- One company was selling a ‘Consumers with Clinical Depression in the US’ list
- Another firm charged $0.20 per health record with a minimum spend of $2,000
- Users might not even know their data was being collected or sold, review said
The sensitive mental health data of millions of Americans is being sold online for pennies, a damning review has found.
The Duke University report found telemedicine companies and therapy apps are harvesting and selling on data including patient names, addresses, mental health diagnoses and prescriptions for as little as six cents.
Researchers behind the report described the data bundles as ‘a tasting menu for buying people’s health data’.
Increases in anxiety and depression off the back of the pandemic coupled with lockdowns and hospital restrictions caused people to turn to mobile health apps in droves.
But loopholes in data laws mean users may not even realize the apps have taken or are selling their sensitive mental health information on to other companies. This could be used for targeted advertising including offers on medicines.
Joanne Kim, a researcher at Duke’s University, Googled terms such as ‘mental health data for sale’ and ‘health information for sale’.
Kim also contacted 37 data brokers, asking them for ‘any health and/or mental health data you may have available for purchase or use’.
She then entered into negotiations with ten companies willing and able to sell requested data.
The brokers advertised highly-sensitive mental health data on Americans, including about patients with insomnia and ADHD, as well as data on age, gender, zip code, religion, children in the home, marital status, net worth, credit score, date of birth, and single parent status.
Prices for the data varied, and some of it was offered in an aggregate form which would tell a buyer how many people within a Zip code might have bipolar disorder, for example.
One data broker offered data on depressed and anxious individuals at Ms Kim’s budget price of $2,500 and gave no restrictions on how it could be used.
This broker offered up highly sensitive mental health data, including names and postal addresses of individuals with depression, bipolar disorder, anxiety issues, panic disorder, cancer, PTSD, OCD, and personality disorder, as well as individuals who have had strokes and data on those people’s races and ethnicities.
The company had lists called ‘Anxiety Sufferers’ and ‘Consumers with Clinical Depression in the United States’.
A separate firm charged $0.20 per health record and had a minimum spend of $2,000.
The more records bought, the cheaper the price — meaning for 435,780 records, the cost per record was just $0.06, the report said.
Another data broker charged more than $100,000 a year on a subscription basis for access to data that included information on individuals’ mental health conditions.
For 5,000 Americans’ mental health records in an aggregated form, one data broker charged $275.
One data broker said that the requested data on individuals’ mental health conditions was ‘extremely restricted’, but later said that as long as Ms Kim did not contact the individuals in the dataset, she could use the data freely.
All the sales representatives who used video platforms such as Zoom or Microsoft Teams did not reveal their faces to Ms Kim throughout.
Justin Sherman, a senior fellow at Duke who ran the research team, told the Washington Post it was like ‘a tasting menu for buying people’s health data’.
Most of the apps are not covered by the Health Insurance Portability and Accountability Act (HIPAA) as it only applies to certain covered health entities.
Because of this, many private companies operating mobile health apps are not legally required to keep their users’ data confidential and can sell and share it as they please.
The data brokers often did not say where their data had come from, meaning many people probably did not realize their data was being collected in the first place.
It was unclear whether the apps had allowed people another options, as many companies state in their privacy policy that they can share data with advertisers or third-parties.
The review called for the federal government to ban the sale of mental health data on the open market.