Facebook, Privacy and Health

Report 3: Facebook & Health Privacy | June 2011

unNiche
Widen Your Health Marketing Communications Perspective

Facebook and Health Just Between Us: Facebook,
Privacy Essentials Health Information, and Privacy

S
A Conversation About Health Privacy:
Who's In?
ocial media has the potential to be a valuable tool for the
Conversation on e-patients.net led by
Susannah Fox of the Pew Internet & healthcare field. Platforms like Facebook and Twitter enable patients
American Life Project focusing on to communicate directly with doctors, share information with one
implications of Facebook's evolving another, and form support networks. Online medical record keeping
privacy settings for health. Learn More and personal health records enable patients to have more
responsibility for and ownership of their health, and to coordinate the
The Social LIfe of Health
efforts of different doctors.
Information, 2011
The Pew Internet & American Life However, these tools have significant flaws and limitations. Online
Project's 2011 report on the habits of information may be inaccurate or misleading, and social networks
online health seekers, including how they and online health resources carry privacy risks. Moreover, insurers,
use Facebook. Learn More employers, and others may gain access to patientsʼ health
information on social networks more easily if it is attached to their
Healthcare Social Media Sites Neglect real name.
Privacy Protections
Article published in February 2011 by
The tension between the promise and peril of the Internet and social
Information Week focusing on how many
health-based social networks neglect to media as a health resource is most pronounced in the case of
provide adequate and complete privacy Facebook, the largest social network and arguably the most
protections. Learn More transformative force at work on the Internet today. Facebook has
attracted hundreds of millions of users who may never have
considered sharing personal information online before. But,
Facebookʼs business model is predicated on enabling marketers to
track usersʼ behavior, and tying it to real offline identities. Facebook
has steadily pushed its users to make more of their posts and
behaviors public, often by way of unilateral changes to usersʼ privacy
settings. Furthermore, Facebook transmits usersʼ profile IDs and
Web browsing behavior to marketers, sometimes intentionally,
sometimes inadvertently.

Authors: Ethan Hein, Jayme Hummer
and Merry J. Whitney
A Path of the Blue Eye
Project Publication Produced by Enspektos, LLC
www.pathoftheblueeye.com www.enspektos.com


unNiche

Just Between Us:
Facebook, Health Information, and Privacy
With Facebookʼs rapidly growing popularity, it may seem surprising that the large majority of users do not
search for or share health information on the site. For example, according to a May 2011 study published by
the Pew Internet & American Life Project, only 15% of social network users go to sites like Facebook and
MySpace to get health information. Why? Well, it may be because this content is not shared widely on these
sites.

Another major limiting factor is the concern over privacy. According to research within the study, conducted by
the Path of the Blue Eye Project, Facebook users are afraid that marketers, employers, insurers, or others will
ﬁnd and misuse their information. For some, Facebookʼs uneven track record on user privacy shows these
fears to be well-founded.

The Internet As a Health Resource: the De Facto Second Opinion

According to a 2009 study published by the Pew Internet Project, seeking health information is the third most
prevalent activity among American Internet users, after e-mailing and browsing search engines. Eight out of ten
Internet users report seeking health information online—either for themselves or on behalf of children and
other dependents. The Pew report describes the Web as “the de facto second opinion.”

Pew's study indicates that the tendency to seek health information and emotional support varies across
demographic groups. Fewer than half of African-American and Latino adults seek health content online. The
same is true for senior citizens, persons with disabilities, and those living in households with an annual income
of less than $30,000. This is likely due to a generally lower rate of Internet usage among these groups. The
study further notes that as more mobile phones become capable of Web browsing, seeking health information
online is likely to become more widespread among these less-connected groups, just like adoption of mobile
phones has become nearly universal among Americans of all backgrounds.

A 2009 study by Manhattan Research indicates that health information seekers now turn to the Internet more
than physicians. The study also shows that more than 80 million adults in the U.S. use social media to
research health-related issues. They create or use content on health blogs, message boards, chat rooms,
health-speciﬁc social networks and online health communities. Between 2004 and 2009, the U.S. consumer
market for online health resources nearly doubled from 90 million to nearly 160 million.

2


unNiche

Just Between Us:
The Manhattan Research study also found that patients use various electronic health resources to inform
conversations and decisions at the doctorʼs office. Virtually all U.S. physicians report that at least some of their
patients bring health information they found online to an appointment, and more than two-thirds believe this
trend to be a positive one. Additionally, about four in ten physicians communicate with patients through e-mail,
instant messages, or secure messaging services.

In the press release accompanying its study, Manhattan Research reported: “Thereʼs a sizable market of
consumers who are interested in connecting with their doctors online, so physician acceptance will go a long
way in pushing this type of communication forward. … Marketers should be aware that online health
information is playing an increasingly bigger role in the doctorʼs office, so providing online patient education
tools and resources, such as a doctor discussion guide, can help brands become part of the treatment decision
process.”

