9 ms·
Facebook is receiving sensitive medical information from hospital websites
- hgazx 4y agoMore like “hospital websites are sending sensitive medical information to Facebook”
- blablabla123 4y agoThat's true, I can also imagine how the discussions on the project went. Privacy was never mentioned at all OTOH with that knowledge Facebook might probably want to filter certain keys and values
- Nextgrid 4y agoJust because some bad actors are using spyware doesn't mean the party who originally created the spyware shouldn't be considered complicit. This isn't a case where a tool made for legitimate purposes is being misused, it's a case where the tool has no legitimate purpose.
- kleinsch 4y agoCome on. This is a tool that has a legitimate purpose - if you buy advertising on FB, you use pixel trackers to find out if it was effective. Did the ad you showed the user lead to them doing the thing you want - buying a shirt, signing up for a newsletter, or in this case, making an appointment? They shouldn't be optimizing on medical search terms, but this is a problem with usage, not the tool.
- Nextgrid 4y agoI disagree. Exposing your users (including non-FB users who visit your website directly) to FB stalking isn’t a good enough justification (and in breach of the GDPR). You can track advertising effectiveness yourself by having all your ads point to a unique URL with some query parameter (“campaign_id=123”) which preserves the privacy of everyone. FB can stalk their users on their own properties but at least non-FB users are protected from it.
- trapexit 4y agoDoes anyone know how to tell the FB "pixel" to stop sending the query string to Facebook? Facebook now alerts you if you're sending what looks like PII to them in the query string, e.g. parameters named "first_name", but after extensive Googling I couldn't find any way to tell the FB code to strip off the query string before sending conversion events back to the mothership. It's not exactly easy, but with Google Analytics it's at least possible to redact the URL before it gets attached to the transmitted event. The only thing I could think of was to do for Facebook was to use a redirect (or the History API) to strip the query off the URL before loading the FB pixel, but this will break any other embeds that are relying on query params for e.g. form-filling.
- Nextgrid 4y ago> Does anyone know how to tell the FB "pixel" to stop sending the query string to Facebook? It's like letting a burglar in your home after asking them not to rob you. Maybe just not let the burglar enter in the first place?
- Kstarek 4y ago
- deleted 4y ago[deleted]
- mario_kart_snes 4y agoI set up a DNS entry in my hosts file for all facebook/meta domains (https://github.com/jmdugan/blocklists/blob/master/corporations/facebook/all https://github.com/jmdugan/blocklists/blob/master/corporatio...) to be blocked (routed to 0.0.0.0). The effectively blocks any data from the "pixel" because when it tries to send it, the request fails.
- alistairSH 4y agoWhy are the hospitals installing a FB/Meta tracker in patient portals? HIPAA is generally taken seriously in industry - this is a weird oversight.
- api 4y agoIt's not uncommon for shit like that to be in a template that gets used across an organization.
- willcipriano 4y ago"but we want to know how long they stay on each page of the app and it's free!" Was the response I got when I explained the issue with Google Analytics in patient portals.
- xbar 4y agoThis is a common refrain, and the implementers are baffled by any security or privacy concern about it.
- wolpoli 4y agoUnless it is made into a regulatory compliance concern, they don't want to hear about it.
- alistairSH 4y agoI'm guess I'm just surprised that the product owner (or whoever tends to fill that role in this space) isn't intimately aware of the privacy concerns. There's an entire market of HIPAA-compliant data storage/processing/etc. If there isn't a HIPAA-compliant web metrics solution, I guess that's my million-dollar idea (free for the taking, I have zero interest in building it myself).
- deleted 4y ago[deleted]
- 4y ago
- tephra 4y agoA number of pharmacies in Sweden also sent a bunch of data (IIRC for example contents of shopping carts) to facebook via the pixel. All of them are now under investigation by our data protection agency.
- amin 4y agoI'll probably get downvoted but this article seems highly sensationalized. It blames Facebook, while the blame should be on the hospitals who, for whatever reason, have the FB pixel code in locations where it shouldn't be.
- Nextgrid 4y agoYou're suggesting that there are places where the "FB pixel code" should be?
- euroderf 4y agoYes (relatively speaking, only).
