Monument and Tempest, which both provide resources for patients struggling with alcohol addiction, say the leak might have also included patients’ responses to self-evaluations about their drinking habits, something Monument clearly says are “protected” and used only by its care teams. The companies blame the breach on the pixel tracking tools they included on their sites for advertising purposes.

Monument says it reviewed its use of tracking pixels after the US government issued guidance to health companies about them in late 2022. In a bulletin published by the Department of Health and Human Services (HHS), the agency warns health companies that they might be held liable for violating patient privacy through the use of pixel-tracking tools.

Pixel trackers are the snippets of code created by companies like Meta, Google, TikTok, and Pinterest that often get embedded into ads, websites, or emails. They track information about what a user clicks or the forms they fill out, which then gets used by both parties to create tailored ads or better understand their user bases....