Data Scraping and How This Impacts Your Online Presence

By Luke Matthew Martin, MBA, JD
CAMFT Staff Attorney

Have you “Googled” yourself lately? If you have not, you may be surprised to find that your personal or business information is likely being listed on a website called CareDash. Created in 2016, CareDash advertises itself as “one the world's leading providers of doctor, dentist, therapist, and hospital reviews.” CareDash appears to be a “Yelp” for healthcare providers – a consumer healthcare directory and review site, but it also allows consumers to make appointments with their own participating providers and other providers contracted through their partners, such as Betterhelp.

Data Scraping
How does CareDash obtain providers’ information? CareDash obtains the data on your profile from public websites. This tactic is called data scraping. Data scraping is a technique in which a computer program extracts data from human-readable output coming from another program. Simplified, a computer program searches public websites, sorts the information that is already out there, and then compiles it neatly onto a website. Unlike other websites, CareDash does not scrape any review or rating data from other sites; meaning that it won’t pull a negative review from Yelp or Google to their website.

Web scraping is legal if you scrape data publicly available on the internet. In late 2019, the US Court of Appeals heard hiQ Labs v. Linkedin, 938 F.3d 985, and denied LinkedIn’s request to prevent hiQ, an analytics company, from scraping its data. The U.S. 9th Circuit Court of Appeals ruled (Appeal from the United States District Court for the Northern District of California) that web scraping public sites does not violate the CFAA (Computer Fraud and Abuse Act). The 9th Circuit affirmed the district court's preliminary injunction, preventing LinkedIn from denying the plaintiff, hiQ Labs, from accessing LinkedIn’s publicly available LinkedIn member profiles. The decision does not grant data scrapers the freedom to obtain data from sites that require authentication. Any data that is publicly available and not copyrighted is fair game for data scrapers and for companies like CareDash to harness.

According to CareDash, they obtain information about providers from various public resources, including the NPI Registry, which is governed by the Centers for Medicare and Medicaid Services (CMS).” In September 2007, CMS began disclosing NPPES health care provider data that are disclosable under the Freedom of Information Act (FOIA) to the public. In accordance with the e-FOIA Amendments, CMS has disclosed this data via the Internet in two forms: NPI Registry and NPI Downloadable file. Only the FOIA data related to the selected record is viewable. This makes the data that is posted on the NPI Registry publicly available.

Concerning Practices
CAMFT is aware of the following main concerns members have expressed about CareDash and our Legal Team is carefully reviewing these issues:

Inaccurate/Incorrect Information
CAMFT is made aware that there is inaccurate information posted about providers and their specialties/businesses. If your information listed on the CareDash website is incorrect it is most likely because another public source is sharing that information incorrectly. If upon reviewing your profile you find incorrect information, CareDash indicates that the provider can claim their profile and make edits and updates themselves.³ However, providers who are not interested in doing so are recommended to contact CareDash and inform them of the inaccurate information which needs to be immediately corrected/removed: https://www.webcontactus.com/caredash/, and document the attempt to correct the misinformation.

Another option is to update the public websites from which CareDash does data scraping. CareDash does a new scraping about every two weeks, so the current data will be updated with any newly updated data (such as changing the information on the NPPES NPI Registry).⁴ It is recommended that therapists who know their licensure/practice information is being shared incorrectly to make good faith attempts to correct the misinformation, if possible.⁵

Providers’ Home Address
CareDash may list a provider’s home address if the home address is being listed on other public sources, such as the NPPES NPI Registry. CAMFT recommends therapists review public directories, such as the NPPES NPI Registry, managed care directories, and the Board of Behavioral Science public listings to make sure their home address is not listed. And if so, you may want to change that to an office address, or a P.O. Box if permitted by the source.

