Privacy advocates are expressing concern over a marketing and advertising corporation's recent investment in e-health companies. The company's minority stakes, part of a larger trend blurring the lines protecting personal information, gives it access to databases through which advertising to physicians and consumers can be targeted.
"Right now, the Internet is a free-for-all," says Andrew Shen, policy analyst at the not-for-profit Electronic Privacy Information Center in Washington.
"Consumers are often left defenseless: Where their personally identifiable information (PII) ends up, at the end of the day, is very hard to determine."
New York-based Omnicom Group, a holding company with hundreds of advertising and specialty marketing companies and 42 of the world's 50 leading pharmaceutical firms, purchased a 10% or greater share in five e-health enterprises. Thomas Harrison, CEO of Omnicom's diversified services division, says the walls surrounding PII within the databanks of e-health companies in which Omnicom invests are unassailable.
"Never will a client get that information, neither will Omnicom get that information," Harrison says. "Everything will be compliant with HIPAA privacy regulations."
HIPAA's final rules likely will dictate only how providers, and those contractually linked to them, handle information collected online, says Richard Cleland, senior attorney in the Federal Trade Commission's division of advertising practices. "That leaves a whole lot of sites out there that are collecting information from consumers, that aren't going to neatly fall into the definition of medical provider."
While savvy surfers read Web sites' privacy policies before diving in, Shen says that precaution may not ensure permanent protection of data divulged by those online or gleaned from tracking their movements.
Sites often claim they will not sell PII, Shen says. But with the lines between brick-and-mortar and online companies increasingly blurred, and tactics such as online sweepstakes requiring a contestant's name and mailing address, unnamed data can be cross-referenced to other databases and thereby linked to a name.
"For a long, long time companies can collect data and none of it will be identified, per se, but it doesn't mean it will never be identified," Shen says.
Shen says the temptation for struggling dot-coms to plunder or sell databases can be potent in the volatile e-commerce market. "People's privacy should not be at the whim of a company's business model, particularly on the Internet, where business models change radically."
Consumers generally are concerned yet unsophisticated about PII garnered through medical sites, says Margaret Winker, M.D., AMA's director of scientific online resources in Chicago and deputy editor of the Journal of the American Medical Association, which published its own set of criteria for e-health sites in March. "Some Web sites aren't even aware of what advertisers can do with the data collected. I think the risk for privacy breach is huge."
Cleland says Omnicom's actions reflect a larger trend that underscores the need for federal legislation governing the disposition of e-companies' databases.
While some sites scrupulously construct and honor privacy pledges, others are alarmingly lax.
"The more we start co-mingling information gathered from different sources, the more concern there is about privacy," Cleland says. "We need to have some very, very clear, tight rules on privacy in general. Industry self-assurances and self-regulation are not adequate."
Jonathan Joseph, a partner in charge of Christian & Barton's healthcare practice in Richmond, Va., says some states are tackling Internet privacy issues, but the United States lags behind Europe in getting laws on the books.
"From a legal perspective, the law hasn't really caught up with the issues being raised regarding privacy here," Joseph says. "The federal agencies are trying to play catch-up with the explosion in healthcare sites. At this point, Congress hasn't passed any laws or regulations that would stop e-health companies from monitoring where people go on their sites, and then marketing to them."
Of the five companies in which Omnicom has staked a claim, two are geared to physicians: online medical textbook site eMedicine and continuing education site World Medical Leaders. Two others, Healthology and Caresoft's TheDailyApple, provide healthcare information to consumers.
The fifth, eResearch Technology, is a B-to-B firm offering software applications and technology consulting touted to streamline clinical trials.
Linda Boone Hunt is a Prescott, Ariz.-based investigative reporter and feature writer.