PRIVACY CONCERNS
Whether the issue is about an online consultation or an online drug purchase, one basic question remains as a serious concern: What about privacy? Few would argue that the Internet age has led to increased concerns about privacy, particularly as it relates to the collection, use, and dissemination of individually identifiable health information. The results of a recent Gallup poll are extremely revealing. While 77 percent of respondents rated the privacy of their health information as very important, 84 percent expressed concerns that their health information would be sold or shared without their consent (Liebman 2002)
. Such concerns are not without merit. The nature of web tracking, e-commerce and electronic data interchange (EDI) is such that digital information can be vulnerable to unauthorized access and misuse. At the very basic level, it should be recognized that different individuals involved in the EDI process (physicians, nurses, labs, pharmacies, benefits managers, employers, insurance or claims adjusters, etc.) do not need equal access to the wealth of personal information and data contained in patient and insurance records. Failure to adequately protect an individual’s personal health information could result in embarrassment or societal rejection, influence an individual’s prospects for promotion, may even cause termination(Rothstein2001). The security of data from hackers is also an ongoing concern (Simpson 2001) as is the unintended disclosure of personal medical information; both Kaiser Permanente and Lilly Prozac.com have recently been cited by the media for accidentally releasing private medical information via email (Holohan 2000; Liebman 2002)
. Yet the potential for abuse goes far beyond the accidental or obvious. For example, many employers use surveillance technologies such as tracking software to monitor Internet usage and site visitation by employees while on the job. Rothstein (2001) suggests that such practices could potentially allow employers or insurance providers (via information provided by employers) to alter insurance risk assessments or even
cancel coverage should visitations to certain types of health-related websites occur (e.g., support sites for alcoholics, cancer, or AIDS)
. The use of web bugs and cookies, common practices for most web marketers, has also come under scrutiny. Pharmatrak, a company that monitors drug and disease-based website usage for its various pharmaceutical company clients,claimed that its data collection system was designed to gather only non-personal information in a manner which could not directly identify individual users. Citing the Electronic Communications Privacy Act (ECPA), suit was brought against Pharmatrak and several of its pharmaceutical clients alleging that Pharmatrak had intercepted personally identifiable information by means of web bugs and cookies without the consent of the individuals in question (Pierce 2003). While the District Court of Massachusetts initially found in favor of Pharmatrak (Memorandum of the United States District Court, District of Massachusetts 2002), in May of 2003 the court of appeals re- versed the decision, stating that the District court had misinterpreted “consent” and that interception had occurred under the auspices of the ECPA. In conjunction with this ruling, the case has been returned to the district court for additional consideration (Pierce 2003). Even more disturbing are reports that governmental web sites failed to follow their own privacy policies, and collected social security numbers in violation of federal law (Cogar 2002)