Blue Shield of California shared the private health data of millions with Google for years

Blue Shield of California is notifying 4.7 million people after discovering that a misconfigured Google Analytics implementation collected and shared patients’ personal and sensitive health information with Google from 2021 until January 2024. Exposed data included search terms on its site, plan details, member account numbers, claim service dates, provider information, names, and financial responsibility; Blue Shield learned in February 2024 that sensitive data was involved, and it’s unclear if Google will delete it. The company’s breach, attributed to online tracking technologies, is currently the largest U.S. healthcare-related data breach reported in 2025.