Pew Internet reports that e-patients have taken to social technologies to pool their opinions and experiences.
Among survey participants, 60% consume social media and 29% have contributed content. Social media is
becoming a popular method of crowdsourcing proveriders' ratings. Nineteen percent of e-patients consult
rankings and reviews of providers, and 5% post such reviews. Eighteen percent of patients consult reviews of
hospitals, and 4% post them.

More information on Americans' online health research activities was provided in a 2011 National Research
Corp Ticker survey, which indicates that only one in five Americans use social media websites as a source of
healthcare information. Of those who did, 18% each used Twitter and MySpace. However, hospital web-sites
continue to be a much more highly used and trusted source, with half of respondents preferring them to other
sources. Respondents also continue to prefer traditional advertising sources like TV, newspapers, and radio to
online advertising, since they see advertising as an intrusive presence in social media.

Mobile Phones and Health

The next rapid growth in online health engagement is likely to be in the mobile sector. At present, nearly one in
ten cell phone users have a health app. As Internet-enabled smart phones drop in price, we can expect the
adoption of health apps to expand significantly.

3


unNiche

Just Between Us:
Pew Internet reports that 17% of respondents use mobile phones to find health information. Mobile health
users are over represented among the young, minorities, urban residents and upper socio economic status.
There are no male-female differences in mobile health adoption.

Mobile phones may change the nature of online health searches. Pew cites statistics from Yahoo! showing that
the top five most common health searches on the mobile version of their site include "pregnancy," "herpes,"
and "STD" (sexually transmitted diseases). None of these topics appear in the top five health searches on the
non-mobile version of Yahoo!. This discrepancy is most likely due to the need for discretion; a mobile phone
can be used without family members or coworkers looking over oneʼs shoulder.

Personal Health Records

The healthcare profession lags far behind other industries in adopting electronic record keeping. In recent
years this trend has started to shift, with a launch of several high-profile services offering online personal
health records (PHRs). Using PHRs, patients can have effortless access to their health records and can feel
more ownership of and responsibility for their own care. As of 2010, 7% of adults had used a PHR, and that
number is increasing.

PHR users report that they are more active in taking steps to improve their health and asking questions of their
physicians, according to Consumers and Health Information Technology: A National Survey by Lake Research
Partners. The study suggests that PHR adoption is most widespread among higher-income people who are
also the more frequent Internet users overall. However, the greatest benefits of PHRs could be realized by
lower-income adults, sufferers from chronic conditions, and those without a college degree. While privacy is a
concern for two-thirds of Lake Researchʼs respondents, a majority of PHR users do not express worry over the
privacy of their records. And among non-users of PHRs, 40% express interest in using one.

A presentation developed by John Moore of the California HealthCare Foundation, indicates that 75% of PHR
non-users cite privacy concerns. Those who do trust their PHR mostly cite the web siteʼs or doctorʼs reputation
and the siteʼs security and password protection, while very few cite HIPAA or the siteʼs privacy policy.

4


unNiche

Just Between Us:
While the product is rumored to be on its last legs, Google Health represents a particularly interesting entrant
into the nascent PHR market. The search giantʼs PHR offering is richly and dynamically interactive. According
to its FAQ page, Google Health “can store wellness data, medical records, or both in Google Health including
personalized wellness goals around weight or exercise as an example, or more traditional medical history such
as your medications, allergies, procedures, immunizations, conditions, health insurance information and test
results. You can enter any of this information on your own, or you may be able to import your medical
information from a list of Google Health integrated partners such as hospitals, retail pharmacies or
laboratories.”

Google Health will also show personalized search results according to the medical conditions, medications,
and lab results listed in usersʼ Google Health profiles. While this function may be convenient and valuable to
users, it also raises concerns as to how Google will store or use the data it is gathering. Google has a strict
privacy policy with user data. For example, it does not save personal data to inform customized searches.
However, users should be aware that Google is not legally blocked from sharing user data with employers and
insurers. The Google Health Terms of Service state: “Google is not a 'covered entity' under the Health
Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder ('HIPAA'). As
a result, HIPAA does not apply to the transmission of health information by Google to any third party.”

Google does not charge fees to users of Google Health and does not show advertising on it. Google also
pledges not to sell health data or share it with employers and health insurance providers. However, users may
be forgiven if they're skeptical about Google contining to provide this service for free indefinitely with no effort
to extract financial gain from it. Users must trust that Google will not misuse their confidential information,
willfully or accidentally. This trust must also extend to Googleʼs employees and contractors.

