The “Invisible Web” Undermines Health Information Privacy

“The goal of privacy is not to protect some stable self from erosion but to create boundaries where this self can emerge, mutate, and stabilize. What matters here is the framework— or the procedure— rather than the outcome or the substance. Limits and constraints, in other words, can be productive— even if the entire conceit of “the Internet” suggests otherwise.

         Evgeny Morozov in “To Save Everything, Click Here: The Folly of Technological Solutionism

 

We cherish privacy in health matters because our health has such a profound impact on how we interact with other humans. If you are diagnosed with an illness, it should be your right to decide when and with whom you share this piece of information. Perhaps you want to hold off on telling your loved ones because you are worried about how it might affect them. Maybe you do not want your employer to know about your diagnosis because it could get you fired. And if your bank finds out, they could deny you a mortgage loan. These and many other reasons have resulted in laws and regulations that protect our personal health information. Family members, employers and insurances have no access to your health data unless you specifically authorize it. Even healthcare providers from two different medical institutions cannot share your medical information unless they can document your consent.

Health Information Privacy via Shutterstock
Health Information Privacy via Shutterstock

The recent study “Privacy Implications of Health Information Seeking on the Web” conducted by Tim Libert at the Annenberg School for Communication (University of Pennsylvania) shows that we have a for more nonchalant attitude regarding health privacy when it comes to personal health information on the internet. Libert analyzed 80,142 health-related webpages that users might come across while performing online searches for common diseases. For example, if a user uses Google to search for information on HIV, the Center for Disease Control and Prevention (CDC) webpage on HIV/AIDS (http://www.cdc.gov/hiv/) is one of the top hits and users will likely click on it. The information provided by the CDC will likely provide solid advice based on scientific results but Libert was more interested in investigating whether visits to the CDC website were being tracked. He found that by visiting the CDC website, information of the visit is relayed to third-party corporate entities such as Google, Facebook and Twitter. The webpage contains “Share” or “Like” buttons which is why the URL of the visited webpage (which contains the word “HIV”) is passed on to them – even if the user does not explicitly click on the buttons.

Libert found that 91% of health-related pages relay the URL to third parties, often unbeknownst to the user, and in 70% of the cases, the URL contains sensitive information such as “HIV” or “cancer” which is sufficient to tip off these third parties that you have been searching for information related to a specific disease. Most users probably do not know that they are being tracked which is why Libert refers to this form of tracking as the “Invisible Web” which can only be unveiled when analyzing the hidden http requests between the servers. Here are some of the most common (invisible) partners which participate in the third-party exchanges:

Entity                                      Percent of health-related pages

Google                                                78

Facebook                                            31

Twitter                                               18

Amazon                                              16

Experian                                             5

What do the third parties do with your data? We do not really know because the laws and regulations are rather fuzzy here. We do know that Google, Facebook and Twitter primarily make money by advertising so they could potentially use your info and customize the ads you see. Just because you visited a page on breast cancer does not mean that the “Invisible Web” knows your name and address but they do know that you have some interest in breast cancer. It would make financial sense to send breast cancer related ads your way: books about breast cancer, new herbal miracle cures for cancer or even ads by pharmaceutical companies. It would be illegal for your physician to pass on your diagnosis or inquiry about breast cancer to an advertiser without your consent but when it comes to the “Invisible Web” there is a continuous chatter going on in the background about your health interests without your knowledge.

Some users won’t mind receiving targeted ads. “If I am interested in web pages related to breast cancer, I could benefit from a few book suggestions by Amazon,” you might say. But we do not know what else the information is being used for. The appearance of the data broker Experian on the third-party request list should serve as a red flag. Experian‘s main source of revenue is not advertising but amassing personal data for reports such as credit reports which are then sold to clients. If Experian knows that you are checking out breast cancer pages then you should not be surprised if this information will be stored in some personal data file about you.

How do we contain this sharing of personal health information? One obvious approach is to demand accountability from the third parties regarding the fate of your browsing history. We need laws that regulate how information can be used, whether it can be passed on to advertisers or data brokers and how long the information is stored.

