When immigration agents enter hospitals and private companies are allowed to buy and sell data that reveals who seeks medical care, patients retreat, treatment is delayed, and health outcomes worsen, according to a new report that describes a growing “health privacy crisis” in the United States driven by surveillance and weak law enforcement limits.
The report, published by the Electronic Privacy Information Center (EPIC), attributes the problem to outdated privacy laws and rapidly expanding digital systems that allow health-related information to be tracked, analyzed, breached, and accessed by both private companies and government agencies.
EPIC, a Washington-based nonprofit focused on privacy and civil liberties, based its findings on a review of federal and state laws, court rulings, agency policies, technical research, and documented case studies examining how health data is collected, shared, and used across government and commercial systems.
“Unregulated digital technologies, mass surveillance, and weak privacy laws have created a health privacy crisis,” the report says. “Our health data is increasingly being harvested, sold, and used beyond our control.”
The organization found that health data routinely escapes medical settings and gets repurposed for surveillance and enforcement, and is increasingly deterring patients from seeking care.
EPIC identifies the sale of medical and health-related data as a central driver of the crisis. “Trafficking in individuals’ personal information has become a booming industry in the absence of a federal data privacy law,” it says, “and health information is no exception.”
The report describes a largely unregulated market in which data brokers buy, aggregate and resell information that can reveal diagnoses, treatments, medications and visits to medical facilities. This data is often collected outside traditional health care settings—through apps, websites, location tracking and online searches—and can be repurposed for advertising, insurance risk scoring, or government surveillance without patients’ knowledge or consent.
Once sold, EPIC notes, the information can be difficult or impossible to control, increasing the risks of profiling, discrimination, and higher costs for care, while discouraging people from seeking treatment in the first place.
Last year, WIRED reported that Google’s advertising ecosystem allowed marketers to target US consumers based on sensitive health indicators, including chronic illness, using data supplied by third-party brokers, despite company rules barring such use. The investigation found that advertisers could reach millions of devices linked to conditions such as diabetes, asthma, or heart disease through audience segments circulating inside Google’s ad-tech platform.
In a 2022 investigation, The Markup examined the websites of Newsweek’s top 100 US hospitals and found that 33 were sending sensitive patient information to Facebook through the Meta Pixel, an online tracking tool. Reporters documented the pixel transmitting details when users attempted to schedule appointments, including doctors’ names, medical specialties and search terms such as “pregnancy termination,” along with IP addresses that can often be linked to individuals.
Health privacy experts told The Markup that some of the data sharing may have violated the Health Insurance Portability and Accountability Act, or HIPAA, the nation’s primary law governing the privacy of medical records, which is supposed to limit how hospitals can disclose identifiable patient information to third parties without consent or specific contracts.
EPIC argues that large technology companies have become central actors in the health privacy crisis by embedding surveillance tools across health, advertising, and data-broker ecosystems while pressing policymakers to loosen constraints on data collection. The report warns that those practices have public-health consequences, particularly for people already wary of surveillance or government scrutiny.
“We face a health privacy crisis where care is inaccessible due to criminalization, costs, stigma, and the rise of government intrusion into medical care which forces people to delay or retreat from care, worsening their health,” says Sara Geoghegan, EPIC senior counsel.
