Chairman Guthrie Requests More Information on Improperly Shared User Data by California’s Health Insurance Marketplace Website
WASHINGTON, D.C. – Congressman Brett Guthrie (KY-02), Chairman of the House Committee on Energy and Commerce, along with Reps. Palmer (AL-06), Carter (GA-01), Bilirakis (FL-12), and Obernolte (CA-23), penned a letter to the Executive Director of Covered California (CoveredCA), Jessica Altman, to request further information related to the potentially unauthorized transmission of sensitive personal health information involving Covered California’s website. Key Letter Excerpt: “According to public reports and agency statements, tracking technology was embedded on Covered California's website beginning in February 2024, as part of a broader digital advertising effort, and in direct contravention of the tracking platform’s user agreement, which prohibits the use of such tools on pages that collect sensitive health information. Although the tags were reportedly removed in April 2025, following external scrutiny and a vendor transition, the extended period of data exposure raises serious questions about the adequacy of safeguards that Covered California had in place. Forensic testing by investigative reporters identified the trackers in operation and confirmed that user-entered health information was being transmitted to third parties without consent. These circumstances warrant examination of Covered California’s actions under federal privacy standards.” “Ensuring the confidentiality of health information is a foundational obligation for entities operating within the health insurance ecosystem. Federal privacy protections, particularly the Health Insurance Portability and Accountability Act (HIPAA), establish expectations for how covered organizations handle sensitive data. Recent reports and public filings raised questions about whether those expectations were met in this case, and whether existing oversight mechanisms are sufficient to detect and prevent improper disclosures.” Background: Forensic testing shows Covered California —the State of California’s official health insurance marketplace—has been sending sensitive user health data to third-party websites through several online data trackers. Prior to removal of the trackers, CoveredCA had more than 60 trackers active on its website; the average number of trackers on a government website is three. Some types of information sent to such websites include: Searches for doctors in network with specific plans/specializations Demographic information, including gender, ethnicity, and martial status Length of treatment a patent received by a provider Frequency of doctor visits If the user indicated they were blind, pregnant, a victim of domestic abuse, or used prescription medications. The State of California independently operates CoveredCA. As the state’s official ACA marketplace, CoveredCA falls under the purview of Health Insurance Portability and Accountability Act (HIPAA). The disclosure of information such as pregnancy or prescription drug use without proper consent—even for “marketing purposes”—may violate HIPAA. This Congress, the Committee has sent letters to 23andMe and DeepSeek over potential data privacy concerns: The Committee also held a hearing last Congress on the Change Healthcare hack, where personal health information was also jeopardized. CLICK HERE to read Fox News coverage of the letter. CLICK HERE to view the full letter. ###