Redirecting Consumers to BetterHelp/Other Platforms
In addition to posting public information CareDash finds online, CAMFT has been made aware of CareDash’s business practice of redirecting consumers to providers contracted with BetterHelp and other online therapy programs that CareDash partners with, as well as their participating providers. If a therapist has not accepted their profile and updated their availability on CareDash’s site, the prospective client is prompted with a message that the therapist has not provided a way to schedule online through CareDash and is offered the ability to schedule with one of their online therapists or to chat with a virtual assistant.

Not only do these above-mentioned practices have the potential to confuse consumers who are seeking much-needed therapy services, but they also raise other concerns such as potential misleading advertising and possible deceptive business practices. Inaccurate information listed on CareDash’s site about providers and their services may negatively impact providers’ businesses, as well as consumers’ access to mental health care. Unfortunately, this area of law is quite in flux, and it is currently unclear if such practices comply fully with state and federal law. CAMFT’s Legal Team is carefully reviewing these issues, and our initial step is to send a letter to CareDash to address these concerns. We will keep members apprised of our efforts in advocating for our members and consumers’ access to mental health care.

In the interim, members may also contact the Federal Trade Commission (FTC), the State of California’s Attorney General’s Office, and/or the Better Business Bureau with their concerns:

• The FTC enforces federal competition and consumer protection laws that prevent anticompetitive, deceptive, and unfair business practices. The FTC’s complaint form can be found here https://reportfraud.ftc.gov/#/.
   
• Members may also contact the California Attorney General’s Office to report a complaint about a business or if you have questions or comments at https://oag.ca.gov/contact/consumer-complaint-against-business-or-company.
   
• Members may complain to the Better Business Bureau. It does appear that CareDash is actively engaging with individuals filing complaints on the Better Business Bureau’s website and are working on finding satisfactory resolutions. Providers may reach out to the Better Business Bureau directly at: https://www.bbb.org/us/ma/cambridge/profile/health-care-referral/caredash-0021- 439041/complaints.

Additional Recommendations
The following are some of our recommendations on dealing with CareDash and other directory/review sites:

• CareDash is recommending providers to take claim of their profiles and make changes. Some providers have done so, and it is up to each provider individually if they choose to do so. For more information, see: https://www.caredash.com/portal. However, providers who are not interested in doing this are recommended to contact CareDash and inform them of the inaccurate information which needs to be immediately corrected/removed at: https://www.webcontactus.com/caredash/.
   
• Providers can update their information on the NPI Registry (https://nppes.cms.hhs.gov/#/) to remove/update the public data that is provided on the CareDash website. There is likely a 2-week turnaround before the new data on the NPI Registry updates on CareDash’s site. Check other public sources to ensure home address or inaccurate information is not listed and make changes accordingly.
   
• Providers concerned about CareDash selling their 3rd party data can reach out to CareDash directly under California’s “Shine the Light Law.” While CareDash claims not to sell 3rd party data, Therapists in California are entitled to verify this information as accurate. California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits consumers who are California residents, to request and obtain from CareDash once a year, free of charge, information about the categories of personal information (as defined in the Shine the Light law), if any, that CareDash disclosed in the preceding calendar year to third parties for those third parties’ direct marketing purposes. CareDash disclosure requirements apply only if CareDash shares consumers’ personal information with third parties for them to directly market their own products to those consumers. Providers can obtain this by sending a formal request utilizing their “Contact Us” form, which is linked here: https://www.caredash.com/contact- us.
  
  
• Review CAMFT’s article entitled You, Yelp, and Social Media by Alain Montgomery. The original thesis dealt with Yelp, but it’s equally applicable here:https://www.camft.org/Resources/Legal-Articles/Chronological-Article-List/you- yelp-and-social-media

¹ https://www.linkedin.com/company/caredash/
² https://www.caredash.com/faq
³ According to CareDash, “[i]t's free and very easy, they just need to claim their profile and update the incorrect data.”
⁴ https://www.bbb.org/us/ma/cambridge/profile/health-care-referral/caredash-0021-439041/complaints
⁵ Business and Professions Code §651 states that it is unlawful to disseminate or cause to be disseminated any form of public communication containing a false, fraudulent, misleading, or deceptive statement.