An Analysis of Web Site Privacy Policy Evolution in the Presence of HIPAA

The U.S. department of Health and Human Services’ (HHS) Privacy Rule requires healthcare institutions to notify their customers about the institution’s privacy practices. Privacy practices are typically posted online in the form of privacy policy documents. We investigate the online privacy practices of three categories of healthcare Web sites –– pharmaceuticals, health insurance companies and online drugstores –– and present our analysis of 24 online privacy documents from nine institutions. Our study provides a unique perspective on the state of privacy practices before and after HIPAA’s enactment, by comparing our current results to our pre-HIPAA (Health Insurance Portability and Accountability Act) study of these same institutions’ privacy practices. We discuss how HIPAA’s introduction has resulted in more descriptive and detailed privacy policies but has not necessarily improved the online privacy practices of these organizations. The results of this analysis may be helpful for forecasting how future legislation will affect the state of online privacy in other domains.