• by Wendy Davis , Staff Writer @wendyndavis, July 20, 2023

More than 100 companies that collect health data face were warned by government officials about the privacy risks of tracking consumers' online activity.

In letters dated Thursday, officials with the Federal Trade Commission and Health and Human Services Office for Civil Rights wrote that tracking technologies like the Meta Pixel and Google Analytics “gather identifiable information about users as they interact with a website or mobile app, often in ways which are not avoidable by and largely unknown to users.”

The agencies added that sharing people's sensitive health data could lead to “identity theft, financial loss, discrimination, stigma, mental anguish, or other serious negative consequences.”

“To the extent you are using the tracking technologies described in this letter on your website or app, we strongly encourage you to review the laws cited in this letter and take actions to protect the privacy and security of individuals’ health information,” the agencies stated.

The letters were sent to 130 companies, including not only hospitals and health providers covered by the Health Insurance Portability and Accountability Act (which aims to protect patients' privacy), but also some developers of health related apps.

The letters specifically warned companies they “have an obligation to protect against impermissible disclosures of personal health information,” regardless of whether they're subject to the Health Insurance Portability and Accountability Act.

“This is true even if you relied upon a third party to develop your website or mobile app and even if you do not use the information obtained through use of a tracking technology for any marketing purposes,” the agencies wrote.

They added that disclosing health information can violate the FTC Act, which prohibits companies from engaging in deceptive or unfair practices.

Earlier this year, the FTC brought enforcement actions against two companies -- drug discounter GoodRx and therapy app BetterHelp -- for allegedly sharing consumer data with third-party ad platforms.

Meta and Google are both facing class-action complaints stemming from the FTC's allegations against GoodRx. Both companies have asked U.S. District Court Judge Araceli Martínez-Olguín in San Francisco to dismiss the case, arguing that they're not responsible for other companies' use of tracking technology. Meta said it doesn't want to receive sensitive health information from publishers, and has a system to filter out sensitive health data. Google made a similar argument, adding that it prohibits targeted advertising based on health conditions.