Google has a number of major competitors in the PHR space. Microsoft HealthVault offers similar functionality,
though without the integration with online searches [http://www.healthvault.com/]. The Norwegian company
World Medical Center offers another similar product, the World Medical Card. Dossia is an open-source PHR
service jointly operated by a group of major employers: AT&T, Applied Materials, BP America, Cardinal Health,
Intel, Pitney Bowes, Sanofi-Aventis, Walmart, Abraxis BioScience, and Vanguard Health Systems.

5


unNiche

Just Between Us:
Facebook, Health Information and Privacy
Facebook and Health

Facebook is the largest and most used social media platform in the world, and one of the most used web-sites
overall. Since its launch in 2004, Facebook has gained more than 600 million users, with millions more joining
daily. A January 2009 Compete study listed Facebook as the most used social network by global monthly
active users, with MySpace in second place. According to a Quantcast estimate in October 2010, Facebook
had 135.1 million unique U.S. visitors a month. Social Media Today estimates that as of April 2010, 41.6% of
the U.S. population had a Facebook account. Facebook is also the number-one most visited site in Mexico,
Indonesia, Turkey, Argentina, Malaysia and other countries.

Facebook has heavily impacted every sector of the Internet, and the healthcare field is no exception. For
example, in 2010, the Centers for Disease Control and Prevention reported that Facebook drove more than
100,000 visits to the agencyʼs Web properties between January and June. In addition, the agencyʼs Facebook
page generated more than 75,000 “Likes” as of late January 2011.

Interactions between Physicians, Providers, Scientists and Patients on Facebook

Physicians have long maintained blogs and social media presences as ways of sharing and interpreting health
news and general advice, and the practice is no longer remarkable. However, physiciansʼ use of two-way
platforms like Facebook is significantly more fraught with potential controversy.

In December 2010, the Journal of Medical Ethics published an article entitled “Facebook activity of residents
and fellows and its impact on the doctor patient relationship.” In a survey of 202 physicians, 73% had a
Facebook profile. Of these physicians, 99% displayed their real name on their profile, 91% showed a personal
photograph, 59% listed their university affiliation, and 55% their current position. No physicians in the study
automatically accepted friend requests from patients, 15% decline friend requests on a case-by-case basis and
85% decline all patients' friend requests.

Bryan Vartabedian, MD, a pediatrician at Texas Childrenʼs Hospital, is a prominent physician blogger. In an
article in Infectious Disease News, Dr. Vartabedian reported that patients attempt to contact him for medical
advice via his social media presence about once a month.

6


unNiche

Just Between Us:
Dr. Vartabedian does not encourage this type of contact: “Physicians should not be having direct dialogue with
patients in public places, even if it is the patient who initiates the dialogue.” Dr. Vartabedian further advises that
physicians not mention specific patients by name online, and should generally go above and beyond HIPAA
guidelines: “If I see a patient with a rare disorder, technically I could discuss the case on Twitter without
mentioning the patientʼs name. It may be HIPAA compliant, but ethically, if the mother of my patient saw that I
had written about it in a public platform, how would she feel? I think it represents a serious breach in the
relationship we share.”

The Communications and Public Outreach branch of the Canadian Institutes of Health Research (CIHR) uses
social media to interact with Canadians about health research initiatives. One successful CIHR program, Café
Scientifique, facilitates interactive dialogue between various experts in health-research topics and the general
public. The meetings take place in a café, pub, or restaurant; interested people who are unable to physically
attend may participate via the Café Scientifique Facebook community, which has 40,000 fans.

Health Communities on Facebook

While physicians and health providers may be constrained in their use of social media, patients have shown a
greater willingness to form online communities in order to share stories and information. Participants in such
communities seek emotional support, practical advice for day-to-day coping, and recommendations for
everyday remedies.

In a study conducted by CVS Caremark, researchers examined the 15 largest Facebook communities
dedicated to diabetes. These communities averaged 9,289 members. The study examined 690 wall postings
from 480 unique users. Most of the postings were by people sharing personal stories. Among the studyʼs
findings:

• 66% of posts described personal experiences living with diabetes
• 24% included information unlikely to be shared with a doctor, such as alcohol and carbohydrate
management
• 29% were intended to show emotional support
• 13% provided specific responses to information requests

7


unNiche

Just Between Us:
Who Shares Health Information on Facebook?

In spite of Facebook's widespread adoption, relatively few Americans are using social networks to gather or
share health information. Data published in 2009 by the Pew Internet and American Life Project indicates that:

• 22% of social network users have followed their friendsʼ personal health experiences or updates
• 15% have posted comments, queries, or information about health or medical matters
• 12% have gathered any useful health information from the sites
• 6% have started or joined a health-related group on a social networking site

In 2011, Pew updated its 2009 research (cited above) and found that only 15% of social network users go to
these sites to find health information. The 2009 report revealed no significant differences among demographic
groups in their health-related usage of social networks. This holds true across gender, education level, and
race.