- cratermoon 4y agoThe blame should fall squarely on the company providing the electronic health records system, and any regulatory agencies (like the FDA) that are supposed to be overseeing them. The hospitals buy these systems, which are massive and complex, they don't create them in-house. I would not expect them to have the expertise to do so.
- pueblito 4y agoUCHealth’s app does this, and clearly knowingly because it’s spelled out in the Privacy Policy page
- teejmya 4y agoI just loaded their webpage up with Network Inspector and found a Tiktok tracking pixel. Fucking disgusting.
- sharmin123 4y ago
- maxehmookau 4y agoThis is super widespread, even in the UK. This is the patient portal for one of the two largest medical records systems in the UK: https://account.patientaccess.com/Account/Login https://account.patientaccess.com/Account/Login Open the network tab and there's a lot of gstatic network connections.
- Nextgrid 4y agoLast time I looked I found https://patally.co.uk https://patally.co.uk which does the same thing and doesn't have as much nastiness (it only has Google Fonts).
- maccard 4y agoTo be fair, the majority of those gstatic connections are for things like fonts. When you are actually logged in there,s only one (for a font), and that is cached by the browser (because you've received it already). Worryingly, I saw requests (that ublock stopped) to https://exponea.com/ https://exponea.com/, dc.services.visualstudio.com/v2/track, and googletagmanager, _and_ if I book an appointment it sends the details of the booking to the analytics service... that's pretty horiffic.
- tgv 4y agoServing fonts from google is forbidden now in the EU.
- maccard 4y agoThat's a bit of a stretch of an interpretation - you can serve fonts via Google as long as you obtain permission, and it being illegal doesn't mean you're going to get put in jail. The case this came from finedthe company €100.
- tgv 4y agoIt's more serious than that. From The Register: > The ruling directs the website to stop providing IP addresses to Google and threatens the site operator with a fine of €250,000 for each violation, or up to six months in prison, for continued improper use of Google Fonts.
- bbqbbqbbq 4y ago
- nerdjon 4y agoI cannot believe anyone in these comments is defending Facebook on this. Should the hospitals have been better so this sensitive data doesn't get to Facebook? Yes. But we cannot excuse the privacy invasive practices of Facebook and Google (I would be shocked if google was not also getting this data somehow). And this is not just hospital data, it is certain sensitive apps (I really don't need or want Facebook to know every time I open Grindr), nearly every single thing we do these companies find a way to find out because they weasel their way in by offering some helpful feature that a developer would want to use.
- colpabar 4y agoUnfortunately, all of the world's richest people seem pretty set on getting rid of privacy as a concept altogether. https://www.forbes.com/sites/worldeconomicforum/2016/11/10/shopping-i-cant-really-remember-what-that-is-or-how-differently-well-live-in-2030/?sh=348a2c2f1735 https://www.forbes.com/sites/worldeconomicforum/2016/11/10/s... >Once in a while I get annoyed about the fact that I have no real privacy. Nowhere I can go and not be registered. I know that, somewhere, everything I do, think and dream of is recorded. I just hope that nobody will use it against me.
- ajsnigrutin 4y agoMostly because government's don't do shit to stop them, and even when they do, facebook makes millions from that data, and is then fined a few percents of the money earned. Fines for a single act like this, should be multiple times higher than whatever posible income they could get by gathering data like this.
- nerdjon 4y agoIt saddens me that we need the government to step in on cases like this. Why has invading users privacy become normal? While Facebook and Google are the largest, it has become common that smaller companies are doing this to pad their bottom line. As developers we should be pushing back on this. Not using these tools from Facebook and Google that just grow their grip on the web. The tools that invade user privacy in completely invisible ways.
- cratermoon 4y agoOracle just spent $28B Cerner[1], one of the two largest providers of electronic patient medical records systems. I happen to know personally that at least one of the hospitals mentioned uses Cerner and has used it since the 90s. This sharing of sensitive medical information thing is just going to get worse, unless Congress and the FDA step up strongly. 1 https://techcrunch.com/2022/06/07/oracle-quietly-closes-28b-deal-to-buy-electronic-health-records-company-cerner/ https://techcrunch.com/2022/06/07/oracle-quietly-closes-28b-...
