Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

The new cure-all for vacation excess: the IV drip 

What’s the best bus to New York? We tested 5 for comfort and value.

You asked: Do I need a passport for my cruise?

The New York Times, alone in its outrage over access to Biden

The ‘Access Hollywood’ video cemented Trump’s air of invincibility

Stephen A. Smith would like even more of your attention

Ask Amy: I live with my boyfriend – and his sister and her family

Carolyn Hax: Working for a celebrity has this employee feeling ‘small’

Carolyn Hax: Longtime friend won’t forgive being last-minute canceled for a guy

Top RNC lawyer resigns after rift grows with Trump

Trump escalates attacks on prosecutors, says Democrats run ‘a Gestapo administration’

Divided Trump campaign weighs joining TikTok, the app he tried to ban

In photos: The 150th running of the Kentucky Derby

Bodies found in Mexico where 3 tourists went missing

Protesters clash with law enforcement at U-Va.

Strangers help Sesame Street puppeteer after heirloom necklace was stolen

Teen grabs wheel when driver passes out and school bus veers into traffic

Cat climbed into Amazon return box, found alive 630 miles away

Twitch streamers become go-to news source for campus protest coverage

After years of delay, Boeing to try again with Starliner space capsule

There’s still time for Congress to Trump-proof the Insurrection Act 

The Post endorses April McClain Delaney and Tom Royals for Maryland’s 6th District

On Press Freedom Day, little to celebrate for Hong Kong’s journalists

A frank look at hot dog prices at MLB ballparks

Sloppy first inning dooms the Nationals in a 6-3 loss to the Blue Jays

In a pinch, the Nationals finally find some offense

How Pope Francis opened the Vatican to transgender sex workers

Israel shuts down Al Jazeera’s operations, raids Jerusalem office

Hamas attacks border crossing, killing 3, as Gaza cease-fire talks drag on

Let’s say you like a Facebook page devoted to breast cancer survivors. It has been a useful forum for comparing treatment options with others who have dealt with similar health issues. There’s only one problem: Facebook has now categorized you as a patient, and you constantly receive precisely targeted ads about cancer services available near you. They are showing up on your computer screen at work, for all your co-workers to see, right when you’re up for a big promotion.

Many users experience a version of this scenario when they receive creepily personalized ads while browsing on Facebook. When those ads follow users onto sites outside Facebook, it feels like an invasion of privacy. But how do you regulate data privacy in an age of big-data black boxes?

Mark Zuckerberg’s testimony about the Facebook-Cambridge Analytica scandal alerted users about <a href="https://www.nytimes.com/2018/04/11/technology/personaltech/i-downloaded-the-information-that-facebook-has-on-me-yikes.html?hp&amp;action=click&amp;pgtype=Homepage&amp;clickSource=story-heading&amp;module=first-column-region&amp;region=top-news&amp;WT.nav=top-news">what personal data</a> Facebook routinely collects and shares with third-party apps. But many questions were left unanswered. How many apps are collecting this data, and what are they doing with it? Are there more Cambridge Analyticas out there? It took a political scandal to get the attention of Congress this time. Where will it happen next, and how long will it be before the public finds out?

While Zuckerberg claimed even he is <a href="https://www.washingtonpost.com/news/the-switch/wp/2018/03/21/mark-zuckerberg-says-facebook-will-audit-thousands-of-apps-after-breach-of-trust/?utm_term=.2890ee509de0">not fully aware</a> of everything that happens in the Facebook digital economy, the evidence suggests health-care information may lead to the next major data-related crisis.

In early April, CNBC <a href="https://www.cnbc.com/2018/04/05/facebook-building-8-explored-data-sharing-agreement-with-hospitals.html">reported</a> that Facebook recently launched a project based in its secretive “Building 8” group to get hospitals to share anonymized patient data with them. The project was reportedly put on hold in the wake of the current scandal, but the stated plan was to match hospitals’ patient data on diagnoses and prescription information with Facebook so the company could combine that data with its own to construct digital profiles of patients.

Even setting aside the voluminous evidence showing that true <a href="https://techscience.org/a/2015092903/">anonymization of data</a> is virtually impossible, Facebook’s stated intent was never to leave the data anonymized. But requesting the hospitals’ data in that form would allow Facebook to sidestep the issue of obtaining patients’ consent, as required by federal law.

