- Academics at the University of Pennsylvania analyzed a nationally representative sample of 100 non-federal acute care hospitals – essentially traditional hospitals with emergency departments – and their findings were that 96 percent of their websites transmitted user data to third parties.
- Not all sites had privacy policies and of those that did, only 56% disclosed specific third parties receiving data.
- Google and Meta (through Facebook Pixel) were on nearly every site and received the most data. Adobe, Verizon, Oracle, Microsoft, Amazon also received data.
- Common data shared included IP addresses, browser info, pages visited, referring site.
- Sharing data poses privacy risks for visitors and legal/regulatory risks for hospitals if policies don’t comply with laws.
- A class action lawsuit against Mass General Brigham and Dana-Farber resulted in an $18.4M settlement over sharing patient data.
- Researcher calls for hospitals to collaborate with computer science departments to design more private websites. Also recommends privacy tools to block third party tracking.
But in the meantime, and in lieu of any federal data privacy law in the US, protecting personal information falls to the individual. And for that, Friedman recommends browser-based tools Ghostery and Privacy Badger, which identify and block transfers to third-party domains. “It impacts your browsing experience almost none,” he explained. “It’s free. And you will be shocked at how much tracking is actually happening, and how much data is actually flowing to third parties.”
Note: Although Friedman recommends Ghostery and Privacy Badger, uBlock Origin is generally considered a better privacy-enhancing browser extension. Additionally, there exist multiple approaches for adblocking and tracker blocking beyond the browser extension model.
This is just a guess, but I would assume the hospitals doing this are unaware. They probably just put Google Analytics and Meta’s SDK on their website, completely oblivious to the fact that that shit vacuums up everything on the page, including text box inputs.
The bad part is that even if you block everything on the client side with ad/tracker blocking extensions, there’s nothing stopping them from collecting data on the server side.
That would be a violation of HIPAA.
I was referring to the website. This article goes in a lot more detail about how it works.
I’m pretty sure they are consulting lawyers to see how much data they can sell to third parties without breaking the law.
For non-medical data, sure. That’s not an uncommon form of data collection. It’s a complete violation of HIPAA to use something like that on medical databases.
Please explain. How can google, Facebook, and such get data out of a hospital web server directly? That would be hacking.
Typically trackers are implemented client side because it’s more convenient. It’s closer to the user, it can collect more data, and there is only one programming language it needs to support, Javascript.
But the disadvantage is that it can be blocked by the users. Data collection and user tracking can also be done on the server side. There are many analytics packages that support it, including Google Analytics. This is much easier to hide from the users. Here is an article I found on the topic.
It’s not hacking because the website developers integrate it willingly.
Doesn’t this violate HIPAA, or does HIPAA not cover this?
HIPAA prevents providers from sharing your personal medical data. In this case, you are the one sharing the data by using a third-party portal. Best recommendation is to check-in in person, complete ER forms on paper, and avoid using third-party apps/websites for medical care. Provider-hosted secure portals are protected by HIPAA.
That’s a huge loophole.
Fuck this country. 😬
Write your representatives asking for privacy legislation. The EU’s GDPR is a great example.
I remember years ago my friends told me Ghostery did some shady business. Sadly it is difficult to find any useful information about this, between the lots of ads and pop ups (Where have all the blog posts gone ?), but here is something : https://en.wikipedia.org/wiki/Ghostery#Criticism
Welcome to for-profit healthcare.
Reading this while in an urgent care lmao
Feel better.
Just a sprain :P I should get over it fast. Thank you though :)
I bet they made you use a website or app to check in. And that website wasn’t created by the Urgent Care. So everything you entered isn’t protected by HIPPA.
They did and probably 😔
I feel like this is ripe for abuse. I’m sure insurance companies purchase this data to screw their customers in some wicked way
This is called “enumerating badness” and the findings here are both probably not that meaningful and based on a lot of assumptions.
I am curious to see what data is being transmitted, but not a lot is actually revealed by this
“Common data shared included IP addresses, browser info, pages visited, referring site.”
So enough to cross reference with a bazillion other data-brokers online and absolutely pinpoint most people.
