- Academics at the University of Pennsylvania analyzed a nationally representative sample of 100 non-federal acute care hospitals – essentially traditional hospitals with emergency departments – and their findings were that 96 percent of their websites transmitted user data to third parties.
- Not all sites had privacy policies and of those that did, only 56% disclosed specific third parties receiving data.
- Google and Meta (through Facebook Pixel) were on nearly every site and received the most data. Adobe, Verizon, Oracle, Microsoft, Amazon also received data.
- Common data shared included IP addresses, browser info, pages visited, referring site.
- Sharing data poses privacy risks for visitors and legal/regulatory risks for hospitals if policies don’t comply with laws.
- A class action lawsuit against Mass General Brigham and Dana-Farber resulted in an $18.4M settlement over sharing patient data.
- Researcher calls for hospitals to collaborate with computer science departments to design more private websites. Also recommends privacy tools to block third party tracking.
But in the meantime, and in lieu of any federal data privacy law in the US, protecting personal information falls to the individual. And for that, Friedman recommends browser-based tools Ghostery and Privacy Badger, which identify and block transfers to third-party domains. “It impacts your browsing experience almost none,” he explained. “It’s free. And you will be shocked at how much tracking is actually happening, and how much data is actually flowing to third parties.”
Note: Although Friedman recommends Ghostery and Privacy Badger, uBlock Origin is generally considered a better privacy-enhancing browser extension. Additionally, there exist multiple approaches for adblocking and tracker blocking beyond the browser extension model.
Glad to live in Europe…
Yah. We need a more general version of HIPPA that covers all personal data, not just health information.
If any of this is actual health info it’ll be $25000 per person, per instance.
That’s not entirely true. HIPAA prevents providers from sharing your personal data, but it doesn’t prevent you from sharing it. If the office uses a portal site with an EULA that discloses third-party data sharing, and you accept, it’s disgustingly legal.
As for personal data, we absolutely need the GDPR or equivalent in the US. Unfortunately, the personal data trade is a $300B/yr industry in the US, so they have plenty of cash for lobbying.
Why is that disgusting?
The urgency of someone in need of medical assistance would make them highly likely to accept terms without reading them. It’s predatory in my opinion.
It’s predatory from the get go. If you actually read any of these things they’re impossible to fully comprehend.
There’s a great website that converts the legalese of TOS into english, made by lawyers working pro-bono. I highly recommend it.
This is the result of running hospitals like businesses
“Common data shared included IP addresses, browser info, pages visited, referring site.”
Is this not common practice for any website?
Would it ever happen that there’s so much data that it is actually difficult to sort and categorise it?
