It started with email. Which of us hasn’t inadvertently sent an email to the wrong person? Most of the time a withdrawal of the missive and an apology is the end of the matter. But what if a mistakenly sent group email contains personal health information about yourself? Whether embarrassing or not, it’s now potentially “out there” online.
On top of this, with Google, Facebook and a host of powerful search engines, aided by the ubiquitous cookies, you may not even be aware you are leaving an online health trail. Specifically, browser cookies – small text files saved to your computer that can be used to identify and correlate your visits to many websites – operate in the background quietly sending information about your browsing habits to third parties.
In January 2014, the Privacy Commission of Canada declared that Google had violated Canadian privacy law when it used information about individuals’ online activities to target them with health-related advertisements.
Someone who had searched online for medical devices to treat sleep apnoea found himself followed by advertisements for similar devices as he visited unrelated websites.
He had unknowingly generated a browser cookie that triggered ads for sleep apnoea devices when he visited websites that used Google’s advertising services.
Resold
A recent
British Medical Journal
review notes that records of visits to pages for sleep apnoea, depression, or addiction treatment can be resold to organisations that want to know who is interested in these topics.
“Such information may be as sensitive as that contained in electronic health records and yet little legal oversight regulates how this health information is collected, how long it is kept, and how it is used,” the authors say.
They reference a study using 1,986 health-related search terms which showed that some 91 per cent of more than 80,000 commonly visited web pages initiated such requests, most of which transmit user information to third parties, largely to promote marketing.
While the commercial imperative for such tracking is obvious, the practice is also found among government public health sites. In the UK, for example, the NHS homepage generates third-party requests to seven domains owned by American companies, including Amazon and Google. Similar information sharing is also found in a majority of health-related French web pages.
While it can be argued that most web browsing reveals little personal health detail, it’s a different ball game when data is aggregated. This allows patterns of behaviour to be attributed to specific people.
Facebook requires the use of real names; by linking these with user’s exploration of health sites there is potential to pair names with health conditions.
The potential leak of personal information in this manner is in stark contrast to the strict controls of personal medical information generated by encounters with healthcare professionals. It's hard to disagree with the BMJ review conclusion that: "It is as if the front door is barricaded and the back door is wide open."
It’s also possible that as individuals living in a highly connected and sharing world we are no longer as concerned as we were about sharing personal health information. We seem relaxed about using devices that promote fitness and weight loss and encourage online sharing of health information as a motivating tool, and to involve friends and physicians in our quest for better health.
Other positives have and will emerge. At a population level, browsing history has been used to forecast flu outbreaks, albeit with mixed results. In a gamekeeper- turned-poacher scenario, the clever use of data by commercial organisations could be adapted (with appropriate controls) to predict when an individual has reached a point where they are ready and motivated to give up smoking.
It is time we had a debate not just about the need for tighter regulation of health-browsing information but also about how it can be used to promote individual and public health.
mhouston@irishtimes.com @muirishouston