American's mental health data is up for sale, and it's pretty easy to get.

From American public media, this is Marketplace Tech.

I'm Megan McCarty-Karino.

Digital tools like virtual therapy and meditation apps have made mental health care more accessible,

but they've also made data about the people using them more accessible too.

That's what Joanne Kim, an undergraduate student at Duke University, found in a report

published earlier this year.

She identified 11 firms willing to sell her highly sensitive health data.

We spoke with Justin Sherman, a senior fellow at Duke School of Public Policy, who helped

oversee the study.

He told us how this data ends up on the market.

Most of us, we might use a website or an app to make an appointment with a therapist

or to go to an urgent clinic if we have a sore throat, for example.

The reality, unfortunately, is that a lot of that health data is not protected, so HIPAA,

which people refer to as the US Health Privacy Law.

It's almost 30 years old, and a lot of these technologies that are around today were

not in existence back then or were not as prevalent back then.

So what happens is that there are some entities covered by HIPAA, like an emergency room.

If you go in with something, they can't tweet it out.

They can't go sell it on the street corner.

But there are plenty of apps of data brokers, of social media companies, of ad tech firms,

who are not covered.

...