Customize your JAMA Network experience by selecting one or more topics from the list below.
Niforatos JD, Zheutlin AR, Sussman JB. Prevalence of Third-Party Data Tracking by US Hospital Websites. JAMA Netw Open. 2021;4(9):e2126121. doi:10.1001/jamanetworkopen.2021.26121
Web tracking occurs when third parties collect, store, and share information related to a website visitor’s activity.1 Hospital websites may reveal sensitive information about an individual’s health conditions and concerns often without their knowledge. We characterized data tracking on US hospital websites to understand potential patient privacy risks.
We conducted a cross-sectional study of publicly available website data tracking on June 23, 2021. This study did not require institutional review board approval based on the criteria of 45 CFR §46 because it was not regulated as human participant research. Three categories of US hospitals were included in this study (Table): the 20 largest for-profit hospitals and the 21 largest nonprofit and governmental hospitals (nonprofit) according to the 2019 American Hospital Association annual survey and the 20 best hospitals according to the US News & World Report (USNWR) 2020-2021 Best Hospitals Honor Roll. More details are given in the eMethods in the Supplement. This study followed the Strengthening the Reporting of Observational Studies in Epidemiology (STROBE) reporting guideline.
For each hospital, we gathered information regarding their website’s data tracking using Blacklight,2 which monitors website surveillance scripts (eMethods in the Supplement).3 We collected information on advertisement tracking, third-party cookies, session recording services, and Facebook and Google tracking software. Data were analyzed descriptively.
A total of 61 hospital websites were included. All hospitals used advertisement trackers, and most (55 [90%]) used third-party cookies (Table). Session recording services were found on 14 hospital websites (23%), whereas 40 websites (66%) used Facebook tracking software and 54 (89%) used Google tracking software (Table).
The median values for both advertisement trackers and third-party cookies were highest among the USNWR best hospitals (trackers: 9.0 [interquartile range (IQR), 4.8-11.3]; cookies: 11.5 [IQR, 4.0-22.0]), followed by nonprofit hospitals (trackers: 6.0 [IQR, 3.0-9.0]; cookies: 4.0 [IQR, 1.0-10.0]) and for-profit hospitals (trackers: 5.0 [IQR, 3.0-6.3]; cookies: 3.0 [IQR, 2.0-5.8]) (Table). The proportions of websites with session recording services and Facebook tracking software were highest among the USNWR best hospitals (7 [35%] and 14 [70%], respectively), whereas the proportion of websites with Google tracking software was greatest among for-profit hospitals (19 [95%]).
All hospital websites in the current analysis used advertisement trackers, and most used third-party cookies and provided user information to Facebook and Google. The websites for the USNWR best hospitals used more advertisement trackers and third-party cookies than the websites for the other hospital categories. A higher proportion of USNWR best hospitals also used session recording services and provided user information to Facebook.
Patients often use hospital websites when seeking health care services. In this process, patients create a digital profile that gives information on the patient’s location, demographic characteristics, and disease status, giving hospitals and other organizations who receive their data the ability to construct health profiles of individuals that can be used for targeted advertising and monitoring or to better understand information-seeking habits of the website users.
The USNWR best hospital websites had substantially more tracking than the nonprofit and for-profit hospital websites. Hospital rankings may inform and influence consumer behavior and are often used to justify care locations by patients.4-6 Furthermore, patients with rare diseases or diseases refractory to common therapies in particular may benefit from the subspecialty care at top hospitals but also may be at increased risk of identification.
The current study is limited by the use of only 1 method to examine website tracking; other algorithms for monitoring data privacy may vary. In addition, we cannot comment on how the data are used or how aware hospital leadership is of the tracking. Given the substantial amount of information patients may be providing to hospital systems through their websites, future research is warranted regarding how this information is used, whether protected health information is inadvertently created, and whether patients are provided easily accessible and understandable up-front consumer privacy disclosures.
Accepted for Publication: July 19, 2021.
Published: September 22, 2021. doi:10.1001/jamanetworkopen.2021.26121
Open Access: This is an open access article distributed under the terms of the CC-BY License. © 2021 Niforatos JD et al. JAMA Network Open.
Corresponding Author: Joshua D. Niforatos, MD, MTS, Department of Emergency Medicine, The Johns Hopkins School of Medicine, 1830 E Monument St, Ste 6-100, Baltimore, MD 21205 (firstname.lastname@example.org).
Author Contributions: All authors had full access to all of the data in the study and take responsibility for the integrity of the data and the accuracy of the data analysis.
Concept and design: All authors.
Acquisition, analysis, or interpretation of data: All authors.
Drafting of the manuscript: Niforatos, Zheutlin.
Critical revision of the manuscript for important intellectual content: All authors.
Statistical analysis: All authors.
Administrative, technical, or material support: Sussman.
Conflict of Interest Disclosures: None reported.
Funding/Support: Dr Zheutlin was supported by award 1R38HL143605-01 from the Utah Stimulating Access to Research in Residency Transition Scholar.
Role of the Funder/Sponsor: The funder had no role in the design and conduct of the study; collection, management, analysis, and interpretation of the data; preparation, review, or approval of the manuscript; and decision to submit the manuscript for publication.