Data Leaks to Third-Party Services on Medical Websites

Several web-based healthcare services such as medi-cal center websites, online pharmacies and mental health websites process sensitive medical data that should not end up in the wrong hands. Today's trend of incorporating several third-party services on websites poses a threat to online privacy, and this is also a considerable risk when it comes to medical websites. In this study, we conduct a network traffic analysis on 20 Finnish healthcare websites to investigate the types of personal data that these websites inadvertently share with third parties and to identify these third-party entities. Our results indicate that even without consent, 12 of these websites leak sensitive data to third parties. We also discuss the implications of health data leaks and offer recommendations for web developers to prevent such privacy issues in the future.