Privacy and Security of Digital Health Data

Electronic health records including those from hospitals, GPs, pharmacies, and dentists.
Fitness devices and wearables such as Fitbit and connected scales along with their associated apps.
Health insurance providers and other dedicated health applications.
Online pharmacy and retail accounts, including entities like Chemist Warehouse.
Online search history, social media activity, and store loyalty cards (e.g., Clubcard).
DNA and ancestry services, including 23andMe and Ancestry.com.

Risks include data breaches, leaks, and the normalization of surveillance.
Commercial risks involve the on-selling of data and potential discrimination by insurers and employers.
There is a risk of overstating data accuracy, such as ovulation predictions in period tracking apps.
Notable incidents include the 2021 Waikato DHB cybersecurity attack, which resulted in stolen patient data being released on the dark web and the cessation of various hospital services.

Regulates how agencies like pharmacists, doctors, insurers, and the Ministry of Health collect and disclose health information.
Rule 5 of the Code mandates "reasonable security safeguards" to protect information from loss, unauthorized access, or disclosure.
Required security areas include:
- Electronic security: Email usage, passwords, and portable storage.
- Operational security: Staff training, confidentiality agreements, and document tracking.
- Physical security: Entry controls and the positioning of equipment.

Defined by Zuboff (2019) as the claiming of human experience as raw material for translation into behavioural data.
Personal experiences are scraped and packaged into prediction products sold to advertisers.
These products are used to nudge, coax, tune, and herd behaviour toward profitable outcomes.
Historical examples include Target using loyalty card data and shopping habits to predict customer pregnancies.

Factors affecting users include feelings of empowerment, anxiety regarding hormonal fluctuations, and a desire for data to counter medical gaslighting.
Data risk perceptions range from resignation and indifference to significant concern over the lack of control or rangatiratanga (sovereignty).
The overturning of Roe v. Wade raised significant privacy questions regarding the use of period app data by law enforcement.

A wāhine Māori participant expressed concern regarding mana motuhake of her body and the lack of full control or rangatiratanga over provided data, especially regarding overseas politics affecting Aotearoa.
Some users express resignation, viewing the lack of privacy as the price paid for using the app.
One user noted that despite knowing about data-sharing practices (e.g., by the app Flo), they felt such practices were near unavoidable.
Conversely, some users find the data gives them a sense of control and helps them understand biological cycles that were previously stigmatized or poorly understood.