Prohibit Privacy-Invasive Uses or Disclosures
An HSNS must carefully weigh the risks and benefits of uses or disclosures of health data, giving special attention to legal constraints and ethical considerations. HSNS administrators might find it necessary to prohibit certain privacy-invasive uses or disclosures of health data regardless of user consent.7 We know that users are concerned about employers, insurers, or credit card companies having access to their medical records. Therefore, health data must not be exposed for purposes of discrimination in the context of employment, insurance, or credit. Moreover, if an HSNS doesn’t prevent inappropriate use or disclosure of personal information, the Federal Trade Commission (FTC) can bring action against the company for engaging in a “fraudulent, deceptive, and unfair business practices” (http://ftc.gov/opa/2011/11/ privacysettlement.shtm). More importantly, privacy protection makes good business sense because it increases users’ trust in the system and reduces costs for data breaches.
Greater exchange of information would result, benefitting both the site and users.