EFF investigator have severally corroborate that healthcare.gov is send personal wellness data to at least 14 third party domains , even if the substance abuser has enabledDo Not Track . The data is sent via the referrer header , which contains the URL of the page quest a third party resource . The referrer coping is an all important part of the HTTP communications protocol , and is charge for every request that is made on the World Wide Web . The referrer head lets the request resource roll in the hay what URL the petition come from . This would for example let a web site know who else was relate to their pages . In this case however the referrer URL contains personal wellness info .
In some cases the information is also broadcast embedded in the request drawstring itself , like so :
https://4037109.fls.doubleclick.net/activityi;src=…type=20142003;cat=201420;ord=7917385912018;~oref=https://www.healthcare.gov/seeplans/85601/results/county=04019&age=40&smoker=1&parent=&pregnant=1&mec=&zip=85601&state=AZ&income=35000&&step=4 ?
In the above example , a uniform resource locator at doubleclick.net is requested by your browser app . Appended to the final stage of this URL is your eld , smoking status , preganacy status , parental condition , zip code , state and one-year income . This URL is requested by your web browser after you fill out the required information on healthcare.gov and cluck the push button to view health insurance policy plans that you are eligible for .
The chase is a tabular array showing which third party domains EFF researchers confirm were receiving the secret health data .
It ’s especially worrying that the U.S. government is post personal information to commercial-grade companies on a internet site that ’s touted as the place for people to obtain health charge reporting . Even more worrying is the voltage for society like Doubleclick , Google , Twitter , Yahoo , and others to link this data with a somebody ’s literal individuality . Google , thanks to material name insurance , for sure has selective information unambiguously identifying someone using Google divine service . If a substantial identity operator is link up to the information have from healthcare.gov it would be a monumental infringement of privacy for users of the land site .
Third - company imagination could also introduce additional security risk to the healthcare.gov website , with each let in third - company resourcefulness increasing the attack surface of the site . If an attacker were able to compromise just one of the third company imagination let in on healthcare.gov they could potentially compromise the accounting of every substance abuser of healthcare.gov . The attacker could then sell the Private Health Information orhold it for ransom .
For now , EFF recommends installing software that will kibosh third party tracking , such as EFF ’s ownPrivacy Badger . secrecy Wisconsinite will occlude the referrers and the connections to third company sites on healthcare.gov and protect your personal wellness information .
Health entropy is some of the most sensitive and personal information there is . People ’s private aesculapian datum should not be uncommitted to third political party companies without consent from the user . This practice is negligent at best , and potentially crushing for consumer . At a miminum , healthcare.gov should incapacitate third - party tracker for any user thatrequests an opt outusing the DNT head . Arguably , healthcare.gov shouldmeet good privacy standardsfor all its users .
President Obama will give his State of the Union speech tonight , in which he is expect to address cybersecurity issues . If President Obama is really implicated about cybersecurity , he may want to start in his own backyard , by secure healthcare.gov .
This postfirst seem on Electronic Frontier Foundationand republished here under Creative Commons license .
PrivacySecurity
Daily Newsletter
Get the good tech , science , and civilisation news in your inbox day by day .
News from the time to come , delivered to your present .
You May Also Like
