Why are these health-care websites sharing sensitive info with LinkedIn and Snapchat?
Why are these health-care websites sharing sensitive info with LinkedIn and Snapchat?
This story was originally published by The Markup, now a part of CalMatters. Sign up for their newsletter.State-run health care websites around the country, meant to provide a simple way to shop for insurance, have been quietly sending visitors' sensitive health information to Google and social media companies, The Markup and CalMatters found. The data, including prescription drug names and dosages, was sent by web trackers on state exchanges set up under the Affordable Care Act to help Americans purchase health coverage. The exchange websites ask users to answer a series of questions, including about their health histories, to find them the most relevant information on plans. But in some cases, when visitors responded to sensitive questions, the invisible trackers sent that information to platforms like Google, LinkedIn, and Snapchat. The Markup and CalMatters audited the websites of all 19 states that independently operate their own online health exchange. While most of the sites contained advertising trackers of some kind, The Markup and CalMatters found that four states exposed visitors' sensitive health information.Nevada's exchange, Nevada Health Link, asks visitors about what prescriptions they use, including the names and dosages of the drugs, to help them find their best options for health insurance. When visitors start typing, it suggests specific medications, including antidepressants, birth control and hormone therapies. As visitors answered the questions, their responses were sent to LinkedIn and Snapchat, according to tests conducted by The Markup and CalMatters in April and May.
Spend your money smart: Sign up for USA TODAY's Daily Money newsletter.
On the other side of the country, Maine's exchange, CoverME.gov, sent information on drug prescriptions and dosages to Google through an analytics tool. It also sent the names of doctors and hospitals that people had previously visited.
Rhode Island's exchange, HealthSource RI, sent prescription information, dosages, and doctors' names to Google.
Massachusetts Health Connector, another exchange, told LinkedIn whether visitors said they were pregnant, blind, or disabled.
After being contacted by The Markup and CalMatters, Nevada's health exchange stopped sending visitors' data to Snapchat and Massachusetts stopped sending data to LinkedIn. Additionally, The Markup and CalMatters found that Nevada stopped sending data to LinkedIn in early May, as testing was happening.
The Markup and CalMatters discovered the sharing after finding that California's exchange, Covered California, told LinkedIn when a visitor indicated they were blind, pregnant, or a victim of domestic violence.
Experts said state health exchanges' use of advertising trackers was troubling if not entirely surprising. Such tools can help organizations to reach visitors and tailor ads for them. Google Analytics allows website operators to better understand who is coming to their site and to optimize ad campaigns. The LinkedIn and Snap trackers, like a similar offering from Meta, help companies target their social media ads.
Nevada uses the trackers to help target marketing at uninsured residents, according to Russell Cook, Executive Director of the state agency that operates Nevada's exchange, Silver State Health Insurance Exchange.
But health care services need to be especially careful with those tools, said John Haskell, a data privacy attorney who has previously worked as an investigator for the Department of Health and Human Services.
'It doesn't surprise me that organizations that have these massive tech stacks that rely on third party-resources don't have a full understanding of what the configuration is, what the data flows are, and then once they go to somebody, what that data is being used for,' Haskell said. 'It's something that needs to be addressed.'
How was state exchange data tied to users' identities?
After The Markup and CalMatters reported on Covered California's sharing of health data with LinkedIn, the exchange removed its trackers and said it would review its data practices. The news triggered a class-action lawsuit and questions from federal lawmakers.
The Markup and CalMatters then examined websites operated by 18 states other than California, as well as Washington, D.C., to see what information they shared as users navigated them. The sites were established under the Affordable Care Act, which requires states to offer health insurance either through their own exchanges or one operated by the federal government.
To test them, The Markup and CalMatters first ran the sites through Blacklight, a tool we developed to reveal web trackers. We then reviewed network traffic on the sites to see what data the trackers received when visitors filled out forms.
The results showed that 18 used some sort of tracker. Some were filled with them. Nevada, for example, used nearly 50. By contrast, Blacklight found no tracker of any kind on Washington, D.C.'s exchange. Popular websites use on average seven trackers, according to Blacklight scans of the 100,000 most trafficked sites on the web.
Many of the sites used trackers in relatively innocuous ways, like counting page views.
The four exchanges The Markup and CalMatters found sharing sensitive health data sent varied responses to questions about the tracking.
Cook said in a statement that trackers placed by his Nevada agency were 'inadvertently obtaining information regarding the name and dosage of prescription drugs' and sending it to LinkedIn and Snapchat.
Cook acknowledged such data was 'wholly irrelevant to our marketing efforts' and said it had disabled tracking software pending an audit.