 

Here is the Privacy Policy Summary for WebMD, a commonly visited health information portal:

   We may use information we collect about you to:

 ·         Administer your account;

·         Provide you with access to particular tools and services;

·         Respond to your inquiries and send you administrative communications;

·         Obtain your feedback on our sites and our offerings;

·         Statistically analyze user behavior and activity;

·         Provide you and people with similar demographic characteristics and interests with more relevant content and advertisements;

·         Conduct research and measurement activities;

·         Send you personalized emails or secure electronic messages pertaining to your health interests, including news, announcements, reminders and opportunities from WebMD; or

·         Send you relevant offers and informational materials on behalf of our sponsors pertaining to your health interests.

 

Users are provided with instructions for how they can opt out of the tracking and receiving information from the (undisclosed) sponsors but it is unlikely that the majority of users read the privacy policy pages of the various health-related websites. It is even less likely that users will go through the cumbersome process of requesting that all their information be kept private and not passed on to corporate sponsors.

Perhaps one of the most effective solutions would be to make the “Invisible Web” more visible. If health-related pages were mandated to disclose all third-party requests in real-time such as pop-ups (“Information about your visit to this page is now being sent to Amazon“) and ask for consent in each case, users would be far more aware of the threat to personal privacy posed by health-related pages. Such awareness of health privacy and potential threats to privacy are routinely addressed in the real world and there is no reason why this awareness should not be extended to online information.

 

 

 

Note: An earlier version of this article was first published on the 3Quarksdaily Blog.

Reference:

Libert, Tim. “Privacy implications of health information seeking on the Web” Communications of the ACM, Vol. 58 No. 3, Pages 68-77, March 2015, doi: 10.1145/2658983 (PDF)

 

ResearchBlogging.org

Libert, T. (2015). Privacy implications of health information seeking on the web Communications of the ACM, 58 (3), 68-77 DOI: 10.1145/2658983

Advertisements

New Study Shows Surgical Checklists In Operating Rooms Are Less Effective Than Assumed

The patient has verified his or her identity, the surgical site, the type of procedure, and his or her consent. Check.

The surgical site is marked on a patient if such marking is appropriate for the procedure. Check.

The probe measuring blood oxygen content has been placed on the patient and is functioning. Check.

All members of the surgical and anesthesia team are aware of whether the patient has a known allergy? Check.

Surgeon
Surgeon – via Shutterstock

These were the first items on a nineteen-point World Health Organization (WHO) surgical safety checklist from an international research study to evaluate the impact of routinely using checklists in operating rooms. The research involved over 7,500 patients undergoing surgery in eight hospitals (Toronto, Canada; New Delhi, India; Amman, Jordan; Auckland, New Zealand; Manila, Philippines; Ifakara, Tanzania; London, England; and Seattle, WA) and was published in the New England Journal of Medicine in 2009.

Some of the items on the checklist were already part of standard care at many of the enrolled hospitals, such as the use of oxygen monitoring probes. Other items, such as ensuring that there was a contingency plan for major blood loss prior to each surgical procedure, were not part of routine surgical practice. The impact of checklist implementation was quite impressive, showing that this simple safety measure nearly halved the rate of death in surgical patients from 1.6% to 0.8%.  The infection rate at the site of the surgical procedure also decreased from 6.2% in the months preceding the checklist introduction to a mere 3.4%.

Checklists as a Panacea?

The remarkable results of the 2009 study were met with widespread enthusiasm. This low-cost measure could be easily implemented in hospitals all over the world and could potentially lead to major improvements in patient outcomes. It also made intuitive sense that encouraging communication between surgical team members via checklists would reduce complications after surgery.

