> They are almost never intentional.
Somebody had to specifically code the application to concatenate into the string:
> smoker=1&parent=&pregnant=1&mec=&zip=85601&state=AZ&income=35000
Somebody had to specifically code the application to concatenate into the string:
> smoker=1&parent=&pregnant=1&mec=&zip=85601&state=AZ&income=35000
https://4037109.fls.doubleclick.net/activityi;src=4037109;ty...?
Unfortunately, a quick Google search doesn't explain what the oref parameter does but from the name I'm assuming it's something like "original referrer".
You don't need malice to explain this – it's entirely plausible to imagine that some people wanted to track user activities and they had a staggering lapse in HIPAA auditing due to the rush of getting the site out and stabilized.
I agree that there's no evidence, at least not yet, of malicious intent. But remember that the "rush of getting the site out" took place back in 2012-2013, with a launch in 2013. It's 2015 now.
(probably not)
The only reason this is particularly newsworthy is that it's a .gov service connected to a contentious political issue – I mean, my health insurance company uses the same DoubleClick tracking service and I doubt I could even get a reporter to call me back if I tried to peddle some conspiracy theory about it.
Considering they spent 1.7 billion on the site, I simply cannot believe that they were so unorganised and lazy on their testing that they couldn't find this. Otherwise I don't know what to think anymore.
I think the $1.7 billion figure comes from this OIG report http://oig.hhs.gov/oei/reports/oei-03-14-00231.pdf
However, the OIG report has a number of important caveats:
* The list of 60 contracts in the report includes contracts to support state websites and for programs unrelated to the website (for instance, I found an $85 million contract related to accountable care organizations, which doesn't seem to have any connection to the website).
* The $1.7 billion is not the amount expended, it's the estimated value at the time the contract was awarded if all the options are exercised. When you look at the individual contracts, this estimated value turns out not to be very useful. Some contracts had double the estimated expenditure, some had $0 expended. Looking at the total amount expended, you get a figure of $500 million.
So I think it's more reasonable to say that they spent $500 million on various projects to implement the law, including both the user-facing website and all the behind-the-scenes stuff.
https://www.healthcare.gov/see-plans/85601/results/?county=04019&age=40&smoker=1&parent=&pregnant=1&mec=&zip=85601&state=AZ&income=35000&step=4
There's plenty to be legitimately upset about here, but your comment ("specifically code the application to concatenate") seems to imply the code has something outrageous like "&pregant="+currentUser.pregnant+"&smoker="+currentUser.smoker somewhere, without you giving any evidence that's the case.
Putting sensitive data into query strings has been considered bad practice for a very long time. To name just one problem among many, it goes into the browser history.
This doesn't excuse them, but it's interesting to consider that probably tens of thousands of sensitive Google, etc. searches per day go into query strings. I guess the difference is that Google doesn't know if your freeform search is sensitive, whereas a "Pregnant?" checkbox is known to be sensitive. But maybe general search engines should not be using query strings either, just in case.
Then there's the issue of public computers, which people signing up for Obamacare may well be more likely to use (I don't know that for a fact, but it seems plausible... I know in my area they've had workshops where you come in and someone helps you sign up using a public machine).
It suggests that this data was surfaced accidentally and DoubleClick may not have been interpreting the actual parameters. Either way, it is horrible - there shouldn't be any ad networks or third-party requests within a domain scope that is handling health data.
"when I bookmark the search page or email the link the search results reset - we need to be able to link to a results page" and wa-la.
Voilà = Literally 'See' + 'There' in French
Only Americans seem to confuse these two words.
> Only Americans seem to confuse these two words.
Other seemingly American conventions include saying: 'would of', 'could of', 'for all intensive purposes', 'I could care less', and plenty more. I travel to the US a couple times every month and notice things like this!
All of your examples are examples of words and phrases that people have primarily heard (rather than read), and thus they spell them incorrectly. People who have read these phrases repeatedly are less like to make these mistakes of spelling.
Incase you didn't notice, I wasn't spelling any word - just phonetic punctuation which is common in online chat.
These query parameters in particular are not search terms, they are PHI you enter to determine the rates you will pay for health insurance. They are basically all the key parameters besides the age of household members which determine the price you will pay for a given insurance plan.