Telehealth and therapy applications grew tremendously during the pandemic when people were unable to leave their homes, but companies are now reportedly selling the information they collected regarding people’s mental health.
Duke University’s Sanford School of Public Policy recently performed a study that evaluated the extent to which these sales are performed.
Researcher Joanne Kim reported that 26 of the 37 data brokers she contacted responded to her inquiries regarding mental health data. Overall, 11 of these brokers were apparently willing to sell the highly sensitive information of patients.
The information these brokers were willing to sell included information such as diagnoses or symptoms of “depression, attention disorder, insomnia, anxiety, ADHD, and bipolar disorder.”
In addition to information regarding mental health, they also sold general patient information, such as “ethnicity, age, gender, zip code, religion, children in the home, marital status, net worth, credit score, date of birth, and single parent status.”
One broker allegedly confirmed that the information was “extremely restricted,” according to the study, and they would have to know how the purchasing company would use the information. Despite it being “extremely restricted” information, they still allegedly provided a sample spreadsheet of deidentified data counts.
Speaking to The Washington Post, Justin Sherman, a senior fellow at Duke who ran the research team, described the sample sheets as “a tasting menu for buying people’s health data.”
“Health data is some of the most sensitive data out there, and most of us have no idea how much of it is out there for sale, often for just a couple hundred dollars,” continued Sherman, as reported by The Washington Post.
The pricing of the data requested varied by broker. One broker apparently charged $275 for 5,000 aggregated counts of mental health records. On the other hand, some brokers reportedly charged upwards of $75,000 to $100,000 for annual access to patients’ mental health information.
Sherman told The Washington Post that mental health information is especially risky to sell, as the misuse of this information puts people at risk.
Pam Dixon, founder and executive director of the World Privacy Forum, a research and advocacy group, agreed and added that it is near impossible to determine whether your information is truly safe in the hands of a company.
“There is mass consumer confusion about when our health records are protected by health privacy law or not,” Dixon said, per NBC News. “It’d be almost impossible for the average person who’s not a privacy attorney to know if a website’s protected by HIPAA or not.”
Dixon said that anything, not just mental health information, could be sold by a company, and there is no real way to prevent it.
“There’s no possible way at this point in time that a human being, if they wanted to, could opt out of all the data broker activity in the world,” she said, as reported by NBC News.