Jason Lefferts, a spokesperson for Massachusetts Health Connector, said in a statement that 'personally identifiable information is not part of the tool's structure and no personally identifiable information, not even the IP addresses of users of the tool, has ever been shared with any party in any way via this tool." But LinkedIn's tracker documentation makes clear that it correlates the information it receives with specific LinkedIn accounts so companies can use the data for features like retargeting website visitors. The company's documentation also states it later obscures this information and eventually deletes it.
Spokespeople for the Rhode Island and Maine health exchanges said that they pay a vendor, Consumers' Checkbook, to run a separate site that allows visitors to explore what plans are available to them through their states' exchanges. It was from these sites that sensitive information was shared to Google. Consumers' Checkbook's sites are at different web addresses than the exchange sites, but are prominently linked to on the exchange sites and display identical branding like the state health exchange's logo, making it unlikely that an average visitor would realize they were no longer on a state-run domain.
Christina Spaight O'Reilly, a spokesperson for HealthSource RI, said the company uses Google Analytics to study trends but not to serve ads, and 'disables Google Signals Data Collection, ensuring that no data is shared with Google Ads for audience creation or ad personalization, and no session data is linked to Google's advertising cookies or identifiers.' HealthSource RI's terms of use mention the use of Google Analytics, she noted. A spokesperson for CoverME.gov made similar points, saying that the agency 'does not collect or retain any data entered into the tool.'
Consumers' Checkbook declined to comment beyond the exchanges' statements.
All of the exchanges said that individually identifiable health information, like names and addresses, wasn't sent to third parties. But the point of the trackers is to enhance information sent about a user with data the platforms already have on that user, and every tracker found by The Markup and CalMatters logged details about individual visitors, such as their operating system, browser, device, and times of visit.
In response to requests for comment, the tech companies whose trackers were examined uniformly said they do not want organizations sending them potentially sensitive health data, and that doing so is against their terms of use.
Steve Ganem, Director of Product Management for Google Analytics, said that 'by default any data sent to Google Analytics does not identify individuals, and we have strict policies against collecting Private Health Information or advertising based on sensitive information.' A spokesperson for LinkedIn, Brionna Ruff, said that advertisers are not allowed 'to target ads based on sensitive data categories,' such as health issues. A spokesperson for Snapchat owner Snap said the same, noting that sending purchases of supplies like prescriptions would run afoul of the company's rules about sensitive data.
A Google Analytics information page specifically discusses how organizations that use the company's tools should comply with the Health Insurance Portability and Accountability Act, which protects health data. The page notes that 'Google makes no representations that Google Analytics satisfies HIPAA requirements.'
'It is important to ensure that your implementation of Google Analytics and the data collected about visitors to your properties satisfies all applicable legal requirements,' the page reads.
More incidents
State exchanges aren't the only health sites that have sent medical information to social media companies. In 2022, The Markup revealed that dozens of hospital websites shared information with Facebook's parent company, Meta, through a tool called the Meta Pixel. The hospitals faced scrutiny from Congress and legal action. Another Markup investigation found trackers logging information about online drugstore visitors purchasing HIV tests and Plan B. In 2023, a New York hospital agreed to pay a $300,000 fine for violations of the Health Insurance Portability and Accountability Act, or HIPAA.In response to a series of incidents, the Department of Health and Human Services said in 2023 that use of social media trackers to log health information could violate HIPAA, although recent court decisions have narrowed how the law can be applied against companies that use those trackers. Some plaintiffs have used state laws, like those in California, to argue that they should be compensated for having their health data sent to third parties without consent. Others have argued that this kind of tracking runs afoul of wiretapping or even racketeering laws. 'Organizations aren't investing enough time and resources into properly vetting everything,' said Haskell, who advises clients to be very careful about the information they track on their sites. 'When organizations are saying, 'we didn't understand that there's a certain configuration of this tool that we're using,' well, I can't really not put that on you.'
