjar.com%' OR url LIKE '%fullstory.com%' ORDER BY visit_time DESC LIMIT 100")
    })
WHERE URL =~ "portal|mychart|patient|health|medical"

-- Alternative: Check for tracking pixel JavaScript in browser cache
-- Indicates recent execution even if history is cleared

SELECT 
    FullPath as CacheFile,
    parse_string_with_regex(string=read_file(file=FullPath, accessor="data"), regex="(?i)(facebook\.com/tr|google-analytics\.com|hotjar\.com|fullstory\.com)") as TrackingIndicator,
    Mtime as ModifiedTime
FROM glob(globs="C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Cache/**/*")
WHERE TrackingIndicator
LIMIT 50

# Healthcare Portal Tracking Pixel Audit and Remediation Script
# Run on web servers hosting patient portals to identify and inventory tracking tags

# Configuration
$PortalPaths = @("C:\inetpub\wwwroot\portal", "C:\inetpub\wwwroot\mychart", "D:\websites\patientportal")
$OutputPath = "C:\SecurityAudit\TrackingPixelAudit_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"

# Known tracking pixel patterns
$TrackingPatterns = @(
    "facebook\.com/tr",
    "connect\.facebook\.net",
    "google-analytics\.com",
    "googletagmanager\.com",
    "gtag\(",
    "fbq\(",
    "_fbq",
    "hotjar\.com",
    "fullstory\.com",
    "logrocket\.com",
    "clarity\.ms",
    "snap\.licdn\.com",
    "tiktok\.com/i18n/pixel"
)

$results = @()

foreach ($path in $PortalPaths) {
    if (Test-Path $path) {
        Write-Host "Scanning: $path" -ForegroundColor Cyan
        
        # Get all HTML, JS, ASPX, and CSHTML files
        $files = Get-ChildItem -Path $path -Recurse -Include *.html,*.htm,*.js,*.aspx,*.cshtml,*.php -ErrorAction SilentlyContinue
        
        foreach ($file in $files) {
            $content = Get-Content $file.FullName -Raw -ErrorAction SilentlyContinue
            
            foreach ($pattern in $TrackingPatterns) {
                if ($content -match $pattern) {
                    # Extract surrounding context
                    $match = [regex]::Match($content, ".{0,100}$pattern.{0,200}")
                    
                    $results += [PSCustomObject]@{
                        FilePath = $file.FullName
                        FileName = $file.Name
                        Pattern = $pattern
                        Context = $match.Value -replace "`n|`r", " "
                        FileModified = $file.LastWriteTime
                        RequiresReview = $true
                        Recommendation = "Remove or move to public marketing pages only"
                    }
                }
            }
        }
    }
}

# Export results
$results | Export-Csv -Path $OutputPath -NoTypeInformation

# Summary output
Write-Host "`n=== TRACKING PIXEL AUDIT COMPLETE ===" -ForegroundColor Green
Write-Host "Files scanned: $($files.Count)" -ForegroundColor White
Write-Host "Tracking indicators found: $($results.Count)" -ForegroundColor $(if($results.Count -gt 0){"Red"}else{"Green"})
Write-Host "Report saved to: $OutputPath" -ForegroundColor White

if ($results.Count -gt 0) {
    Write-Host "`n=== FILES REQUIRING IMMEDIATE REVIEW ===" -ForegroundColor Red
    $results | Group-Object FilePath | ForEach-Object {
        Write-Host $_.Name -ForegroundColor Yellow
    }
    
    Write-Host "`n=== RECOMMENDED ACTIONS ===" -ForegroundColor Cyan
    Write-Host "1. Remove all tracking pixels from authenticated portal pages"
    Write-Host "2. Implement Content Security Policy (CSP) to block unauthorized third-party domains"
    Write-Host "3. Move marketing pixels to public-facing pages only"
    Write-Host "4. Conduct privacy impact assessment for any remaining analytics"
    Write-Host "5. Update privacy notices and obtain appropriate consents"
}

