Banned Tracking Technology Use Among Medical Device, Pharmacy, and Hospital Webforms: A Cross-Sectional Study (Preprint)

BACKGROUND Tracking technologies are frequently employed to gather and examine data regarding user interactions with websites or mobile applications of regulated health-related entities. These technologies then illegally share user data with third parties that use it to target ads to patients across social media platforms. This collection and sharing constitutes a data leak of massive proportions. Specifically, some pharmacies, medical device companies, and hospitals utilize banned tracking or surveillance technologies on their websites in a way that exposes patients’ prescriptions, medical device information, doctor appointments and contact details to third parties. OBJECTIVE This study aimed to assess the use of prohibited tracking technologies on unauthenticated URL’s within three types of entities: pharmacies, medical companies, and health systems. METHODS We identified the largest-by-revenue medical device companies, pharmacies, and hospitals in the United States, using a scanning tool we developed based on existing open source software to detect the presence or absence of five banned tracking technologies on a sample of them. RESULTS In total, we included 341 URLs associated with three different types of HIPAA covered entities in our scan sample. Medical device company (n= 147) webpages comprised 43.1% of our overall sample. Pharmacy webpages (n=96) comprised 28.2% of our sample, and hospitals/health system URLs (n=98) comprised 28.7% of our sample. 63.9% of the medical device company URLs scanned contained at least one banned surveillance technology. 59.2% of pharmacy URLs scanned had at least one banned surveillance technology installed. 59.8% out of hospital URLs scanned contained at least one banned surveillance tracker. The most common tracker found on medical device company sample was Google Audience (39.5%), followed closely by Facebook Pixel (36.1%) There were a number of device companies, pharmacies, and hospitals scanned that had none of the banned trackers. n=53 URLs or 36.1% did not have any banned trackers identified. 40.8% (44) of pharmacies did not have any trackers. 67.0% of hospital URLs scanned did not have any trackers identified. CONCLUSIONS This study demonstrates the presence of health trackers on many health-related sites despite the laws that prohibit them, and further examines the ways PHI may be shared with social media platforms or third parties via unauthenticated landing pages. Future studies are needed to assess the impact of leaking sensitive data belonging to millions of patients to third party vendors. CLINICALTRIAL n/a