What are the biggest threats to health data privacy?

The biggest threats to health data privacy include: (1) Data brokers - companies like IQVIA capture 93% of prescription fills and sell de-identified data that can be re-linked to individuals. The health data broker market is worth $7.3B and growing 8.5% annually. (2) Healthcare data breaches - 734 breaches exposed 276M+ records in 2024, nearly 2 breaches per day. (3) Health app data sharing - popular apps like Flo, BetterHelp, and GoodRx share intimate health details with Facebook, Google, and advertisers without proper consent. (4) Health Information Exchanges - HIEs automatically share your medical records between providers, often without explicit opt-in consent. (5) Medical identity theft - stolen health data sells for $100-$250 per record on criminal markets, 10x more than credit cards.

How do health data brokers get my medical information?

Health data brokers obtain medical information through several channels: (1) Pharmacy data - IQVIA captures prescription information from 93% of pharmacies daily through electronic systems. (2) Insurance claims - companies purchase de-identified claims data from insurers and clearinghouses. (3) Public records - they scrape court records, property records, and licensing databases for health-related information. (4) Web tracking - pixels and cookies on health websites track searches and page visits. (5) Health apps - many free apps sell or share user data with brokers. (6) Purchase from other brokers - companies like LexisNexis aggregate data from hundreds of sources and create comprehensive health profiles. While the data is technically 'de-identified,' research shows 87% of Americans can be uniquely identified with just zip code, gender, and birthdate.

Are health apps sharing my data without consent?

Yes, many popular health apps share user data with advertisers and third parties, often without proper informed consent. High-profile cases include: (1) Flo (period tracking app) - shared menstrual cycle, fertility, and pregnancy data with Facebook for ad targeting. FTC settled for $100K and mandated explicit consent. (2) BetterHelp (therapy app) - uploaded therapy intake questionnaire responses to Facebook, Google, Snapchat, and Criteo for advertising. FTC fined them $7.8M. (3) GoodRx (prescription discount app) - shared prescription medication lists and health conditions with Facebook and Google. (4) Mental health apps - 2022 study found 19 of 37 popular mental health apps shared data with advertisers without disclosure. The FTC Health Breach Notification Rule (strengthened in 2024) now requires apps handling health data to report breaches and implement stricter consent practices.

What is medical identity theft and how common is it?

Medical identity theft occurs when someone uses your personal information (name, SSN, insurance ID) to obtain medical services, prescriptions, or file fraudulent insurance claims. It's a growing problem: medical records sell for $100-$250 each on criminal markets (10x more than credit cards) because they contain complete identity profiles plus insurance details. Medical identity theft can result in: (1) Fraudulent charges on your insurance, (2) Incorrect medical information entered into your records (wrong blood type, allergies, diagnoses) that could cause life-threatening treatment errors, (3) Denial of insurance coverage due to fraudulent claims, (4) Debt collection for services you never received, (5) Impact on your ability to get insurance. Warning signs include: unexpected EOB statements, calls from debt collectors about medical bills you don't recognize, or being billed for medical services you didn't receive. Unlike credit card fraud, medical identity theft can take years to detect and resolve because it affects your permanent medical records.

How can I protect my health data from these threats?

To protect your health data from brokers, breaches, and unauthorized sharing: (1) Opt out of Health Information Exchanges (HIEs) - contact every state HIE where you've received care and submit opt-out forms. There are 40+ major HIEs across all 50 states. (2) Opt out of Surescripts - submit their opt-out form to stop prescription data sharing with IQVIA and other brokers. (3) Restrict HIPAA authorizations - review and revoke unnecessary authorizations with all your healthcare providers. (4) Limit health app usage - avoid free health apps that monetize through data sales. If you use them, review privacy policies and disable ad tracking. (5) Request accounting of disclosures - annually request from all providers to see who accessed your records. (6) Monitor for breaches - check the HHS OCR Breach Portal at https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf to see if your providers experienced breaches. (7) Use credit monitoring - after breaches, enroll in credit monitoring to detect medical identity theft. (8) Consider automated privacy services - platforms like HealthConsent® automate opt-outs, monitor compliance, and handle the complex process across all 50 states.

Critical Privacy Alert

The Hidden Reality of Health Data Privacy

Your most sensitive health information is being collected, sold, and exploited by a vast industry you never knew existed. Understanding these threats is the first step to protection.

Get Protection Now Learn the Facts

Healthcare Breaches: By the Numbers

Healthcare data breaches have exploded in frequency and scale. Here's what's happening right now.

734

Healthcare breaches in 2024

Nearly 2 breaches per day

276M

Patient records exposed in 2024

A new all-time record

87%

Of Americans can be identified

With just zip + gender + birth date

$100-$250

Price per medical record

On criminal markets - 10x more than credit cards

Critical Reality: Unlike credit card theft (quickly resolved), medical identity theft often goes undetected for years, making your health data a criminal's long-term goldmine. Learn how to exercise your privacy rights to protect yourself.

