New privacy concerns over health care website

Washington — The government’s health insurance website is quietly sending consumers’ personal data to private companies that specialize in advertising and analyzing Internet data for performance and marketing, the Associated Press has learned.

The scope of what is disclosed or how it might be used was not immediately clear, but it can include age, income, ZIP code, whether a person smokes, and if a person is pregnant. It can include a computer’s Internet address, which can identify a person’s name or address when combined with other information collected by sophisticated online marketing or advertising firms.

The Obama administration says HealthCare.gov’s connections to data firms were intended to help improve the consumer experience. Officials said outside firms are barred from using the data to further their own business interests.

There is no evidence that personal information has been misused. But connections to dozens of third-party tech firms were documented by technology experts who analyzed HealthCare.gov and then confirmed by AP. A handful of the companies were also collecting highly specific information.

A leading lawmaker on Tuesday asked the administration to explain how it oversees the data firms to make sure no personally identifiable information is improperly used or shared.

“This new information is extremely concerning, not only because it violates the privacy of millions of Americans, but because it may potentially compromise their security,” Sen. Orrin Hatch, R-Utah, wrote to the administration.

Created under the president’s health care law, HealthCare.gov is the online gateway to government-subsidized private insurance for people who lack coverage on the job. It serves consumers in 37 states, while the remaining states operate their own insurance markets.

A former White House chief information officer, Theresa Payton, said third-party vendors are a weak link on any website. She questioned both the number of vendors on HealthCare.gov and the specific details some of them are collecting.

“You don’t need all of that data to do customer service,” said Payton, who served under President George W. Bush.