South Florida Sun-Sentinel Palm Beach (Sunday)
Spam calls a growing problem for some vaccine seekers
Companies providing results may have shared personal info
As Floridians signed up for texts of their COVID test results or frantically created pharmacy accounts to find a vaccine, they gave away their phone numbers and unwittingly contributed to a growing problem — spam calls.
The companies providing COVID testing and vaccines may have shared recipients’ cellphone numbers and other limited personal information with third parties and subcontractors for marketing purposes, all with the patient’s consent.
“Non-health providers should be providing the consumer with some sort of notice as to how their information is going to be used,” said Bill Dillon, a health care and data privacy attorney with Gunster law firm. “They may be doing that, but people click a box
and they don’t read it.”
No one knows for certain how spammers get their phone lists, but they do know robocalls are rising as more people are putting their contact information into COVID-related sign-up forms such as vaccine registration, dose locator apps, or test result notification systems.
Retail chains such as CVS Health Corp., Walmart Inc. and Walgreens have acknowledged they are collecting personal information about customers who create online profiles in order to get their vaccine. The Walgreens registration form, for example, indicates the company will share “non-identifiable or aggregate information with third parties for lawful purposes.”
Publix Supermarkets spokesperson Maria Brous would not say how the chain uses the customer information it collects. The Publix registration form, however, requires each person to agree to allow Publix to deliver calls via mobile phone for purposes related to treatment or “for telemarketing and advertising care alternatives and other benefits, products, and services that may be of interest.” That individual also consents that they understand texts and push notifications are not secure.
The Electronic Privacy Information Center is calling on states to investigate major pharmacy chains’ handling of the personal information they are collecting during vaccination registration.
“Patients should not have to trade unrestricted use of their personal information for a life-saving vaccine,” said Sara Geoghegan with the Electronic Privacy Information Center.
On April 2, the Centers for Disease Control & Prevention addressed the growing concern over how details about vaccine recipients were safeguarded. The new CDC guidelines say providers are prohibited from using any data gathered from the COVID -19 Vaccination Program for commercial marketing purposes.
Yvonne Gamble, a spokeswoman for the Office of Inspector General for Health and Human Services, said at the beginning of the COVID19 vaccine rollout, their office received complaints regarding companies potentially sharing data about people who received the shots.
Consumer watchdogs and privacy experts fear bad actors already have seized on the availability of phone numbers to inundate Floridians with spam calls.
Adriane Rosen of Davie said the robocalls started after she signed up to get COVID test results by text.
“I’ve always had some, but now every call is spam,” said Rosen, 48, of Fort Lauderdale. “It makes me wonder what’s going on.”
Florida is one of the top five most spam-called states per capita, according to RoboKiller.com, a telemarketing blocking service.
“People already were giving their numbers out for a lot of things, but with COVID they are doing it more,” said Giulia Porter, vice president at RoboKiller.
Spam calls are up
Spammers have kicked into full gear again in Florida, making more than 425 million calls in March, according to the anti-spam call company YouMail, a big jump from about 316 million the same month last year. In the first three months of 2021, the number of spam calls per person each month rose from 16 to 18 to 20.
AARP, aware of the increase, has issued numerous warnings with ways to guard against rip-offs from COVID-related robocalls.
Zayne Smith, an AARP associate state director, says too many companies now have access to our cellphone numbers, making it easier for robocallers to prey on the elderly in Florida.
“I don’t know what the guarantee was when people provided their information,” she said. “Not all of these are government sign-ups. Some went through private entities. I do know we saw an uptick once vaccines became available.”
AARP supports a bill (HB 1307) by Florida Rep. Mike Beltran, R-Lithia, who says he is fed up with the flood of spam calls to Floridians. His bill would limit telemarketing calls without consent and curb automated telephone solicitation.
Beltran said he was not aware COVID tests or vaccine sign-ups could be driving the robocalls and would be angry to find out that contact information provided on health forms was accessed or sold.
“Could that information have been put in the public domain when it shouldn’t have?” he said. “If they harvested those records for telemarketing purposes I have a real problem with it, and that’s something that should be addressed.”