- kube-system 4y agoCongress already stepped up in 1996 and 2013. Sharing sensitive medical information like this is already illegal.
- cratermoon 4y agoI meant in terms of oversight and enforcement. We know that multiple administrations have sought to shrink, or even cripple, federal regulatory agencies. Just because there are laws on the books doesn't mean there's sufficient regulatory power or money to ensure they are followed. An after-the-fact prosecution isn't good enough. Any healthcare provider will tell you that prevention is far preferable to any treatment needed once the patient is sick.
- nemacol 4y agoLooking at the portal for my local hospital and I see a "Google Tag Manager". Right below that is a "Tracking Pixel" and the URL is "https://tags.w55c.net/rs?id=(somejunk)&t=marketing https://tags.w55c.net/rs?id=(somejunk)&t=marketing" When I search whoisdomain "w55c.net" I find it is owned by Roku, Inc. 150 Winchester Circle Los Gatos, CA. Am I doing this wrong or is the tracking pixel in my local hospital sending data to ... Roku... the company that make the little streaming box I have hooked up to my TV.
- soared 4y agoYou’re probably correct. Your hospital is probably running an advertising campaign through roku and wants to track how successful it is, and exclude serving ads to existing patients (customers). You can opt out here (ctrl f “ad personalization”): https://docs.roku.com/published/userprivacypolicy/en/US#:~:text=You%20can%20ask%20Roku%20to,settings%20provided%20on%20your%20device https://docs.roku.com/published/userprivacypolicy/en/US#:~:t.... Or global opt out (do this on all of your devices): https://optout.aboutads.info/?c=2&lang=EN https://optout.aboutads.info/?c=2&lang=EN
- nemacol 4y agoohh. That makes sense. Thank you for the reply.
- jklinger410 4y agoThis goes to show how little enforcement there is for privacy laws in the United States.
- honestduane 4y agoThis is illegal under fed law and HIPAA, right?
- starwind 4y ago> Former regulators, health data security experts, and privacy advocates who reviewed The Markup’s findings said the hospitals in question may have violated the federal Health Insurance Portability and Accountability Act (HIPAA). The law prohibits covered entities like hospitals from sharing personally identifiable health information with third parties like Facebook, except when an individual has expressly consented in advance or under certain contracts. > Neither the hospitals nor Meta said they had such contracts in place, and The Markup found no evidence that the hospitals or Meta were otherwise obtaining patients’ express consent.
- DesiLurker 4y agoillegal for hospitals to expose/sell this information. not illegal for FB to receive it. the moment hospitals/providers start selling it there will be some business out there trying to aggregate and data mine it. be it FB or google or amazon, the key thing is hospitals are break the law by exposing it even if they do it for some really silly instrumentation benefits.
- vba616 4y agoYou really think that HIPAA prohibits distributing any data at all, providing it has a fig leaf of being deidentified? I mean, aside from Facebook, how do you think people do medical research? Data sets are available to the public. Decades ago, somebody showed that deidentification was completely meaningless because with just a few data points almost everybody can be relinked. You are probably the only person in your zip code, with your gender, and your birthdate (including the year). Distributing that information with any medical record you ever had is not prevented by anything I know of. As long as your name and SSN is not with it.
- starwind 4y ago"Coming Next in the Pixel Hunt Series. This children's hospital network is giving kids' names to Facebook." That's as good a teaser as I've ever seen
- jrochkind1 4y agoThis is amusing: > “We do not have an adequate level of control and explainability over how our systems use data, and thus we can’t confidently make controlled policy changes or external commitments such as ‘we will not use X data for Y purpose.’ ” Facebook engineers on the ad and business product team wrote in a 2021 privacy overview that was leaked to Vice.
- jrochkind1 4y ago> The Meta Pixel “hashed” those personal details—obscuring them through a form of cryptography—before sending them to Facebook. But that hashing doesn’t prevent Facebook from using the data. In fact, Meta explicitly uses the hashed information to link pixel data to Facebook profiles. Anyone know what they are talking about? (and getting wrong in some way one way or another).
- ilrwbwrkhv 4y agoFacebook is a curse on society empowered by the normies storming the internet.
- donkey-hotei 4y agoIs "normies" a euphemism for "every day people"?... Jeez.