A 2010 Pew report indicates that only 25% of Internet users living with a chronic disease said they use a social
networking site like Facebook to gather or share health-related information. Of those:

• One in four has followed friendsʼ personal health experiences or updates on these sites
• One in five has posted comments, queries, or information about health or medical matters
• One in five has gathered any health information from these sites
• One in ten has started or joined a health-related group on a social networking site

Page 9 and 10 show two examples of public status updates providing detailed information about users' health.
Figure 1 (on page 9) shows a profile belonging to Tammy Archer. From her profile, we can determine that she
is married with three children, one grandson, and three pets. She is dealing with a two-year-old diagnosis of
pseudotumor cerebri, a condition in which abnormal fluid builds and causes pressure in the skull, resulting in
painful headaches and loss of vision.

In Figure 2 (on page 10) Sandra Gil-Brito is seeking advice from her Facebook community regarding a platelet
disorder. The comments below her status update include well wishes and recommendations that she visit a
naturopath and eat peanuts with the shells. Based on a userʼs privacy settings, Facebook status updates like
these may be visible to any member of the public.

8


unNiche

Just Between Us:
Figure 1: Tammy Archer's Facebook Proﬁle

9


unNiche

Just Between Us:
Figure 2: Sandra Gil-Brito's Facebook Proﬁle

10


unNiche

Just Between Us:
Facebook as Lifesaver

In a December 2010 article, Dr. Kamal Thapar, a neurosurgeon at Sacred Heart Hospital in Wisconsin, and
Newt Gingrich, former speaker of the House of Representatives and founder of the Center for Health
Transformation, described how doctors solved a life-or-death mystery by reviewing and analyzing a comatose
patientʼs Facebook commentaries about her symptoms.

The 56-year-old woman had been hospitalized several times over the course of a few weeks, but doctors were
stymied about the cause of her problem. She had complained of chest discomfort, but tests did not identify a
problem before she lapsed into a coma. Subsequently, doctors realized that the coma and accompanying
paralysis resulted from a massive stroke, with indications of prior strokes. The woman lived a considerable
distance from family members, and there was no complete medical history to consult. A hospital staff member
contacted a relative, but he could provide very little information, except that she had a Facebook account. The
patientʼs Facebook profile detailed her medical history for several months: she had posted the medications
taken, symptoms, hospitalizations and conditions preceding admissions, dates, times, and descriptions of what
she felt and how her body reacted. Through her commentary, the Sacred Heart medical team determined that
the patient had a hole in her heart, and that resultant blood clots to the brain had caused the strokes. This
discovery enabled the doctors to construct a treatment plan, including surgery that saved her life.

It is stories such as these that underline the promise of Facebook and similar sites to benefit their usersʼ
health. However, many users may find that the risk of sharing such detailed health data may outweigh the
benefits. While physicians can see this data, so can the usersʼ friends, family, employers, insurance company,
and untold numbers of outside data-gathering entities and marketing firms.

Obstacles to the Use of Online Health Resources

An analysis of diabetes sites by the Children's Hospital Boston informatics program published in January 2011
indicates that many websites lack scientific accuracy and put users' personal information at risk. This study
neatly encapsulates the major objections that some health providers and experts have regarding the
trustworthiness of online health resources.

11


unNiche

Just Between Us:
The study found that only 50% of sites presented content consistent with diabetes science and clinical
practice. Furthermore, the sites lacked proper privacy protection and review processes, and showed
inappropriate advertising. Four moderated sites gave information about a nonexistent diabetes cure, and three
sites showed advertisements for unfounded cures. Data security and encryption were largely absent, and only
three sites gave members control over their personal information. The sites were found to lack basic and
essential facts about diabetes and did not consistently include disclaimers recommending visitors seek the
opinion of a physician. The study recommended increased moderation and transparency, particularly regarding
potential conflicts of interest, like ties to the pharmaceutical industry.

The CVS study of diabetes communities on Facebook (referenced on page 7) cites inaccurate or willfully
misleading content. The study found that 27 percent of posts were promoting non-FDA-approved products,
sometimes with personal testimonials. Troyen A. Brennan, MD, MPH, executive vice president and chief
medical officer of CVS Caremark states, “This study shows the many ways that patients are benefitting from
social networks. But it is critically important for patients to understand the need for fact-checking.”

Internet Privacy Issues

While inaccuracy and fraud are inherent dangers in any discussion or publication of medical information, the
Internet poses particular risks of its own concerning privacy, risks that create the most major obstacle to the
discussion of health online. Even the youngest Internet users who are generally inclined to reveal large
amounts of personal information online express reluctance to discussing medical issues. According to a
research project by the UK Royal Academy of Engineering, while the 14-to 19-year-old age group is generally
very comfortable with social networking and with the contemporary culture of posting personal information on
Facebook and similar sites, they are at least as aware as their elders of the potential for personal details to
become subject to abuse or unauthorized uses.

