用户信息共享和医院网站隐私政策。

User Information Sharing and Hospital Website Privacy Policies.

机构信息

Department of Medical Ethics and Health Policy, University of Pennsylvania, Philadelphia.

Leonard Davis Institute of Health Economics, University of Pennsylvania, Philadelphia.

出版信息

JAMA Netw Open. 2024 Apr 1;7(4):e245861. doi: 10.1001/jamanetworkopen.2024.5861.

DOI:10.1001/jamanetworkopen.2024.5861

PMID:38602678

原文链接:https://pmc.ncbi.nlm.nih.gov/articles/PMC11009820/

Abstract

IMPORTANCE

Hospital websites frequently use tracking technologies that transfer user information to third parties. It is not known whether hospital websites include privacy policies that disclose relevant details regarding tracking.

OBJECTIVE

To determine whether hospital websites have accessible privacy policies and whether those policies contain key information related to third-party tracking.

DESIGN, SETTING, AND PARTICIPANTS: In this cross-sectional content analysis of website privacy policies of a nationally representative sample of nonfederal acute care hospitals, hospital websites were first measured to determine whether they included tracking technologies that transferred user information to third parties. Hospital website privacy policies were then identified using standardized searches. Policies were assessed for length and readability. Policy content was analyzed using a data abstraction form. Tracking measurement and privacy policy retrieval and analysis took place from November 2023 to January 2024. The prevalence of privacy policy characteristics was analyzed using standard descriptive statistics.

MAIN OUTCOMES AND MEASURES

The primary study outcome was the availability of a website privacy policy. Secondary outcomes were the length and readability of privacy policies and the inclusion of privacy policy content addressing user information collected by the website, potential uses of user information, third-party recipients of user information, and user rights regarding tracking and information collection.

RESULTS

Of 100 hospital websites, 96 (96.0%; 95% CI, 90.1%-98.9%) transferred user information to third parties. Privacy policies were found on 71 websites (71.0%; 95% CI, 61.6%-79.4%). Policies were a mean length of 2527 words (95% CI, 2058-2997 words) and were written at a mean grade level of 13.7 (95% CI, 13.4-14.1). Among 71 privacy policies, 69 (97.2%; 95% CI, 91.4%-99.5%) addressed types of user information automatically collected by the website, 70 (98.6%; 95% CI, 93.8%-99.9%) addressed how collected information would be used, 66 (93.0%; 95% CI, 85.3%-97.5%) addressed categories of third-party recipients of user information, and 40 (56.3%; 95% CI, 44.5%-67.7%) named specific third-party companies or services receiving user information.

CONCLUSIONS AND RELEVANCE

In this cross-sectional study of hospital website privacy policies, a substantial number of hospital websites did not present users with adequate information about the privacy implications of website use, either because they lacked a privacy policy or had a privacy policy that contained limited content about third-party recipients of user information.

摘要

重要性

医院网站经常使用跟踪技术将用户信息传输给第三方。目前尚不清楚医院网站是否包含披露有关跟踪相关细节的隐私政策。

目的

确定医院网站是否具有可访问的隐私政策，以及这些政策是否包含与第三方跟踪相关的关键信息。

设计、设置和参与者：本研究采用了一种全国代表性的非联邦急性护理医院样本的网站隐私政策的横断面内容分析方法，首先测量医院网站是否包含将用户信息传输给第三方的跟踪技术。然后使用标准化搜索来确定医院网站的隐私政策。评估政策的长度和可读性。使用数据抽象表格分析政策内容。跟踪测量和隐私政策检索以及分析于 2023 年 11 月至 2024 年 1 月进行。使用标准描述性统计分析隐私政策特征的流行率。

主要结果和措施

主要研究结果是网站隐私政策的可用性。次要结果是隐私政策的长度和可读性，以及包含网站收集的用户信息、用户信息的潜在用途、用户信息的第三方接收者以及用户在跟踪和信息收集方面的权利等隐私政策内容。

结果

在 100 家医院网站中，96 家（96.0%；95%置信区间，90.1%-98.9%）将用户信息传输给第三方。71 家网站（71.0%；95%置信区间，61.6%-79.4%）找到了隐私政策。政策的平均长度为 2527 个单词（95%置信区间，2058-2997 个单词），写作平均水平为 13.7 级（95%置信区间，13.4-14.1）。在 71 项隐私政策中，69 项（97.2%；95%置信区间，91.4%-99.5%）解决了网站自动收集的用户信息类型，70 项（98.6%；95%置信区间，93.8%-99.9%）解决了收集的信息将如何使用，66 项（93.0%；95%置信区间，85.3%-97.5%）解决了用户信息第三方接收者的类别，40 项（56.3%；95%置信区间，44.5%-67.7%）命名了接收用户信息的特定第三方公司或服务。