The company has reason to believe that, if asked, patients would not consent to this practice. In 2016, Facebook was <a href="https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?referer=https://www.google.com/&amp;httpsredir=1&amp;article=2175&amp;context=historical">sued</a> by a metastatic cancer patient who accused the company of violating his privacy by <a href="https://www.nytimes.com/2018/04/11/technology/facebook-privacy-hearings.html">collecting data</a> about his participation on cancer websites outside of Facebook. The case was dismissed and is under appeal, but this clearly has not stopped the company from pursuing data initiatives in health care.

[Facebook could easily make privacy the default. It still hasn’t.]

Indeed, Zuckerberg <a href="https://www.theguardian.com/technology/live/2018/apr/11/mark-zuckerberg-testimony-live-updates-house-congress-cambridge-analytica">admitted</a> in his congressional testimony last week that Facebook does collect some medical data from users. Considering the large number of <a href="http://www.mobihealthnews.com/content/study-facebook-support-group-increases-patient-engagement-satisfaction">patient support groups</a> on Facebook that use the site for <a href="https://susannahfox.com/2013/08/03/peer-to-peer-health-care-is-a-slow-idea-that-will-change-the-world/">peer-to-peer health care</a> and <a href="https://www.facebook.com/ADSGfellowship/">social support</a>, there is plenty of medically relevant data to be mined. Membership in some patient groups numbers in the tens of thousands, with average daily posts of several hundred or more. A sampling of the types of data users post includes “tests, treatments, surgeries, sex drive, and relationships” on a <a href="https://www.facebook.com/groups/bcsisterssupport/">breast cancer support site</a>. Other data include location, personal profile information such as age, race, sex, educational background, employment, even cellphone numbers. In addition, many posts include photos that can be subjected to <a href="https://www.npr.org/sections/thetwo-way/2017/12/19/571954455/facebook-expands-use-of-facial-recognition-to-id-users-in-photos">facial recognition software</a>.

It is not surprising that Facebook wants to move into the digital health market: So does Amazon.com, Google, Apple, Uber and all of the other big <a href="https://www.wired.com/story/embattled-tech-companies-charge-deeper-into-health-care/">tech companies</a>. These businesses see an opportunity to profit from user’s personal health data because, unlike narrowly defined medical data, health and wellness data is not considered <a href="https://www.hhs.gov/answers/hipaa/what-is-phi/index.html">protected health information</a> and therefore is not protected by privacy laws.

In contrast to the personal data users might post on Facebook, patient records at hospitals and other <a href="https://www.hhs.gov/hipaa/for-professionals/faq/covered-entities/index.html">covered entities</a> are protected by privacy laws such as the Health Insurance Portability and Accountability Act (<a href="https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html">HIPAA</a>). Yet, for years, patient data has been sold to <a href="https://www.theguardian.com/technology/2017/jan/10/medical-data-multibillion-dollar-business-report-warns">medical data miners</a> and brokers in a multibillion-dollar global trade. The <a href="https://www.scientificamerican.com/article/how-data-brokers-make-money-off-your-medical-records/">pharmaceutical industry</a> is a major player in this marketplace, spending <a href="http://www.nejm.org/doi/full/10.1056/NEJMp1004986">billions of dollars</a> annually on <a href="https://www.healthaffairs.org/doi/pdf/10.1377/hlthaff.19.2.110">direct-to-consumer advertising</a> aimed at influencing physicians’ prescribing practices and patients’ requests for brand-name drugs. But social media companies such as Facebook struggled to attract this lucrative advertising market.

In June 2017, Facebook addressed this challenge by convening drug marketers at the inaugural <a href="https://www.cnbc.com/2017/05/26/facebook-health-summit-june-6-will-focus-on-pharma-cannes-to-follow.html">Facebook Health Summit</a>, an event where the company wooed the pharmaceutical industry with new features designed to address their specific needs. Danielle Salowski, Facebook’s industry manager for health, said the company re-engineered its advertising features so pharmaceutical advertisers could <a href="https://www.fiercepharma.com/marketing/like-pharma-and-otc-brands-attend-facebook-s-first-health-summit">turn off comments</a> on their Facebook brand pages and on their ads. Changing this feature would help pharma companies avoid the negative publicity associated with the legal requirement of reporting adverse reactions to drugs.