A few weeks after the study’s publication, the National Patient Safety Agency (NPSA) in the United Kingdom issued a patient safety alert, requiring National Health Service (NHS) organizations to use the WHO Surgical Safety Checklist for all patients undergoing surgical procedures. In 2010, Canada followed suit and also introduced regulations requiring the use of surgical safety checklists. However, the data for the efficacy of such lists had only been obtained in observational research studies conducted in selected hospitals. Would widespread mandatory implementation of such a system in “real world” community hospitals also lead to similar benefits?

A recently published study in the New England Journal of Medicine lead by Dr. David Urbach at the University of Toronto has now reviewed the surgery outcomes of hospitals in Ontario, Canada, comparing the rate of surgical complications during three-month periods before and after the implementation of the now mandatory checklists.  Nearly all the hospitals reported that they were adhering to the checklist requirements and the vast majority used either a checklist developed by the Canadian Patient Safety Institute, which is even more comprehensive than the WHO checklist or other similar checklists. After analyzing the results of more than 200,000 procedures at 101 hospitals, Urbach and colleagues found no significant change in the rate of death after surgery after the introduction of the checklists (0.71% versus 0.65% – not statistically significant). Even the overall complication rates or the infection rates in the Ontario hospitals did not change significantly after surgical teams were required to complete the checklists.

 

Check the Checklist

 

The discrepancy in the results between the two studies is striking. How can one study demonstrate such a profound benefit of introducing checklists while a second study shows no significant impact at all? The differences between the two studies may hold some important clues. The 2009 study had a pre-checklist death rate of 1.6%, which is more than double the pre-checklist death rate in the more recent Ontario study. This may reflect the nature and complexity of the surgeries surveyed in the first study and also the socioeconomic differences. A substantial proportion of the patients in the international study were enrolled in low-income or middle-income countries. The introduction of a checklist may have been of much greater benefit to patients and hospitals that were already struggling with higher complication rates.

Furthermore, as the accompanying editorial by Dr. Lucian Leape in the New England Journal of Medicine points out, assessment of checklist implementation in the recent study by Urbach and colleagues was based on a retrospective analysis of self-reports by surgical teams and hospitals. Items may have been marked as “checked” in an effort to rush through the list and start the surgical procedures without the necessary diligence and time required to carefully go through every single item on the checklist. In the 2009 WHO study, on the other hand, surgical teams were aware of the fact that they were actively participating in a research study and the participating surgeons may have therefore been more motivated to meticulously implement all the steps on a checklist.

One of the key benefits of checklists is that they introduce a systematic and standardized approach to patient care and improve communication between team members. It is possible that the awareness of surgical teams in the Ontario hospitals in regards to patient safety and the need for systematic communication was already raised to higher level even before the introduction of the mandatory checklists so that this mandate may have had less of an impact.

 

Looking Forward

The study by Urbach and colleagues does not prove that safety checklists are without benefit. It highlights that there is little scientific data supporting the use of mandatory checklists. Since the study could not obtain any data on how well the checklists were implemented in each hospital, it is possible that checklists are more effective when team members buy into their value and do not just view it as another piece of mandatory and bureaucratic paperwork.

Instead of mandating checklists, authorities should consider the benefits of allowing surgical teams to develop their own measures that improve patient safety and team communication. The safety measures will likely contain some form of physical or verbal checklists. By encouraging surgical teams to get involved in the development process and tailor the checklists according to the needs of individual patients, surgical teams and hospitals, they may be far more motivated to truly implement them.

Optimizing such tailored checklists, understanding why some studies indicate benefits of checklists whereas others do not and re-evaluating the efficacy of checklists in the non-academic setting will all require a substantial amount of future research before one can draw definitive conclusions about the efficacy of checklists. Regulatory agencies in Canada and the United Kingdom should reconsider their current mandates. Perhaps an even more important lesson to be learned is that health regulatory agencies should not rush to enforce new mandates based on limited scientific data.

 

ResearchBlogging.org

Urbach DR, Govindarajan A, Saskin R, Wilton AS, & Baxter NN (2014). Introduction of surgical safety checklists in Ontario, Canada. The New England Journal of Medicine, 370 (11), 1029-38 PMID: 24620866