{"id":24435,"date":"2022-12-19T15:18:58","date_gmt":"2022-12-19T15:18:58","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/19\/surprise-telehealth-startups-playing-fast-and-loose-with-sensitive-user-medical-data\/"},"modified":"2022-12-19T15:18:58","modified_gmt":"2022-12-19T15:18:58","slug":"surprise-telehealth-startups-playing-fast-and-loose-with-sensitive-user-medical-data","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/19\/surprise-telehealth-startups-playing-fast-and-loose-with-sensitive-user-medical-data\/","title":{"rendered":"Surprise: Telehealth Startups Playing Fast And Loose With Sensitive User Medical Data"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

from the nothing-is-sacred-when-there’s-money-to-be-made<\/i> dept<\/h3>\n

From the\u00a0Internet of very broken things<\/a>\u00a0to\u00a0telecom networks<\/a>, the state of U.S. privacy and user security is arguably pathetic. It\u2019s 2022 and we still don\u2019t have even a basic privacy law for the Internet era, in large part because over-collection of data is too profitable to a wide swath of industries, which, in turn, lobby Congress to do either nothing, or the\u00a0wrong thing<\/em>.<\/p>\n

Sensitive medical data, supposedly held to a higher standard, isn\u2019t much of an exception. The Markup and STAT this week had an interesting joint report showcasing how many telehealth startups routinely play fast and loose with consumer data<\/a>. Numerous telehealth websites were found to share sensitive data with ad networks, including which new medications you were taking and what issues you are having:<\/p>\n

\n

On 13 of the 50 websites, we documented<\/a> at least one tracker\u2014from Meta, Google, TikTok, Bing, Snap, Twitter, LinkedIn, or Pinterest\u2014that collected patients\u2019 answers to medical intake questions. Trackers on 25 sites, including those run by industry leaders Hims & Hers, Ro, and Thirty Madison, told at least one big tech platform that the user had added an item like a prescription medication to their cart, or checked out with a subscription for a treatment plan.<\/em><\/p>\n<\/blockquote>\n

Once this data makes its way into advertising networks, it inevitably gets collated into \u201canonymized\u201d profiles of individuals that data routinely suggests aren\u2019t actually that anonymous<\/a>. All it takes is a few additional snippets of data found elsewhere (often available courtesy of a parade of breaches, hacks, or leaks) before individual users can be identified. <\/p>\n

A recent Mozilla report also found that most mental health and prayer apps similarly have pathetic privacy and security standards<\/a>. And numerous reports have pointed out how the \u201cnew and improved\u201d privacy standards, heavily hyped by tech giants like Apple, are often performative<\/a>.<\/p>\n

As The Markup report makes clear, existing privacy regulations like the Health Insurance Portability and Accountability Act (HIPAA) were not built for telehealth, so much of this sloppy handling of consumer data falls through the cracks. Most consumers, meanwhile, operate from the false belief that this data is far more protected than it actually is:<\/p>\n

\n

\u201cIndividually, we have a sense that this information should be protected,\u201d said [Andrew] Mahler, who is now vice president of privacy and compliance at Cynergistek, a health care risk auditing company. \u201cBut then from a legal and a regulatory perspective, you have organizations saying \u2026 technically, we don\u2019t have to.\u201d<\/em><\/p>\n<\/blockquote>\n

U.S. regulators occasionally crack down on bad behavior in this sector, such as when the FTC sued data broker Kochava last July<\/a>, stating the company wasn\u2019t adequately protecting data on whether consumers had visited a reproductive health clinic or addiction recovery center.\u00a0But even post-Roe, with the over-collection of location data taking on life or death stakes, the FTC routinely lacks the staff or finances to take such action with any real consistency in a market full of bad actors.<\/p>\n

And it lacks the staff and resources because it\u2019s become zealous dogma, particularly on the right, to lobotomize all meaningful US regulatory oversight (whether it\u2019s privacy or anything else), then put on dumb, hollow performances<\/a> any time a company abuses the cavalier private data environment they created<\/strong> through their greed and apathy (see: the myopic fixation on TikTok<\/a> and only<\/strong> TikTok). <\/p>\n

Inevitably there will be a medical privacy data scandal so massive it will force the culture to truly own the fact they\u2019ve prioritized money over consumer\/market health, privacy, and safety for decades. But even then, it\u2019s a steep uphill climb to get a comically corrupt Congress to craft even the most modest of guardrails. <\/p>\n

\nFiled Under: consumer protection<\/a>, ftc<\/a>, medical data<\/a>, privacy<\/a>, remote medical<\/a>, security<\/a>, startups<\/a>, telehealth<\/a>
\n<\/p>\n<\/div>\n