Respondents expressed particular concern over the use of Electronic Patient Records (EPRs), including the
potential for user errors or possible misuse of information that might cause discrimination or prejudice if
improperly disclosed. Conversely, respondents did not consider general social interaction threatening on
Facebook or similar sites; they felt they could maintain control over exactly what information was posted and
who could gain access to it.

12


unNiche

Just Between Us:
Web Tracking

Internet search firms and markets have been tracking Web usersʼ browsing history ever since the Web became
a serious commercial entity. Historically, this tracking has been anonymous. Any website administrator can
count the number of a clicks a page receives, which sites and search terms direct traffic to them, and which
countries visitors are located in. Recently, however, tracking has become more significant and fine-tuned.
Modern Web browsers store “cookies,” strings of code that relay web browsing activity to companies like
Google. Such data is immensely valuable to marketers since it helps them target their campaigns to
consumers interests as reflected by their Web activity.

In recent years, Internet marketers have shown a stronger interest in creating profiles of specifically identifiable
consumers, rather than simply aggregating anonymous data. Such profiles enable much more narrowly
focused advertising informed by consumers' posts and other activity on social media sites, as well as those of
their friends. A profile may contain a personʼs name, street and email addresses, telephone number(s), age,
gender, vocation, employer, hobbies, activities, memberships, affiliations, and/or medical considerations.

Insurers Use Social Networking Sites to Identify Risky Clients

One of the major risks for people who share information about their health online is that insurers will use that
information as a basis to deny coverage. The insurance industry has a strong financial incentive to research
applicantsʼ online posts; Web searches are much less expensive than blood and urine tests and other medical
evaluations. The same data-gathering companies that presently serve direct marketers are becoming attractive
to insurers as well. Most consumers are unaware of how much of their Web browsing activity is available to
these companies. For example, Internet security expert James Brown has expressed concern that visitors to
Britainʼs National Health Service website can be tracked and identified via Google and Facebook.

Web Scraping

Individual Web browsing history is not the only data of interest to marketers and insurers. Posts on Web
forums, discussion groups, and bulletin boards are also a rich sources of data that can be easily tied to a
specific identity. While most online forums offer some measure of security or anonymity, these measures can
be easily circumvented using Web scraping techniques.

13


unNiche

Just Between Us:
Web scraping is a method of automatically extracting data from web sites en masse. It is related to the
methods used by search engines to index Web pages.

A site wishing to maintain the privacy of its users can include code in the pages requesting that they not be
scraped, and reputable firms will honor those requests. However, not all firms are reputable. The law is unclear
as to whether or not Web scraping constitutes a theft of information from the scraped sites. Even where law
provides unambiguous protection from scraping, it may be difficult or impossible to enforce. Since scrapers
employ the same protocols as ordinary Web browsers, techniques that would completely prevent scraping
would also block legitimate site visitors. Site programmers can add security measures like CAPTCHAS to limit
visits to human users, but the most sophisticated scraping software can sometimes circumvent these
measures.

In 2010, The Wall Street Journal detailed a scraping incident that occurred on the health social network
PatientsLikeMe. On May 7, 2010, site administrators noticed suspicious activity on its discussion board
dedicated to mood disorders. The board was scraped by Nielsen Co., a media research firm whose clients
include several drug makers. Site user Bilal Ahmed used a pseudonym on the message boards to reach out to
fellow depression sufferers, but his profile linked to his blog, which identifies him by his real name. When
PatientsLikeMe announced the scraping incident, Ahmed deleted his posts and information about the
medications he takes. However, there is no guarantee that his information has been completely removed from
Nielsenʼs database, much to his chagrin. While some firms allow people to remove information about
themselves, there is no law requiring them to do so. Nielsen has announced that it no longer plans to scrape
anonymous health forums, but this pledge will be little comfort to Ahmed and others whose privacy have
already been compromised. The pledge also has no bearing on Nielsenʼs competitors.

PatientsLikeMe sells data about its users, though the company says that this data is anonymized. As Bilal
Ahmedʼs story suggests, however, the use of a pseudonym is no guarantee of anonymity online. A firm called
PeekYou LLC is seeking a patent for a method that matches handles on blogs, forums, and social media sites
to real names. PeekYou offers access to its records of about 250 million people in North America. As with
PatientsLikeMe, PeekYou says that it anonymizes the data it sells, but individuals listed in the data are at the
mercy of the companyʼs intentions.

14


unNiche

Just Between Us:
Facebookʼs Privacy Issues

For groups concerned about Internet privacy and data security, Facebook poses particularly serious issues. A
2010 study by Sophos asked technical personnel at large firms which social networks pose the biggest Internet
security risk. Sixty percent of respondents cited Facebook, much more than cited such sites as MySpace,
Twitter, and LinkedIn.