This activity could simply be understood as advertising in the age of big data, a practice our society has so far agreed to accept. But the unique risks from health- and medical-data mining and digital profiling of patients suggests greater stakes worthy of regulatory attention. Congress accused Facebook of <a href="https://www.cnbc.com/2017/11/14/facebook-full-of-illegal-opioids.html">illegal marketing</a> of opioids and noted that many other types of <a href="http://www.chicagotribune.com/news/local/breaking/ct-met-facebook-secret-group-gun-arrest-20180103-story.html">drugs</a> are also sold on the platform. Patients with life-threatening conditions or limited means to pay for health care are at greater risk of harm from targeted advertising of products or services by unscrupulous vendors.

In addition, the lack of transparency, increasing interconnection of health and technology, and growing reliance on <a href="https://www.healthcatalyst.com/product/patient-stratification/">risk modeling</a> in health care means that combining health- and medical-data sources to target patients could harm anyone who has a serious illness or the risk of developing one. The insurance industry uses <a href="http://www.milliman.com/insight/2016/Insurance-fraud-and-social-media/">social media intelligence</a> and profiling to inform algorithms that automate pricing, claims handling and fraud detection. When health risks are understood as financial risks, contextual information from users’ digital profiles can be used against them to raise premiums or <a href="https://www.theverge.com/2018/3/21/17144260/healthcare-medicaid-algorithm-arkansas-cerebral-palsy">deny claims</a>. That means everyone is at risk.

Members of Congress were <a href="https://www.fastcompany.com/40557799/zuckerberg-just-proved-once-again-that-congress-doesnt-understand-the-internet">criticized</a> for displaying through misguided questions their lack of understanding about how Facebook works. But in the current data economy, Facebook and other big tech companies operate as <a href="https://www.propublica.org/article/breaking-the-black-box-what-facebook-knows-about-you">black boxes</a> that are impossible for outside users to fully understand. We really don’t know most of the time what is being done with the data we post online, except when <a href="https://www.nytimes.com/2018/03/27/nyregion/facebook-housing-ads-discrimination-lawsuit.html">housing discrimination</a>, <a href="https://www.bloomberg.com/news/features/2018-03-27/ad-scammers-need-suckers-and-facebook-helps-find-them">exploitative advertising practices</a> or <a href="https://www.washingtonpost.com/politics/former-cambridge-analytica-workers-say-firm-sent-foreigners-to-advise-us-campaigns/2018/03/25/6a0d7d90-2fa2-11e8-911f-ca7f68bff0fc_story.html?utm_term=.9fa7abcdba81">foreign interference in elections</a> is exposed. The Cambridge Analytica scandal revealed at least <a href="https://www.nytimes.com/2018/04/04/technology/mark-zuckerberg-testify-congress.html">87 million</a> of us are at risk of being exploited or discriminated against.

And really, why should we trust Facebook and third-party app developers to respect users’ privacy when their business model depends on doing the opposite? Facebook clearly recognizes the enhanced value of its user data when combined with medical data. That should tell lawmakers the definition of “protected health information” needs an update. If we can still think of big data as something that could be harnessed for social benefit, we need to create regulations that allow users to consent to participate, like they do in clinical trials. We don’t need to lock down all the data; we just need to distribute the power to access and share it so patients and future patients receive benefits, rather than harms, from sharing their experiences online.

CORRECTION: A previous version of this story suggested that language from Facebook status updates and comments helped advertisers target users. Facebook says only other behavior on the site, such as liking a page or clicking an ad, informs ad targeting. The piece also asserted that Facebook had made a change to help pharmaceutical companies avoid negative publicity – a claim the company denies. It also misidentified the source of a story about Facebook’s planned hospital data sharing project as MSNBC rather than CNBC.

Kirsten Ostherr is a media scholar and digital health technology researcher at Rice University.

Kirsten Ostherr

The Washington Post

name

prism://prism.query/site,/opinions/posteverything?limit=20

PostEverything

The conversation is bigger than you think.

Opinions to start the day, in your inbox. Sign up.

Opinions

The Washington Post Opinions section features opinion articles, op-eds, editorials by the Editorial Board, global opinions and letters to the editor on the issues of the day. Offerings include columns by Washington Post opinion writers, political cartoons by editorial cartoonists Ann Telnaes and Michael de Adder and podcasts by James Hohmann and Jonathan Capehart.