# Check for CSP headers in web.config (IIS)
Write-Host "`n=== CHECKING CONTENT SECURITY POLICY ===" -ForegroundColor Cyan
foreach ($path in $PortalPaths) {
    $webConfig = Join-Path $path "web.config"
    if (Test-Path $webConfig) {
        $config = Get-Content $webConfig -Raw
        if ($config -match "Content-Security-Policy") {
            Write-Host "CSP found in: $webConfig" -ForegroundColor Green
        } else {
            Write-Host "WARNING: No CSP configured in: $webConfig" -ForegroundColor Red
            Write-Host "  Add CSP headers to restrict third-party script execution" -ForegroundColor Yellow
        }
    }
}

#!/bin/bash
# Healthcare Portal Tracking Pixel Audit Script for Linux/Apache/Nginx
# Run on web servers or CI/CD pipelines to detect unauthorized trackers

PORTAL_PATHS=("/var/www/html/portal" "/var/www/html/mychart" "/var/www/patientportal")
OUTPUT_FILE="tracking_audit_$(date +%Y%m%d_%H%M%S).txt"

# Tracking pixel patterns
PATTERNS=(
    "facebook\.com/tr"
    "connect\.facebook\.net"
    "google-analytics\.com"
    "googletagmanager\.com"
    "fbq("
    "_fbq"
    "hotjar\.com"
    "fullstory\.com"
    "logrocket\.com"
    "clarity\.ms"
)

echo "=== HEALTHCARE PORTAL TRACKING PIXEL AUDIT ===" > "$OUTPUT_FILE"
echo "Scan Date: $(date)" >> "$OUTPUT_FILE"
echo "" >> "$OUTPUT_FILE"

FOUND_ISSUES=0

for path in "${PORTAL_PATHS[@]}"; do
    if [ -d "$path" ]; then
        echo "Scanning: $path" | tee -a "$OUTPUT_FILE"
        
        for pattern in "${PATTERNS[@]}"; do
            # Search for pattern in web files
            matches=$(grep -r -l -i "$pattern" "$path" 2>/dev/null || true)
            
            if [ -n "$matches" ]; then
                echo "  [!] FOUND: $pattern" | tee -a "$OUTPUT_FILE"
                echo "$matches" | while read -r file; do
                    echo "      File: $file" | tee -a "$OUTPUT_FILE"
                    # Show context
                    grep -i -B2 -A2 "$pattern" "$file" 2>/dev/null | head -5 | tee -a "$OUTPUT_FILE"
                done
                FOUND_ISSUES=1
            fi
        done
        echo "" >> "$OUTPUT_FILE"
    fi
done

if [ $FOUND_ISSUES -eq 1 ]; then
    echo "=== CRITICAL: Tracking pixels detected on patient portal ===" | tee -a "$OUTPUT_FILE"
    echo "" | tee -a "$OUTPUT_FILE"
    echo "REMEDIATION STEPS:" | tee -a "$OUTPUT_FILE"
    echo "1. Remove all tracking pixels from authenticated pages" | tee -a "$OUTPUT_FILE"
    echo "2. Implement CSP headers to block third-party domains" | tee -a "$OUTPUT_FILE"
    echo "3. Move marketing analytics to public pages only" | tee -a "$OUTPUT_FILE"
    echo "4. Review OCR guidance: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html" | tee -a "$OUTPUT_FILE"
else
    echo "[OK] No tracking pixels detected in scanned paths" | tee -a "$OUTPUT_FILE"
fi

echo "" | tee -a "$OUTPUT_FILE"
echo "Full report: $OUTPUT_FILE"

Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; img-src 'self' data:;

Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-vendor.com; connect-src 'self' https://api.trusted-vendor.com;

# Example: CI/CD pipeline check for tracking pixels
- name: Check for unauthorized trackers
  run: |
    if grep -r "facebook.com/tr\|google-analytics.com" ./src/portal/; then
      echo "ERROR: Tracking pixel detected in portal code"
      exit 1
    fi