Facebook has been criticized for changing its privacy rules to expose more of a user's information by default,
requiring users to actively change their own settings to be more restrictive. Facebook has also been found to
transmit the ID numbers of usersʼ profiles to advertisers when users clicked on some ads, though Facebook
has since discontinued this practice. Given this history, users should feel justified in having grave doubts about
the privacy of personal information they share on the site, even if that data is explicitly marked private.

Facebook users may not be aware of how accessible their posts are to insurers, employers, and marketers,
and may not consider the possible consequences of their posts. In November 2009, Natalie Blanchard lost her
health benefits due to photos she posted on Facebook. The 29-year-old woman was on leave from her job at
IBM due to extreme depression for over a year and a half. Her insurer, Manulife, refused to continue providing
health coverage for her after an investigation into her claims revealed Facebook photos of her on a beach
vacation, at a bar with friends, and at her birthday party. On the basis of these photos, Manulife determined
that Blanchard was no longer depressed, costing her thousands of dollars in uncovered claims.

Facebookʼs Changing Privacy Policies

Since its founding, Facebook has progressively changed its terms of service to make more information public
by default. The clear tendency has been for Facebook to unilaterally change its default settings for maximum
public access, placing the onus on users to manually change their settings to make them more private. In
December 2009, the company made status updates and lists of friends and interests public by default not just
to fellow Facebook users, but to anyone. These changes can most clearly be understood by viewing this
interactive infographic by Matt McKeon: http://mattmckeon.com/facebook-privacy/

15


unNiche

Just Between Us:
Facebook has defended the changes to its policies by citing evolving norms around general privacy in the
Internet age. The company points out that most users are on the site specifically in order to invade the privacy
of fellow users. Indeed, users routinely request feature modifications that give them greater access to other
usersʼ information. For example, Facebook users have asked that profiles of strangers be made more public so
they can determine if someone is a former classmate. While users want this information about themselves to
be private, they want it to be public for everyone else.

Public awareness of Facebookʼs privacy issues reached a peak with the publication of a Time Magazine article
entitled “How Facebook Is Redefining Privacy” published in May 2010. The article observes that Facebook
usersʼ activity is a highly rich source of marketing data: “The more updates Facebook gets you to share and
the more preferences it entreats you to make public, the more data it's able to pool for advertisers. Google
spearheaded targeted advertisements, but it knows what you're interested in only on the basis of what you
query in its search engine and, if you have a Gmail account, what topics you're e-mailing about. Facebook is
amassing a much more well-rounded picture. And having those Like buttons clicked 100 million times a day
gives the company 100 million more data points to package and sell.”

Facebookʼs privacy settings are highly complex, as is the policy governing those settings. The New York Times
reports that to customize your settings, it is necessary to click through more than 50 privacy buttons, requiring
the user to choose from among a total of more than 170 options. Facebookʼs privacy policy is 5,830 words long
and its privacy-related FAQ adds up to more than 45,000 words.

Facebook Reveals User IDs to Advertisers

Ben Edelman reported that clicking an ad in Facebook transmits the userʼs identity to the advertiser. The
advertiser then has access to nearly all of the userʼs Facebook activity and posting, including status updates,
photos and a list of his or her friends. In a post on an online forum, Facebook employee Steven Grimm
explained that this identity transmission was inadvertent and not a policy of the company. If Facebook wanted
to profit from identifying users to advertisers, Grimm argues, it would do so more transparently and reliably.
Nonetheless, whether or not Facebook intends to reveal usersʼ identities, the fact that it is so easy to extract
this information from usersʼ normal browsing should give pause to those concerned about privacy.

16


unNiche

Just Between Us:
Identity Leaks in Facebook Apps

Facebook applications, or apps, are widely used third-party extensions to the siteʼs basic functionality. Apps
enable users to play games, create family trees, discover former classmates, and shop. The company
estimates that 70% of users use an app in a given month. Apps are crucial to Facebookʼs business model
since they often feature virtual goods for sale.

The Wall Street Journal reported that many popular apps, were transmitting usersʼ names and the names of
their friends to advertising and Internet-tracking companies without usersʼ knowledge. This sharing of
information was not prevented by Facebookʼs strictest privacy settings. “The Journal found that all of the 10
most popular apps on Facebook were transmitting users' IDs to outside companies. The apps, ranked by
research company Inside Network Inc. (based on monthly users), include Zynga Game Network Inc.'s
FarmVille, with 59 million users, and Texas HoldEm Poker and FrontierVille. Three of the top 10 apps, including
FarmVille, also have been transmitting personal information about a user's friends to outside companies …
The information being transmitted is one of Facebook's basic building blocks: the unique 'Facebook ID' number
assigned to every user on the site. Since a Facebook user ID is a public part of any Facebook profile, anyone
can use an ID number to look up a person's name, using a standard Web browser, even if that person has set
all of his or her Facebook information to be private.”

