On April 3, Health Affairs published a research article entitled, “Widespread Third-Party Tracking On Hospital Websites Poses Privacy Risks For Patients And Legal Liability For Hospitals.” The article’s authors found that 98.6 percent of U.S. hospital websites use third-party tracking code that transfers patient data to large technology companies, social media companies, advertising firms, and data brokers. Additionally, 94.3 percent had at least one third-party cookie.
The article says that “By including third-party tracking code on their websites, hospitals are facilitating the profiling of their patients by third parties. These practices can lead to dignitary harms, which occur when third parties gain access to sensitive health information that a person would not wish to share. These practices may also lead to increased health-related advertising that targets patients, as well as to legal liability for hospitals.”
Further, “Alphabet (the parent company of Google) was the most common tracking entity among all hospitals in the sample, with 98.5 percent of all home pages reporting third-party transfers to this entity. Other common third-party entities included Meta (55.6 percent), Adobe Systems (31.4 percent), and AT&T (24.6 percent).”
The authors also discovered that transfers to third-party domains whose parent company could not be identified were found on 69.0 percent of home pages. Additionally, hospital website home pages had a median of 16 third-party transfers and were largest among medium-sized hospitals, nonprofit hospitals, urban hospitals and health system-affiliated hospitals.
“We found that hospitals in health systems, hospitals with a medical school affiliation, and hospitals serving more urban patient populations all exposed website visitors to more third-party data transfers,” the article notes. “Although further research is needed to examine the causes of this discrepancy, it may be influenced by multiple factors. These hospitals may strive to include more features on their websites, and the additional tracking is a product of including third-party functionality, such as embedding a Google Maps product onto a site. Alternatively, these hospitals may engage in higher levels of online advertising to drive revenues, and the third-party tracking is a consequence of the perceived need to monitor these adverting campaigns by installing tracking tools.”
As for recommendations, the authors say that “Hospitals have a responsibility to protect patients from unnecessary risks, including risks to their privacy. Furthermore, as suggested by the recent settlement with Mass General Brigham and the Dana-Farber Cancer Institute, similar ongoing lawsuits against other hospital systems, and HHS’s clarification that HIPAA rules apply to some data transfers from regulated entities’ unauthenticated web pages, hospitals may also face financial risks for exposing website visitors to unwanted tracking.”
The authors add that policy makers should address tracking on health-related websites in proposed policy legislation—building on the framework of the American Data Protection and Privacy Act—to eliminate this practice. Hospitals, according to the authors, should also audit their websites to limit or prohibit third-party tracking. If a hospital chooses to allow third-party tracking, it should make website visitors aware of this practice and give them an option to opt out of tracking. Additionally, the authors recommend having third-party tools’ privacy polices reviewed by their organization’s legal department.
