The 3 Types of Your Health Data That Aren't Private

Measuring and managing your health is more do-it-yourself than ever, but health privacy law hasn’t caught up to the technology. That’s the subject of an investigative series from ProPublica, and the newest installment looks at everyday medical and fitness tools that aren’t legally bound to keep your information private.

The story recounts the experience of Jacqueline Stokes, who used an at-home paternity test and discovered that her test results (and those of more than 6,000 others) were publicly accessible online. Stokes, a cybersecurity consultant with an interest in genetics, contacted the Department of Health and Human Services to report what she thought was an obvious breach of patient privacy, but HHS officials said they couldn’t do anything about it.

A person’s health information is generally kept private under the Health Insurance Portability and Accountability Act of 1996 (more commonly known as HIPAA). This privacy law, however, applies only to healthcare providers, insurers and data clearinghouses. Here are some examples of things that doesn’t include:

An at-home paternity test and its online lab results
Data from fitness trackers, health apps and information you enter in those profiles
Genetic information entered on a genealogy site

Many of these devices or services have had problems in the past with protecting user data, as ProPublica describes in its report.

The ProPublica piece and the entire privacy series is worth a read. It’s generally a good idea to be careful about where you store personal information, but as the regular occurrence of data breaches has shown, a lot of that is beyond consumer control. Still, it’s important to watch out for signs your identity has been stolen so you can try to minimize the damage. One of the ways to monitor for identity theft is to check your free annual credit reports. You can also get a free summary of your credit report every 30 days on Credit.com.