The $7.3 Billion Health Data Broker Industry

A vast industry profits from selling your health information, often without your knowledge or consent.

$7.3B

Health data broker market size

Growing 8.5% annually to $13.8B by 2031

93%

Of prescriptions captured by IQVIA

Nearly all pharmacy data monetized daily

$250

Price per medical record

Full patient profiles on criminal markets

40+

Major health data brokers

Hundreds more operate unregistered

How They Collect Your Data

Partnership with pharmacies & PBMs (93% of prescriptions captured)
EHR vendor data feeds from Epic, Cerner, Allscripts
Claims clearinghouses and insurance data
Consumer health apps and wearable devices

Who Buys Your Data

Pharmaceutical companies for drug targeting
Insurance companies for risk assessment
Marketing & advertising technology platforms
Employers for wellness program analytics

6 Ways Your Health Data Is at Risk

Understanding the specific threats to your health information is crucial for making informed decisions about your privacy. Learn about your HIPAA rights to protect against these threats.

"Your mental health, reproductive health, and medical conditions become advertising profiles"

Popular health apps like Flo and BetterHelp were caught sharing intimate health details with Facebook, Google, and other advertising platforms without user consent.

Documented Cases

Flo shared menstrual and fertility data with Facebook

BetterHelp shared therapy intake responses for ad targeting

GoodRx uploaded prescription lists to advertising platforms

"Your prescriptions, diagnoses, and medical history are sold for profit"

Companies like IQVIA automatically capture 93% of prescription fills and sell de-identified data that can be re-linked to you.

Documented Cases

IQVIA captures prescription data from 93% of pharmacies daily

LexisNexis combines health data with social and credit information

Komodo Health sells patient journey maps to pharmaceutical companies

"Your medical records flow to organizations you never authorized"

Your doctors and hospitals share data with hundreds of business associates, analytics companies, and health information exchanges without explicit consent.

Documented Cases

Epic Care Everywhere shares records across 300+ health systems

Business associates receive patient data for 'operations'

Quality improvement programs use your data without opt-in

"Your medical conditions become the basis for invasive marketing"

Health data is used to create condition-specific advertising lists, targeting you with ads based on your medical diagnoses and treatments.

Documented Cases

Lists of 'diabetes sufferers' sold to pharmaceutical marketers

Mental health data used for 'lookalike' audience targeting

Fertility data exploited for pregnancy-related advertising

"You can't track or control how your health information spreads"

You have no visibility into which brokers have your data, who they've sold it to, or how it's being used.

Documented Cases

Many entities involved in health data commerce are not required to register in state data broker registries

No requirement to notify patients of data sales

Complex tokenization and record-linkage systems can obscure data flows

"There's no such thing as truly anonymous health data at scale"

Even 'de-identified' health data can be re-linked to you with just ZIP code, gender, and birth date - uniquely identifying 87% of Americans.

Documented Cases

ZIP + gender + birth date identifies 87% of people uniquely

Brokers combine 'anonymous' health data with consumer profiles

Academic studies repeatedly show re-identification is possible

What Happens When Your Data Is Breached

Healthcare breaches can have devastating personal consequences that last for years.

Identity Theft & Financial Fraud

Can go undetected for months or years

Stolen SSNs, DOBs, and insurance info enable criminals to open credit lines, file fraudulent tax returns, and obtain expensive medical services in your name.

Medical Identity Theft

Often discovered only when reviewing EOB statements

Criminals use your insurance to obtain care, prescriptions, or medical equipment, potentially contaminating your medical records with false information.

Blackmail & Extortion

Immediate threat after data exposure

Sensitive health information like mental health diagnoses, substance abuse treatment, or reproductive health can be used to threaten or embarrass victims.

Targeted Scams & Phishing

Begins within weeks of a breach

Criminals use actual medical appointment details to pose as hospitals or insurers, making scam calls more convincing and dangerous.

The Scale of the Problem

93% of healthcare organizations experienced at least one breach in the past 3 years, with 57% suffering more than 5 breaches.

Unlike credit card theft (which can be resolved quickly), medical identity theft often goes undetected for months or years, making recovery far more difficult.

Medical records sell for $100-$250 each on criminal markets—10-40 times more valuable than credit card data.

Criminal gangs specifically target healthcare because the data enables long-term fraud and organizations often pay ransoms quickly to restore patient care.

Ready to Take Control of Your Health Data?

Now that you understand the threats, learn how HealthConsent provides comprehensive protection across all these risk areas.

Stop Data Brokers

Opt out of 40+ known health data brokers

Control Provider Sharing

HIPAA restrictions and HIE opt-outs

Monitor Compliance

Track your privacy status and renewals

Get Complete Protection Learn Your Rights