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Buzz Feed
3 hours ago
- Buzz Feed
20 'Healthy' Habits That Are Actually Harmful
If you've ever picked up a habit that you thought was healthy only to find out later that it wasn't doing you any favors, welcome to the club. Recently, people on Reddit shared some common behaviors that people think are healthy that can actually backfire, and I'm definitely guilty of a few of these. Here's what they had to say: "Overtraining without rest. Fitness obsession can backfire fast if you ignore recovery." —Appropriate_Rip_104"Found this out recently. Terrible headache, two days of depression, and weakness. My body just said, 'no more.'I'm on a better routine now, not as intense, and learning to rest without guilt."—budda_belly "Carnivore diets. You're telling me you've eliminated fruits and vegetables in favor of eating absurd amounts of fat and/or protein in the name of health? Stop and listen to how ridiculous that sounds. Anything taken to the extreme is bad, and carbs do not make you fat just because they're carbs. Keto isn't much better either." "The idea that because you don't have a diagnosis, you don't have a problem. I spent 23 years of my life with undiagnosed ASD/ADHD, which was unpleasant and led to some hellish self-doubt and low self-esteem. I had problems that made me feel awful, and I'd just rationalize it as everyone else had those problems, but then I realized that this wasn't the case, and that I was an oddball. Spent many nights sleepless, going, 'Why can't I be normal?'" "Consuming tons of protein! Studies show that Americans tend to overestimate protein needs. My protein needs as a grown adult, per evidence-based calculators, are about 46g of protein per day. I've been told time and time again on Reddit this isn't enough, and even been told it's not enough PER meal! Insane. Your body makes the proteins it needs as long as all of the necessary amino acids are present!" "I think a lot of American men are interested in growing the size of their muscles and hear about protein left and right, so their viewpoint of what protein needs look like may be skewed toward what's needed for bulking. And I believe this influences how many people think about protein needs online, even for people who aren't bulking whatsoever. 46g per day is easily achieved with three meals, including vegetarian meals."—Ok_Nothing_9733 "'Positive vibes only' attitude." "Detox teas/diets. People, you do not need to detox. Your body removes toxins through its normal processes, and unless something is very wrong, you don't have random toxins hanging out in your body and poisoning you. And a lot of these really expensive teas have questionable herbs or other ingredients in them that could harm you." "Working 80 hours a week because 'hustle culture' told you it's the path to success. Congrats, now you're rich and exhausted." —patilpradipj"The weird thing about this is, I'm now in C-suite management after working my way up from being an electrician, did the whole thing, big hours, night school for an MBA, I work less now than when I was a teenager! Get to a level you're happy with, then look for other things that make you happy. I put my body and mind through hell to climb the ladder, now I try to relax as much as I can!!"—Oncemor-intothebeach "Going vegan without proper preparation and understanding of nutrients, out here hella deficient in lots of stuff, and it's unhealthy!" "Independence. Obviously, a certain amount is healthy, but some people/cultures glorify hyper-independence, associating it with strength. Social support and connection are so important for healing, health, and quality of life." "Most diets. I think I did the cabbage soup diet for the first time at 12. I found it as an adult, and that is just... What?! What was I thinking?!?!" —Syndromia"Same! The magazines were saying Victoria Beckham was doing it, so I did it. I was just farting and hungry all the time."—AdRevolutionary6650 "Apple cider vinegar shots in the morning to boost metabolism. It's never been scientifically proven to burn fat or increase metabolism. You are also essentially rinsing your teeth in acid first thing in the morning." "One that always comes to mind is those 'healthy' fruit juices. Like, we think we're doing our bodies a favor by sipping on a juice, but a lot of store-bought ones are loaded with sugar. Even if it's 100% fruit juice, it can still spike your blood sugar and mess with your metabolism. Over time, it's actually not as healthy as we think!" "Pushing yourself through pain. It's one thing to push yourself in a workout a little more than last week to see results, but I've seen so many people brag about 'playing through an injury,' and all I can think is, 'Congrats? I guess?' No joke, I met a dude who claimed he finished a rugby game at school with a torn ACL and called me a pussy for getting surgery as soon as I could." —Sufficient-Ad-3586 "Obsessive diet limitation. You want to give up sugar for a short period of time or try a diet elimination to find out what's making you bloat go for it but chances are if you continue this on a hardcore bias and cut out things completely if it's not allergy related it's not sustainable and you are just going to binge later. Sugar is okay in moderation. Carbs are okay in moderation." "Comparing your real life to Instagram fitness models' highlight reels. Mental health matters more than visible abs." "Pretty much every unregulated dietary supplement out there. There are people who say that they don't trust Big Oil, Big Pharma, but take like 10 or more supplements, despite the fact that prescription drugs are much better regulated than any supplement." —WhaleSharkLove "Following whatever viral podcast seems like it has 'good' health information." "Talking about your feelings. Obviously, don't bottle stuff up to the point of some kind of implosive episode. But it's not healthy to 'vent' all the time or analyze every emotion you have. It shrinks your worldview down to 'how you feel about it' and removes your ability to think critically or objectively about things. It also breeds a sort of narcissistic state of being where everything is filtered through the lens of how YOU feel about it." "Sun exposure. Like, yes, of course, go outside and get fresh air and open your curtains, but over time, long-term sun exposure is what leads to signs of aging, but worse, of course, can lead to skin cancer and other skin issues. Wear sunscreen, stay in the shade as much as you can when you're outside, take care of yourself, etc, etc." "I felt so silly learning this as an adult. If excessive tanning makes people look like leathery reptiles and if the sun burns you, why would you only wear sunscreen only in the summer only on certain parts of your body? The sun's rays are always hitting you. Why else did people who didn't go out have such pale and even skin? Duh. It's so obvious to me now."—snickerssnacks And finally, "Honestly, too much of everything will make you sick, no matter if it's healthy or not." Is there anything else you would add? Tell us about it in the comments or via the anonymous form below:
Axios
4 hours ago
- Axios
Retiring GOP senator savages Medicaid cuts in Trump's "big, beautiful bill"
Fresh off announcing he'll retire next year, Sen. Thom Tillis gave a lengthy floor speech Sunday night attacking cuts to Medicaid in the " big, beautiful bill." Why it matters: The North Carolina Republican is accusing the GOP of breaking President Trump's campaign promises to protect Medicaid. Tillis voted Saturday against starting debate on the bill, and has declared he'll vote "no" on the final version. Zoom in: "I'm telling the president, you have been misinformed," Tillis said on Sunday night. "What do I tell 663,000 people in two years, three years, when President Trump breaks his promise by pushing them off of Medicaid because the funding's not there anymore," Tillis asked. He compared Trump's promise on Medicaid to former President Obama's "if you like your health care plan, you can keep it" quote on the Affordable Care Act. The Senate's version of the "big, beautiful bill" would result in 12 million more people without health insurance in 2034 than today, the Congressional Budget Office projects. Between the lines: The Senate is expected to vote on Monday on an amendment by Sen. Rick Scott (R-Fla.) that would lower the federal matching share (FMAP) for states that have expanded their Medicaid programs.
