In this study we analyzed content and marketing tactics of digital medicine companies to evaluate various types of cross site tracking middleware used to extract health information from users without permission. More specifically we examine how browsing data can be exchanged between digital medicine companies and Facebook for advertising and lead generation purposes. The analysis was focused on a small ecosystem of companies offering services to patients within the cancer community that frequently engage on social media. Some companies in our content analysis may fit the legal definition of a personal health record vendor covered by the Federal Trade Commission, others are HIPAA covered entities. The findings of our analysis raise policy questions about what constitutes a breach under the Federal trade Commission's Health Breach Notification Rule. Several examples demonstrate serious problems with inconsistent privacy practices and reveal how digital medicine dark patterns may elicit unauthorized data from patients and companies serving ads. Further we discuss how these common marketing practices enable surveillance and targeting of medical ads to vulnerable patient populations, which may not be apparent to the companies targeting ads.

翻译：在这项研究中,我们分析了数字医药公司的内容和营销策略,以评价各种跨站点跟踪用于在未经许可的情况下从用户获取健康信息的中间软件,更具体地说,我们研究了数字医药公司与脸书之间如何为广告和铅生成目的交换浏览数据;分析的重点是向癌症社区内经常使用社交媒体的病人提供服务的公司的一个小生态系统;我们进行的内容分析中的一些公司可能符合联邦贸易委员会所覆盖的个人健康记录供应商的法律定义,另一些公司是HIPAA所覆盖的实体;我们的分析结论提出了根据联邦贸易委员会《健康损害通知规则》构成违约的政策问题;几个例子表明隐私做法不一致的严重问题,并揭示数字医学黑暗模式如何引起病人和提供广告的公司未经授权的数据;我们进一步讨论这些共同的营销做法如何使得对弱势病人进行监控和指定医疗广告对象,而针对广告的这些公司可能并不明显。