Tracking Code Privacy Incident Affects 29,000 Insulet Corporation Customers
The Massachusetts-based medical device company, Insulet Corporation, has recently notified 29,000 of its Omnipod DASH customers about a recent privacy breach. A Medical Device Correction letter was recently sent to customers. Due to the importance of applying the update, a follow-up receipt acknowledgment request was sent via email on December 1, 2022.
The emails included a clickable link that directed customers to a webpage that was used for receipt verification; however, an error was made configuring that website which resulted in an impermissible disclosure of customers’ protected health information. Each customer was sent a unique URL that included their IP address, whether the customer was an Omnipod DASH user, and if they had a Personal Diabetes Manager.
Cookies and trackers embedded in the MDC acknowledgment pages transferred details of the URLs to third-party website performance and marketing partners. Insulet said the privacy violation was discovered on December 6, 2022, and all tracking technologies on the web pages were disabled to prevent further PHI exposure, and requests were sent to Insulet’s marketing partners requesting they delete the logs of the IP addresses and unique URLs.
Minnesota Department of Human Services Employee Error Impacts 4,307 Individuals
A mistake by an employee of the Minnesota Department of Human Services (DHS) has resulted in the impermissible disclosure of the protected health information of 4,307 Minnesota residents. On November 18, 2022, in response to a request from a client for a copy of their own data, the employee accidentally sent the billing statements of 4,307 individuals who were enrolled in Medical Assistance.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The investigation found no evidence to suggest the information was downloaded or misused. The patient who was sent the data notified DHS about the error and said the email would be deleted. The DHS confirmed that highly sensitive information such as Social Security Numbers, banking information, and credit card numbers were not included in the statements. Notification letters were sent to all affected individuals on January 11, 2023.