Retailers and your personal information
Under a federal law known as HIPAA, hospitals, health plans, labs and pharmacies cannot share personal health information, including phone numbers, for marketing purposes without the patient’s approval. But if you give written authorization — whether or not you realize what you have consented to — it can be legal for the provider to share your information.
The federal law does not apply to many companies assisting with COVID testing and vaccine distribution. These companies include the creators of apps to find vaccines or provide test results, as well as retail pharmacy marketing subcontractors.
“There is no law that clearly and reliably protects the personal information that health departments, pharmacies, and others collect from consumers for COVID testing and vaccines,” said Jessica Rich, a privacy lawyer and Georgetown law professor. “The main US health law (HIPAA) is full of gaps that leave this data unprotected.”
Rich, former director of the FTC’s Bureau of Consumer Protection, says sometimes the disclosure is right there, detailing how your contact information is being used, but people skim over it. She points to an example on the main CVS website: “To the extent permitted by applicable law, we may provide personal information to our affiliated businesses or to our business partners, who may use it to send you marketing and other communications.”
Chains such as CVS and Walgreens admit that, as people sign up for vaccines, they are collecting information to better understand and market to their customers.
“Every one of these customers is coming through our digital front end, so we have their email, we have their text message, and we have the ability to communicate with them regularly,”
Jonathan Roberts, CVS’ chief operating officer, told the Wall Street Journal.
When asked by the South Florida Sun Sentinel whether CVS would share any information collected from Floridians during the vaccine registration process with outside vendors or telemarketers, spokeswoman Tara Burke said only, “We do not use information collected during the vaccination registration process to market non-health related products and services.” She would not specifically address CVS sharing the information with vendors or subcontractors.
Privacy groups are pushing back at the apparent privacy loopholes.
Whether there has been a direct breach of privacy from COVID testing and vaccine sign-up is hard to determine, said Geoghegan with the Electronic Privacy Information Center, but she doesn’t like that it could be happening.
“The fact that people are questioning, and thinking there might be, is a reason why it’s not good for pharmacies to be using personal data for commercial uses,” she said. “People gave their data for good reasons, and now they have to be worried about getting spam calls.”
The law can be tricky
Many companies have built apps or search engines to help deliver COVID test results or find leftover vaccines — opening the door for tech companies to potentially share cellphone numbers.
“If it’s a random app, who knows what they are doing with the information,” said Michelle Mellow, a Stanford professor of law and medicine.
Labs such as Curative and Quest, which process COVID tests, said they do not sell patients’ phone numbers but they do turn them over to Florida health officials for contact tracing. The state hires outside vendors to deliver lab results or make contact tracing calls — and some of those vendors hire their own subcontractors. At any point, phone numbers could have made it into the hands of telemarketers.
Florida Department of Health spokesman Jason Mahon said contractors must comply with the state’s data security procedures and policies, but did not provide a copy of the security policy to the South Florida Sun Sentinel for review.
“I don’t know what the state requires, but Florida should have something in place with third parties that tells them what they can and can’t do with the information,” said Dillon, the health care lawyer.
The state’s largest contact tracing and testing notification app provider, Twenty Labs based in Miami, recognizes the significant access it has to Floridians’ personal information. The company delivered COVID test results electronically to nearly 7 million Floridians who signed up for the Healthy Together app on their phones. It also provided contact tracing to 1.7 million Floridians through its smartphone app.
The company says it discloses how it uses information, including phone numbers, at the time people sign up.
CEO Jared Allgood said the company policy gives the app access to the user’s profile information and contact list, but it details with whom it shares that information and requires consent.
“We will never sell data or information about users,” Allgood said. “We, as a company, have no interest in generating revenue by selling information. It is not our model. I cannot speak, though, for other mobile apps.”
Dillon said Floridians need to be diligent when they sign up for vaccines or test results online.
“If you are putting your phone number out there, consider how your information is going to be used and whether you should be giving them permission — before you are exposed to robocalls.”