Yet there’s some medical information that Acurian doesn’t have to guess about: The company pays Walgreens, which uses a privacy exemption for research, to send recruitment letters to its pharmacy customers on Acurian’s behalf, based on the medications they’re using. Under this arrangement, Acurian notes that it doesn’t access the medical information directly; the customers’ identities remain private until they respond to the invitations.
And that is not the entire story. An investigation by the Special Projects Desk has found that Acurian may also be pursuing people’s medical information more directly, using the services of a startup that advertises its ability to unmask anonymous website visitors. This could allow it harvest the identities of people seeking information about particular conditions online, before they’ve consented to anything.