(Truman Lewis @ ConsumerAffairs) True or false: The Internet is a good place to find health information because it's completely confidential.

Answer: False, at least according to a new analysis of over 80,000 health-related web pages. Researchers found that nine out of ten visits result in personal health information being leaked to third parties, including online advertisers and data brokers.

This puts users at risk for two significant reasons:

First, people's health interests may be publicly identified along with their names. This could happen if hackers or other criminals get hold of the information, it is accidentally leaked, or data brokers collect and sell the information.

Second, many online marketers use algorithmic tools which automatically cluster people into groups with names like "target" and "waste". Predictably, those in the "target" category are extended favorable discounts at retailers and advance notice of sales. Given that 62% of bankruptcies are the result of medical expenses, it is possible anyone visiting medical websites may be grouped into the "waste" category and denied favorable offers.

Timothy Libert, a doctoral student at the University of Pennsylvania's Annenberg School for Communication conducted the study. He wrote a software tool that investigates Hypertext Transfer Protocol (HTTP) requests initiated to third-party advertisers and data brokers.

91% of health pages

He found that 91% of health-related web pages initiate HTTP requests to third-parties. Seventy percent of these requests include information about specific symptoms, treatment, or diseases (AIDS, cancer, etc.).

The vast majority of these requests go to a handful of online advertisers: Google collects user information from 78% of pages, comScore 38%, and Facebook 31%. Two data brokers, Experian and Acxiom, were also found on thousands of pages.

"Google offers a number of services which collect detailed personal information such as a user's persona email (Gmail), work email (Apps for Business), and physical location (Google Maps)," Libert writes. "For those who use Google's social media offering, Google+, a real name is forcefully encouraged. By combining the many types of information held by Google services, it would be fairly trivial for the company to match real identities to "anonymous" web browsing data."

Indeed, in 2014, the The Office of the Privacy Commissioner of Canada found Google to be violating privacy Canadian laws.

"Wholly anonymous"

"Advertisers promise their methods are wholly anonymous and therefore benign," Libert writes. "Yet identification is not always required for discriminatory behavior to occur." He cites a 2013 study where individuals' names were associated with web searches of a criminal record, simply based on whether someone had a "black name."

"Personal health information - historically protected by the Hippocratic Oath - has suddenly become the property of private corporations who may sell it to the highest bidder or accidentally misuse it to discriminate against the ill," Libert said. "As health information seeking has moved online, the privacy of a doctor's office has been traded in for the silent intrusion of behavioral tracking."

Libert points out that the Federal Health Insurance Portability and Accountability Act (HIPPA) is not meant to police business practices by third party commercial entities or data brokers. The field of regulation is widely nonexistent in the U.S., meaning that individuals looking up health information online are left exposed and vulnerable.

The findings are reported in the article "Privacy Implications of Health Information Seeking on the Web," appearing in the March 2015 issue of Communication of the ACM.