Indianapolis Star
7 hours ago
- Indianapolis Star
Indiana's Ryan White opened hearts to AIDS fight. Don't abandon his legacy now.
Ryan White was a spirited, bright kid who loved basketball, Nintendo and dreaming big. In 1984, 13-year-old Ryan contracted HIV through a contaminated blood transfusion used to treat his hemophilia. With widespread misconceptions about HIV/AIDS dominating the headlines, and fear overruling facts, Ryan was barred from attending his school and driven from his hometown of Kokomo. His harrowing story suddenly thrust Ryan onto the national stage, where he transformed the attention into a powerful force for changing perceptions about those living with HIV/AIDS. He had no idea how far his message would reach. Yet he was determined to use it for the greater good. His courage inspired the creation of the Elton John AIDS Foundation, which continues to help people across America, and around the world, stay safe and well. At the time of his diagnosis, doctors gave Ryan only six months to live. On April 8, 1990, six precious years later, we sat together at Ryan's bedside and held his hands as he lost his young, heroic life to AIDS. First lady Barbara Bush attended his funeral, and businessman Donald Trump came to the family home to pay his respects. When Americans needed to take compassionate action, Ryan opened the door and urged everyone to take heart and to help. Four months later, in his name, Congress nearly unanimously enacted the Ryan White CARE Act – providing essential HIV care and treatment to Americans living with the virus. After years of fearmongering and paralysis, the U.S. government had finally committed to join the fight against our common enemy: AIDS. Ryan would be grateful for the progress being made. Today, more than 500,000 Americans living with HIV get lifesaving treatment through the Ryan White CARE Act. In 2019, President Trump proudly launched the End the HIV Epidemic initiative in his State of the Union address − a focused prevention effort to end the HIV epidemic in America by 2030. This evidence-based strategic initiative has achieved remarkable results, reducing new HIV infections by 21% in targeted communities and connecting people newly diagnosed with HIV to vital care and support services. This push to end AIDS is in full swing across America, but the work is not done yet – with young people, particularly in the South, now most severely impacted. We are grateful that the draft budget before Congress continues critically important funding for the Ryan White CARE Act and the End the HIV Epidemic efforts. That is an affirmation of these programs' effectiveness and bipartisan support. However, the proposal also would end federal funding to states for HIV surveillance, testing and education; for community-based organizations that reach those most at risk; and for substance abuse treatment and mental health programs that are crucial for driving down HIV infections. Attempts to cut Medicaid are also alarming, as more than 40% of people living with HIV have their care and treatment covered by Medicaid. Without this essential insurance, scores of people living with HIV won't get the care and medicines they need to keep them healthy. The president has said don't mess with Medicaid. We agree. Programs that provide treatment, fuel prevention and fight stigma should be expanded, not eliminated, as we work toward eradicating the disease that ended Ryan's life. The game-changing opportunity of the moment is to scale up prevention medication that keeps people HIV-free. The recent American-led development of PrEP − a pill or shot that prevents the virus from taking hold − is just the tool we need to end AIDS, but only if we make it accessible to those who need it. The economics are compelling: 14,000 people can receive generic PrEP ($30 annually) for the lifetime cost of treating one person with HIV ($420,285) − keeping Americans healthy, HIV-free and productive. The moment of truth is here. As the administration and Congress consider their investment priorities for next year, we urge them to continue joining forces in the fight against AIDS in the United States and worldwide. Together, their investments over time have created this once-in-a-generation opportunity to end AIDS in America by 2030, as called for by President Trump. Together they can seize that opportunity by banking on prevention. Ryan would expect nothing less.
