In the privacy of a doctor’s office, a patient can ask any question and have it be covered under doctor-patient confidentiality. But what happens when patients want to search possible symptoms of a disease or ailment online?
It’s common to search for treatments for a migraine or stomach pain on WebMD, or a flu strain on the Centers for Disease Control and Prevention website. But there’s no way to know who else may be privy to that search information. So where do the data go when a patient presses enter?
That’s what Tim Libert, a doctoral student at the University of Pennsylvania, wanted to know. He has been researching what happens with information that people search online and spoke with NPR’s Robert Siegel about the privacy implications.
Interview Highlights
On what happens when someone searches a health issue
I took a list of 2,000 common disease names — I mean everything from migraines to breast cancer. I ran those through a search engine and I found about 80,000 pages that were related to those terms. I looked at those pages and I found about 90 percent of those, when you load the page on your computer, it tells hidden parties the address of the page you’re looking at. In cases where that address has the name of the disease or something, these hidden parties get to find out what it is you’re interested in.
On who these hidden parties are, and why they’re interested
Most of the times it’s advertisers — so these are your marquee names, your Googles and Facebooks. But I also found kind of further down there a fair amount of tracking going on by data brokers. So these are companies like Experian and Acxiom. And their core business model is not advertising per se, but selling information about you to whoever wants to buy it.
On what they would do with this search information
There’s actually companies that sell lists of people who have different diseases or symptoms. There’s been some kind of chilling cases: [There were] companies selling lists of people who had been raped or people who had AIDS. So there’s a market for this stuff.
On the Health Insurance Portability and Accountability Act of 1996 [HIPAA] and its relation to online data privacy
HIPAA’s a pretty good law, but HIPAA was made long before the Web was really in everybody’s home and very well before smartphones existed.
Anything that is happening on the Web today is pretty much completely unregulated. There’s really no oversight and there’s no real standards either. Companies aren’t required to encrypt the information to keep it in a secure place. And we’ve also been seeing a lot lately that this is of interest to criminals, so there is additional kind of worry that not only is it not protected by HIPAA — it’s not really protected at all.
Copyright 2016 NPR. To see more, visit http://www.npr.org/.
