How bits of captured data paint a stealth portrait of your health

Picture your credit card statement from last month. Let’s say, among other things, you purchased a pair of athletic leggings, four movie tickets, and maybe two beers and a plate of nachos at a nearby bar. It turns out, you actually may have not wanted to put the latter two on your credit card.

Individually, such discrete pieces of data may appear inconsequential and useless to a third party. However, data-broker companies are combining these purchases to create “mosaics” about one’s health and health status. Such personal information is in high demand, according to Adam Tanner, whose book Our Bodies, Our Data: How Companies Make Billions Selling Our Medical Records details how such information is collected, sorted and sold.

Patient privacy laws make it illegal for your doctor to reveal information about your diseases, unhealthy habits or weight to a third party. However, much can be, and is, inferred from your purchases and other interactions, including online surveys, store loyalty programs, social media habits and public records. The “profiles” that emerge from such data mining have wide-ranging applications for groups that buy them — including drug companies, advertisers and insurers, according to Robert Gellman, a privacy consultant who specializes in health data and helps companies understand privacy law.

This should give consumers pause, Gellman said. “What really is underlying this, and should be disturbing to more people than it is, is somebody is … compiling a dossier on every individual and every household,” he added.

For instance, according to Gellman, a drug company might turn to a data set for a highly specific list that would make it possible to target advertising to specific patient populations — say, women in Pennsylvania who have purchased the morning after pill. A long-term care insurer might tap into that data set to gain a sense of how long someone will live, and use that to decide on a policy. Or perhaps a prospective employer might be curious about whether you routinely take prescribed medicines, or how regularly you hit the gym.

Around the turn of the century, “most of the health data that existed in the world” was kept in well-protected medical records, according to Deven McGraw, a former official in the Department of Health and Human Services who oversaw health data privacy. “Now we have many more data coming from so many other sources.”

Since this data collection is unregulated and scattershot, the portrait it paints may be inaccurate. What if you were buying the beer and nachos for your partner or friend?

Keeping Score

A report by Gellman and Pam Dixon, a privacy advocate and the executive director of the World Privacy Forum, a group that researches and advocates for digital privacy, details how billions of data points are collected on everyone, then analyzed and used to tabulate a variety of “consumer scores.” These assess your spending, and serve as a backdoor glimpse at your health and hobbies.

There are many kinds of health scores that can be calculated: health risk scores, frailty scores and brand-name medicine propensity scores are all available. Analytics firms can use your credit card information to calculate how likely you are to adhere to medication, how likely you are to be a problem gambler, how often you drink or if you buy brand-name medicine.

Anyone, including college admissions officers, health insurers and potential employers, can buy these scores and use them in decision-making, according to Dixon.

For example, a score suggestive of chronic illness may disqualify a consumer from being offered a low-interest loan, a status credit card or a job. While your potential employer can’t outright ask you if you have a chronic illness, the firm may be able to crunch these numbers and find out.

Greg Horne, a health care analytics principal in the Health and Life Sciences Global Practice at analytics firm SAS, said his clients — which include health insurers — use health risk scores merely to get to know their customers better. They help predict, for example, if someone will respond better to a phone call or text message. Or if they’ll be likely to sign up for a diabetes class. It helps them figure out how many patients might develop cancer in the next year, or how many might need hip replacements.

“It’s about assessing and growing and making sure your system is able to cover the liabilities that it’s set for itself in terms of health care provision,” Horne said.

Your apps and devices — even your fridge

It turns out your wearable fitness tracker might be spying on you, too.

Such devices keep tabs on your location — whether it’s at work, at a doctor’s office, at the mall, a fast-food restaurant or the gym. When fitness trackers are set to public, anyone logged in to them can see data on the wearer’s location and heart rate. Anecdotal evidence suggests it’s even possible to determine if the wearer is having sex, according to Anna Slomovic, a lead researcher at George Washington University’s Cyber Security Policy and Research Institute.

Fridges, thermostats, pillows, security systems, cigarettes and even saltshakers come with the ability to connect to the internet and could funnel sensitive information about your daily habits to advertisers. These devices can tell the world if you’re waking up from sleep apnea many times a night, or if you get home at 3 a.m.

“Many of these things are great technological developments that we shouldn’t shun. It’s just we should be recognizing that there [are] unwanted and unanticipated aspects,” Tanner said.

Of course, devices you use specifically for your health also have a role.

When a doctor takes your blood pressure during an office visit, the numbers are protected by privacy laws like the Health Insurance Portability and Accountability Act of 1996. But when you take it at home on your WiFi-enabled monitor, it can be sold and shared, depending on the user agreement from the company.

Even devices being implanted in your body, like a pacemaker, are sending information back to the manufacturer, according to McGraw. Although you might not be able to access the data yourself, it is likely available on the open market.

Paint your own mosaic

Tanner advocates for more consumer empowerment. This would require manufacturers to make it clear when consumers use a device that it’s collecting data and that users are allowed to opt out.

Dixon adds that consumers are empowered to take charge of their information.

“The data is already out there; you need to understand how you can manipulate your profile,” she said, suggesting the use of cash for some purchases, like alcohol or cigarettes — anything that might reflect poorly on you. Expenses like gym memberships and vegetables could go on credit cards.

Dixon also recommends deploying third-party apps that mask or blur spending habits — PayPal, Apple Pay and Samsung Pay all offer this option. Instead of revealing unhealthy patterns via credit card data, she said, consumers can use these payers to break up habits, putting one extra entity between you and your purchases.

And social media can work to consumers’ advantage.

“If you are a gym member or a fitness person, you want it to be known to the world at large,” Dixon said.

Kaiser Health News is a nonprofit news service covering health issues. It is an editorially independent program of the Kaiser Family Foundation that is not affiliated with Kaiser Permanente.