UCLA Health is notifying patients that web-based analytics tools on an appointment request form completed on its website and mobile app may have captured and transmitted to third-party service providers certain limited information.
A small percentage of UCLA Health patients filled out an appointment request form on the UCLA Health website or mobile app between April 2020, and June 2022. Letters were mailed January 13, 2023, to those patients with addresses on file.
For those who completed the form during that time period, the analytics tools may have captured the following information: URL/website address (which could include provider name, specialty, or ad campaign name), page views, IP address, third-party cookies, and hashed values of certain fields on an appointment request form. The hashed value form fields could have included first and last name, email address, mailing address, phone number, and gender. Hashed values are generated by applying a one-way mathematical algorithm to convert the data into a string of numbers and letters.
It is important to note that these analytics tools never captured Social Security numbers, financial account numbers, or debit/credit card information. Moreover, appointment request forms that were impacted were only present on the UCLA Health website and the UCLA Health mobile app. UCLA Health did not place these analytics tools within myUCLAhealth, the online patient portal.
In April 2020, UCLA Health began using analytics tools on its public website, UCLAHealth.org, and a related mobile app to understand how the community interacted with them. Analytics tools allow organizations to review website and app activity in the aggregate to develop more effective and efficient communication.
In June 2022, when UCLA Health learned of concerns relating to the use of these analytics tools by health care providers, the tools were disabled. UCLA Health also initiated a review, supported by a third-party forensic firm, to complete a comprehensive analysis of the use of these analytics tools on its website and mobile apps, evaluate what data these analytics tools collected, and determine to whom the data belonged.
A call center has been set up for those who receive a notice and would like more information or who believe their personal health information may have been impacted. The call center can be reached at 1-800-454-3581 Monday through Friday from 6 am to 8 pm PT, and Saturday and Sunday from 8 am to 5 pm PT. Callers should be prepared to reference engagement number B083805 when speaking with an agent. Additional information can also be found at https://www.uclahealth.org/data-notice.
UCLA Health has enhanced its technology evaluation procedures. UCLA Health takes seriously patient confidentiality and the responsibility to protect personal information.