Personal user data from mental health apps being sold, report finds

Read the Full Transcript

• John Yang:

  There are thousands of mental health apps available on your phone or computer. They promise all kinds of services including virtual therapy sessions, mood trackers, and meditation guides. They can be helpful and affordable tools. But what happens with user`s personal information. William Brangham has more.

• William Brangham:

  Demand for mental health care soared during the pandemic, and many Americans turn to these software-based virtual health and wellness apps for care. To sign up, users are often asked to fill out their personal and medical histories and answer mental health surveys much like you would at a doctor`s office.

  But there is little federal oversight to keep that data private. A recent report from Duke University found that data brokers were selling information that identified people by their mental health diagnoses, including depression, anxiety, and bipolar disorder. Many brokers removed personal information, but some included names and even addresses of individuals seeking care.

  Justin Sherman is a Senior Fellow at Duke Sanford School of Public Policy. He runs their data brokerage project and oversaw this recent report. Justin, thank you so much for being here.

  I imagine that people would be quite alarmed to know that data brokers were out there selling this information, especially if it was connected to their names. Can you give us a sense of how specific is the data that is being sold?

  Justin Sherman, Senior Fellow, Duke Sanford School of Public Policy: Absolutely, we uncovered data brokers selling a range of data about all kinds of mental health conditions dealt with by Americans ranging from depression and anxiety to PTSD, OCD, people battling trauma, and even actually, people who had suffered strokes, if you imagine, you know, a spreadsheet with rows, right? Perhaps it was something like how many people in a zip code do we think have depression, and they might have the underlying data, but the broker was not itself selling people`s names.

  We also found cases though, where there would be names attached, there would be address information or email, information, and even data on race and ethnicity. And how many children are in the home?

• William Brangham:

  Can you just help me understand this marketplace? What is the value of selling this information and then reselling it on the marketplace?

• Justin Sherman:

  The reality is that most Americans assume that their health data is protected anywhere, everywhere all the time. But unfortunately, that`s just not true. There are a range of companies who are not covered by the narrow health privacy regulations we have. And so they are free legally to collect and even share and sell this kind of health data, which enables a range of companies who can`t get at this normally, advertising firms, Big Pharma, even health insurance companies to buy up this data and mass to do things like run ads, to profile consumers to make determinations potentially about health plan pricing. And the data brokers enable these companies to get around health regulations. To get that information in the first place.

• William Brangham:

  Let`s just say someone is watching this or reads your report and is concerned that they might have some information out there that they want to protect, can they call the companies and say, do not share it? Can they get those companies to delete that data? What can a consumer do to protect themselves?

• Justin Sherman:

  There are some places in the United States where consumer can tell a company in certain scenarios to not sell their information. California, for example, under its state privacy rules, allows consumers to do this.

  But not every state has these rules. We don`t have these rules federally to apply across the country. And the real challenge here is that most people aren`t aware of this data is being collected and sold on them in the first place. And even if you knew it was would you know every data broker to go to, to tell them to stop selling the information? Right.

  So, the obscurity of the marketplace and the fact that many of these companies operate in the shadows, makes it really, really hard for consumers themselves to be able to do anything without stronger privacy regulations from the government.

• William Brangham:

  Do you know of any, any initiatives or effort by the government to try to tighten those privacy regulations?

• Justin Sherman:

  There are some efforts underway. So the Federal Trade Commission, the FTC, for example, I recently took action against GoodRx, which is a large online prescription provider and telehealth company. Because GoodRx was falsely advertising to its users that it was regulated by health privacy laws when it wasn`t. And it was secretly sharing user`s health data with Facebook and Google and other companies.

  And so there is some space for regulators to come in and say, this is deceptive to consumers. This is not something that should be happening. There have also been a couple of bills at the federal level to address this. But we still have these privacy battles ongoing in Congress. And it`s an open question. You know if we`re going to get there.

• William Brangham:

  All right, Justin Sherman at Duke University`s Sanford School of Public Policy, thank you so much.

• Justin Sherman:

  Thanks for having me.