How Data Brokers Make Money Off Your Medical Records

Data brokers legally buy, sell and trade health information, but the practice risks undermining public confidence

For decades researchers have run longitudinal studies to gain new insights into health and illness. By regularly recording information about the same individuals' medical history and care over many years, they have, for example, shown that lead from peeling paint damages children's brains and bodies and have demonstrated that high blood pressure and cholesterol levels contribute to heart disease and stroke. To this day, some of the original (and now at least 95-year-old) participants in the famous Framingham Heart Study, which began in 1948, still provide health information to study investigators.

Health researchers are not the only ones, however, who collect and analyze medical data over long periods. A growing number of companies specialize in gathering longitudinal information from hundreds of millions of hospitals' and doctors' records, as well as from prescription and insurance claims and laboratory tests. Pooling all these data turns them into a valuable commodity. Other businesses are willing to pay for the insights that they can glean from such collections to guide their investments in the pharmaceutical industry, for example, or more precisely tailor an advertising campaign promoting a new drug.

By law, the identities of everyone found in these commercial databases are supposed to be kept secret. Indeed, the organizations that sell medical information to data-mining companies strip their records of Social Security numbers, names and detailed addresses to protect people's privacy. But the data brokers also add unique numbers to the records they collect that allow them to match disparate pieces of information to the same individual—even if they do not know that person's name. This matching of information makes the overall collection more valuable, but as data-mining technology becomes ubiquitous, it also makes it easier to learn a previously anonymous individual's identity...