As someone who works in a startup in the healthcare space, I will point out that nobody lets health startups off the hook for HIPAA. You don’t get to be sloppy with people’s protected health information just because it makes your life easier.
I don't see a comparison between what people *willingly post online to public forums compared to their personal health ledger
The thing is that none of those "anonymized" subjects would have ever been asked for consent if they really knew about the consequences.
Such behavior has really, really bad real world implications: When I got a knee operated one of the questions on the questionaire you need to fill is if you agree that your data can be shared in anonymous form for research. At that point (and given that this was a fairly benign condition) I didn't see a problem with consenting.
After that revelation about what Facebook was up to my answer in the future is a clear NO!
Facebook handling medical data. What could ever go wrong with that?
[1] https://www.cnbc.com/2018/04/05/facebook-building-8-explored...