Study details how data brokers are 'willing and able' to sell your mental health records

Data brokers are capitalizing off the sale of Americans’ mental health data, a new report from Duke University's Sanford School of Public Policy found.

"The research is critical as more depressed and anxious individuals utilize personal devices and software-based health-tracking applications... often unknowingly putting their sensitive mental health data at risk," the study found. "This report finds that the industry appears to lack a set of best practices for handling individuals’ mental health data, particularly in the areas of privacy and buyer vetting."

According to the report, which reached out to 37 different data brokers inquiring about mental health data, 26 responded and 11 firms “were ultimately willing and able to sell the requested mental health data.”

Some of these brokers went so far as to advertise sensitive health data, including information on individuals with conditions like depression, anxiety, and bipolar disorder along with demographic data like race, ethnicity, religion, age, gender, and credit score.

The research “shines a light on the wide availability of Americans’ health data for sale on the open market,'' Justin Sherman, a senior fellow at Duke, told Yahoo Finance. “While some of this information appears to be at the aggregate level, some of this data is clearly linked to individuals. For just a few hundred dollars, you can purchase lists of Americans suffering from depression or anxiety, taking medication for trauma, or dealing with the aftermath of a stroke — possibly with their names, races, ethnicities, home addresses, and other information attached.”

The pricing for this mental health data varied widely, according to the findings. Some data brokers charged as low as $275 for 5,000 aggregated accounts of mental health records while others charged between $75,000-$100,000 on an annual basis for access to data that included information on individuals’ mental health conditions.

“Most people are not affirmatively, knowingly, explicitly agreeing to this practice, and consumers’ consent is not freely given in a society where people are forced to interact with the data brokerage ecosystem to apply for a job, apply for housing, get a loan, or sign up for an insurance plan,” Sherman said. “Congress needs to act to rein in this practice and uphold the spirit of HIPAA — protecting Americans’ health data from this kind of exploitation.”

'This raises all kinds of questions'

Selling sensitive data isn’t new — in 2020 and 2021, data brokers Epsilon LLC, Macromark Inc., and KBM were found guilty of fraud and other charges stemming from knowingly providing lists of elderly and vulnerable individuals to scammers.

Because of the lack of comprehensive privacy regulation, it’s entirely legal for companies to collect, aggregate, analyze, share, and even sell health and mental health data. The Health Insurance Portability and Accountability Act — commonly known as HIPAA — only applies to certain covered entities, like health insurance providers and doctor’s offices.

"Most Americans assume all their health data is protected everywhere, all the time, but this is not true,” Sherman said. “The decades-old law doesn’t cover numerous companies with no links to a covered entity, such as apps or websites made by third parties, social media companies, advertising technology firms, and data brokers.”

Additionally, he explained, many data brokers play a role in lobbying politicians to often quash or weaken privacy laws.

The brokers “market their perceived positive uses of the data, fully ignoring the invasiveness of the data collection and sale, and the harm to consumers,” Sherman said, adding that for some companies, “having a credit card and an email address — and maybe signing a nondisclosure agreement — is good enough to give you access to highly sensitive mental health data on Americans, no questions asked.”

The data being sold isn’t always used for just marketing purposes, either. In fact, health insurance companies often purchase data from brokers in order to determine rates for their subscribers based on algorithms.

For example, according to NPR, a woman with a newly changed name could be seen as newly married and “have a pricey pregnancy pending" or as recently divorced and more likely to experience anxiety. Or, data indicating that someone is low-income and a minority means they “are more likely to live in a dilapidated and dangerous neighborhood, increasing [their] health risks.”

Additionally, the Duke report noted, scammers can purchase mental health data to exploit individuals living with mental health conditions.

Consumers are typically unaware of their data being used in such a way.

“This raises all kinds of questions about privacy, potential algorithmic discrimination, and the risk of companies taking advantage of consumers in vulnerable positions,” Sherman said. “The privacy debate is often framed around ‘consent’ and terms of service agreements, but data brokers claiming that people consented to this collection and sale of their mental health data are twisting the term so much it becomes meaningless.”

'The chilling effects'

Julia Harris, associate director at the Bipartisan Policy Center, also expressed dismay over the findings and what the long-term impacts could be.

“We are most concerned about the chilling effects this can have on people seeking care,” Harris told Yahoo Finance. “Over a third of Americans live in mental health professional shortage areas and access to virtual care can address the lack of accessible behavioral health providers for many of these people. Virtual care also helps patients overcome the stigma related to accessing these services, especially in tight-knit rural communities where people may be reluctant to be seen walking into certain providers’ offices.”

But if individuals learned that their mental health records were being shared for others to profit from, she said, it may deter them from seeking virtual care, further preventing them from accessing necessary mental health resources.

“We’re looking into the federal policy levers that can protect consumers from these types of breaches of trust, including more comprehensive privacy laws that apply to entities that traditionally don’t fall within the purview of HIPAA,” Harris said.

In the Duke report, the researcher interacted with one data broker willing to sell lists of data on individuals, including ones titled “Anxiety Sufferers” and “Consumers with Clinical Depression in the United States.”

“Americans suffering from mental health conditions already face stigma in voicing their challenges, seeking care, and getting proper treatment,” Sherman said. “It’s especially predatory that when people are in vulnerable positions, even at serious risk, companies swoop in to secretly gather and sell data on those people — all to make a profit off their health conditions.”

—

Adriana Belmonte is a reporter and editor covering politics and health care policy for Yahoo Finance. You can follow her on Twitter @adrianambells and reach her at adriana@yahoofinance.com.

Read the latest financial and business news from Yahoo Finance

Download the Yahoo Finance app for Apple or Android

Follow Yahoo Finance on Twitter, Facebook, Instagram, Flipboard, LinkedIn, and YouTube