Blue Shield of California Shared Millions of Patients’ Private Health Data with Google for Years

Blue Shield of California, a major health insurance provider, has notified millions of individuals about a significant data privacy breach. The company confirmed on Wednesday that it had been sharing patients’ private health information with tech and advertising giant Google since 2021.

Although this data-sharing arrangement was halted in January 2024, it was only in February that the company discovered the extent of the information shared — including sensitive and personal health data.

According to Blue Shield, it had been using Google Analytics to track how users interacted with its websites. However, due to misconfigured settings, the tool also collected private information — including search terms entered by patients while looking for healthcare providers on the site.

The company acknowledged that Google may have used this data to target affected individuals with advertising campaigns.

The data reportedly shared includes insurance plan names, types, and group numbers, along with personal information such as city of residence, ZIP code, gender, and household size. Additionally, member account numbers issued by Blue Shield, claim service dates, names of providers, patient names, and even financial responsibility details were also exposed.

In compliance with legal disclosure requirements under the U.S. Department of Health, Blue Shield stated it is notifying 4.7 million individuals affected by this breach — a number believed to represent the majority of its customer base, which stood at 4.5 million members as of 2022.

It remains unclear whether Blue Shield has requested Google to delete the collected data, or whether Google has complied. Representatives for both companies declined immediate comment.

Blue Shield now joins a growing list of healthcare organizations caught using online tracking technologies. These technologies, often embedded in websites and apps, are tiny bits of code provided by tech companies to collect data about users’ browsing behaviors — a practice heavily relied on by tech and social media companies for targeted advertising revenue.

Just last year, U.S. health insurance giant Kaiser informed more than 13 million individuals that it had shared patient data with advertisers including Google, Microsoft, and X (formerly Twitter) through similar tracking codes embedded on its website.

Other digital health companies — including mental health startup Cerebral and addiction recovery platforms Monument and Tempest — have also revealed past data-sharing violations involving sensitive patient information passed to advertising firms.

According to the U.S. Department of Health’s Office for Civil Rights, the breach at Blue Shield of California currently ranks as the largest health data privacy violation reported in 2025.