The sharing of this data violated Facebookʼs own rules, and those of the most of the app makers as well.
Nevertheless, if Facebook and the app makers are unable to enforce their rules, it raises questions about the
more than 550,000 third-party apps available overall. It is difficult to imagine that Facebook could prevent data
leaks from all of these apps even with the best intentions. Furthermore, even if a given user has no apps
installed, their app-using friends may inadvertently transmit their ID anyway.

Privacy and the Facebook “Like” Button

Facebook users are able to “Like” one anotherʼs posts. These Likes appear in usersʼ activity streams and on
their profiles. In April 2010, Facebook introduced its Open Graph initiative, which enables any web site to
display a Facebook “Like button”. Within a month after Open Graph's rollout, more than 100,000 sites had
included a Facebook Like button, and this functionality is steadily becoming a ubiquitous presence across the
web. The button shows the number of Facebook users who have clicked it, including the number of the usersʼ
own friends. Facebook is able to perform this function by storing a userʼs credentials in the browser.

17


unNiche

Just Between Us:
The Like button code checks the stored credentials, identifies the user, and adjusts its display accordingly. As
with any of the personal activity recorded by Facebook, users run the risk of this data being sold or misused,
intentionally or not. According to Internet security expert James Brown, it is not necessary for a user to actually
be logged in to Facebook for a site with a Like button to communicate his or her identity. Brown gives the
example of Britainʼs National Health Service website. If a Facebook user visits the NHS site, the fact of the visit
is communicated back to Facebook so that the NHSʼ Like button can display properly.

Facebook, Health Information, and Privacy: The Path of the Blue Eye Project's Research

Our research indicates that people's reluctance to discuss health matters on Facebook is largely due to
concerns over privacy. Figure 3 on page 19 illustrates data generated in a digital media monitoring program
produced by Sysomos and includes information from blogs, traditional media, and forums. The blue line on the
graph shows the number of online conversations mentioning “Facebook” and “privacy” within four words of one
another. The red line shows English-language online conversations mentioning “Facebook,” “privacy” and
“health” within four words of each other.

The graph indicates that concerns regarding Facebook privacy-related issues has grown over the past year-
especially after a Time Magazine article appeared regarding Facebook's privacy issues in May 2010. However,
conversation about privacy, Facebook, and health did not gain intensity during this period.

Our Research: Health Information Sharing Is Not Happening on Facebook

In October 2010, the Path of the Blue Eye Project commissioned a research study of 1,000 Americans of
diverse backgrounds about their patterns of Facebook use and sharing. This survey was conducted by
Wakefield Research, a leading market research firm and has a margin of error of +/- 3%. Overall, this study
indicates that while Facebook use is extremely common, most people are unwilling to share health information
on the social network. Following are some of the most important results of this research:

Overall Facebook Usage

Eighty percent of our respondents reported having used Facebook. The likelihood of a respondent never
having used Facebook at all rather predictably trends upwards with age (see Figure 4 page 20).

18


unNiche

Just Between Us:
Figure 3: Trend Data - Facebook, Health, and Privacy
Conversations on Blogs, Forums, and Other Social Media

19


unNiche

Just Between Us:
Figure 4: Never Used Facebook, by Age

20


unNiche

Just Between Us:
Only Some Are Willing to Share

Only 17% of respondents reported having used Facebook to share personal health or medical information, such
as uploading photos/X-rays or posting status updates about illnesses, medications, doctor visits or other topics.

Twelve percent of respondents answered: “Yes, and I would share this information on Facebook again.” Within
this group, there was significant variation by age. Younger respondents were much more willing to share than
older respondents, which reflects their generally greater openness in online settings (see Figure 5 on page 22).

There was also some variation among racial groups, with whites less likely to report sharing than Hispanic and
black respondents (see Figure 6 on page 23). In addition, religious believers are more than twice as likely to
share than non-believers (see Figure 7 on page 24).

In addition, 54% of respondents answered: “No, and I WILL NEVER share health information on Facebook.”
Women were more likely to respond this way (see Figure 8 on page 25). The percentage of respondents
unwilling to share share health content on Facebook trended generally upwards with the increasing age of the
respondents (see Figure 9 on page 26).

When asked whether they would ever share health information on Facebook, there was not much variation
among the answers from different racial or income groups. Interestingly, however, 24% of repondents with less
than a high school diploma will never share, whereas the percentage for other education levels are all within the
52-56% range. This is somewhat surprising, because a relatively large percentage of this demographic also
said that they would share health information on Facebook.

