MINNEAPOLIS (April 28, 2023) — This notice is regarding a data privacy incident that included select personal information of some Allina Health patients.
In recent months, several health care systems have learned that the tools used by internet tracking technology providers may inadvertently capture private health information. Allina Health proactively reached out to an outside consulting firm to do a forensic analysis of Allina Health’s use of tracking tools.
In late February 2023, the firm determined that tracking pixels were sending protected information to Google Analytics. Allina Health teams have been working diligently with the outside partner to identify affected patients. Approximately 1,000 people are being notified.
Allina Health uses Google Analytics to enhance the AllinaHealth.org experience for our patients, visitors and community members.
A limited number of patients had pieces of information captured by Google Analytics. This was not a cybersecurity attack, and Allina Health has no evidence that Google used this data for any purpose other than providing analytic services to Allina Health. Also, Allina Health has no evidence that any third parties, other than Google, had access to the data.
The information may have included:
This information DID NOT include:
Allina Health has removed the code that was capturing private health information and has implemented internal processes to prevent it from being added in the future.
Allina Health is committed to patient privacy and understands that these types of events can cause concern. We are deeply sorry for any concern or inconvenience that this incident causes anyone. While we do not believe this incident puts patients at risk for identity or financial theft, out of an abundance of caution, we are offering a complimentary two-year membership of TransUnion credit monitoring/identity protection services to our impacted patients. We also encourage everyone to continue practicing the usual caution around suspicious communication and promptly report any suspected identity theft or other suspicious activity to the proper law enforcement authorities.
In addition to sending letters to those impacted, Allina Health has notified the US Department of Health and Human Services Office for Civil Rights of this incident, consistent with standard practice.
Those with questions may call Allina Health at (866) 979-1541, Monday-Friday from 8 a.m. – 6 p.m. CST, beginning Monday, May 1, 2023.