Some Health Care Web Sites Lack Privacy

WASHINGTON —  Just how confidential is the information given by visitors to health Web sites? Not very, according to a new report by the California Healthcare Foundation.

Health Web sites are among the most popular stops on the Internet but, unknown to many consumers, the personal information they disclose often finds its way into the vast world of Internet commerce where an array of companies with products to sell have access to it.

Although 19 of the 21 Web sites surveyed by the foundation had privacy policies--a higher proportion than is found generally on the Internet--often the sites did not follow their published policies or their policies were incomplete.

Although most of the sites say that consumers’ health information will not be shared, often it is picked up by companies that advertise on Internet sites. Thus, when a consumer logs on to find out more about diabetes, the pages called up frequently are recorded not only by the Web site operator but by the ad placement company. That company, in turn, can use the information to create a profile of the consumer, track the consumer through other Web page visits, and combine and market the information to interested companies such as manufacturers of products for diabetics.

Among the health Web sites reviewed by the foundation were the popular drkoop.com, altavista.com, medscape.com and mediconsult.com.

“We’re not here to bash the Internet health care industry. We think that a lot of what is going on is good and important,” said Mark Smith, a physician and president of the nonprofit foundation, which works on projects related to expanding access to affordable health care.

Some Internet health care companies already have responded to the growing concern over Internet privacy and acted voluntarily to safeguard consumer information. Among those is MediConsult, a New York-based company that decided in October to phase out banner ads, in part because of concerns about privacy, said company President Ian Sutcliffe.

“We believe in self-regulation, and we believe government has a huge opportunity to help educate people,” Sutcliffe said. He urged consumers to take the time to read and understand privacy policies.

Ultimately, the study’s authors hope that it is used by some Internet health care companies “to help clean up their act,” said JanLori Goldman, director of the Health Privacy Project at Georgetown University and a lead researcher on the report.

The Federal Trade Commission has warned online companies that they should institute privacy policies, notify consumers about them, let consumers review the information they have submitted and give consumers a choice about how their information will be used. The commission has taken enforcement action on three occasions against Internet companies that did not follow their own privacy policies.

“We’re very concerned when Web sites do not follow their privacy policies,” said Dana Rosenfeld, assistant director of the commission’s Bureau of Consumer Protection.

The report will be “very helpful” to the commission’s ongoing research into whether companies are following their privacy policies, Rosenfeld said.

Health Web sites are a booming part of the Internet, with about 17,000 now in operation. They are widely viewed as one of the most powerful tools of the future in educating consumers about health care, helping consumers buy pharmaceutical drugs and other health products online, and helping physicians manage and store consumers’ medical records.

Of the about 110 million Internet users, about 25 million adults in the United States have visited health Web sites.

Previous studies by the foundation have found that when consumer privacy is neglected in the health care realm, consumers become extremely wary of giving complete information--or any information at all, even to their doctors. A recent survey found that fully 40% of those polled would not give a doctor online access to their medical records and 25% would not refill a prescription over the Internet. Even in the world of paper records, consumers are wary of filing insurance forms when sensitive health conditions are involved.

On the Web, some consumers have no idea that where they go on the Internet and the information they reveal can be readily tracked. Most consumers rarely read the fine print of privacy policies and, when they do, often find them confusing, researchers said.

Though 14 of the 21 sites surveyed have privacy policies in which they say that they limit disclosures to third parties, at a number of the sites disclosure occurs through ad banners at the top of the Web page simply because the consumer has visited the site.

The companies that run the ad banners are able to tag consumers with an identifying device known as a cookie--even if the consumers never click on the ad banner. The cookie then can be used by the ad company to follow the consumer through the Internet. The consumer remains anonymous until an ad company can match the profile to the consumer’s e-mail, name or street address.

Consumer advocates believe that the privacy policies of different companies are hard for most Web users to follow. “They should have one simple privacy policy that we can trust,” Goldman said.