Reasons for Not Sharing

68% of Facebook users (54% of U.S. adults) declared that they had not and would not share their personal
health information on Facebook. Among non-sharing Facebook users, the reasons given include:

• 86%: “Itʼs no oneʼs business but my own.”
• 39%: “Iʼm afraid strangers would find my health information.”
• 32%: “My health information could be used by marketers.”
• 17%: “Itʼs embarrassing.”
• 11%: “Iʼm concerned my insurance provider would find it.”
• 9%: “It could negatively affect my job.”

21


unNiche

Just Between Us:
Figure 5: Willingness to Share Health Information on Facebook, by Age

22


unNiche

Just Between Us:
Figure 6: Willingness to Share Health Information on Facebook, by Race

23


unNiche

Just Between Us:
Figure 7: Willingness to Share Health Information on Facebook, by Religiosity

24


unNiche

Just Between Us:
Figure 8: Unwillingness to Share Health Information on Facebook, by Gender

25


unNiche

Just Between Us:
Figure 9: Unwillingness to Share Health Information on Facebook, by Age

26


unNiche

Just Between Us:
The response “Itʼs no oneʼs business but my own” was by far the most significant reported consistently by 80%
to 90% of non-sharing respondents across all demographic groups, including age, region, race, religion, sex,
income, household size, and education.

The answer “I'm afraid strangers would find my health information” was also reported quite consistently across
all non-sharing groups, ranging from 30% to 45% of all respondents. There was some variation in this
response geographically, with more concern in the Northeast and on the West coast than in the Midwest and
the South (see Figure 10 on page 28).

There was also significant variation by education level, with higher-educated, non-sharing respondents
significantly more likely to be concerned. The response “My health information could be used by marketers”
accounted for 32% of the total. There was wide variation among age groups (see Figure 11 on page 29).

There was also some variation among non-sharing racial groups, with whites being much more concerned
about marketers using heath content shared on Facebook than non-whites (see Figure 12 on page 30).
Concern about marketing also increased steadily with education level (see Figure 13 on page 31).

A quarter of non-sharing respondents replied “My Facebook friends wouldnʼt find it relevant or interesting."
Respondents without children were more likely to feel this way. Respondents with older children were the least
concerned about their Facebook friendsʼ reactions to their posting health information.

The response “Itʼs embarrassing” only accounted for 17% of responses, perhaps because many of the
previous responses could be construed as implying embarrassment. The youngest non-sharing respondents
were likeliest to report embarrassment as their specific reason for not sharing (see Figure 14 on page 32).
This is presumably because health issues become significantly more commonplac among older populations.

As previously mentioned, surprisingly few respondents (11%) responded with: “Iʼm concerned my insurance
provider would find it.” This is likely because few respondents are aware of the issue. There was little
demographic variation in this response.

There was very significant racial variation in the response “It could negatively affect my job,” with non-sharing
Hispanics expressing the most concern over their employers finding health information they post on Facebook,
versus respondents of other racial and ethnic groups (see Figure 15 on page 33). The response “It would
negatively affect my relationships” showed some age variation, with the largest percentage among the
youngest and oldest respondents (see Figure 16 on page 34).

27


unNiche

Just Between Us:
Figure 10: Concern that Health Information Shared on Facebook
Will Be Found By Strangers, by Geographic Region
(Base: Non-health Content Sharers)

28


unNiche

Just Between Us:
Will Be Used by Marketers, by Age

29


unNiche

Just Between Us:
Will Be Used by Marketers, by Race

30


unNiche

Just Between Us:
Will Be Found By Strangers, by Education

31


unNiche

Just Between Us:
Figure 14: Embarrassment Preventing Facebook Users from Sharing Information, by Age

32


unNiche

Just Between Us:
Figure 15: Fear that Employers Will Find Health Information Shared on Facebook, by Race

33


unNiche

Just Between Us:
Figure 16: Fear that Health Information Shared on
Facebook Will Harm Relationships, by Age

34


unNiche

Just Between Us:
Conclusion

If the Web is to become a truly mainstream resource for health information, privacy concerns must be
addressed. While Facebookʼs sheer size and ubiquity gives it an advantage, our research indicates that it is
not likely to become a major destination for the discussion of health issues. Facebookʼs outspoken aim to
make personal information more public is directly at odds with the needs of online health information seekers
and sharers. There is an opportunity to create an online community with robust privacy protections and a
business model that does not create incentives to sell data. While no Internet security measures will ever be
perfect, an outspoken and consistent commitment to privacy would go a long way toward assuaging the
anxieties of online health searchers and sharers.

35

Facebook, Privacy and Health

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Similar a Facebook, Privacy and Health

Similar a Facebook, Privacy and Health (20)

Más de Enspektos, LLC

Más de Enspektos, LLC (15)

Último

Último (20)

Facebook, Privacy and Health