When I said triggered by my google searches, I mean the sites I clicked on were able to correlate to my personal details that got collected somewhere else, not that google sold my details. The thing that makes me suspect the doctor or pharmacy, though, is that I've done that sort of search in the past, but I didn't start getting the pill mill calls until I got that prescription.

Read the documents doctors have you sign very carefully.

They often include a waiver that allows them to share your PHI with whomever they want.

You're under no obligation to allow them to do so.

Sometimes it's mere proximity. If your family or friends find you have condition X or treatment Y then they may look it up to find more.

If you share the same public IP, as most homes do then that adds to it.

I started getting invitations to add a Google review to a restaurant I've never been too. But some of my family had.

I can figure out other stuff too - music tastes, social media trends, etc. Just by seeing ads and stories I'm offered on Google News and other places.

There's that famous story about a guy who discovered his daughter pregnant (or feared she was pregnant) a few years back because he started getting ads for baby clothes.

The source of the information could also be a rogue employee at any of those places, especially for something shady, like robocalls.

In most places, it is not difficult for an employee, especially someone like a sysadmin or a DBA, to simply siphon the data into a CSV. Chances are that no one will ever figure it out.

I think that once law enforcement catches up, slow as they always are, they will start creating honeypot identities and then tracing the information leaks to their source. For now, there is little to be afraid of for the leakers.

The FANG company I work for has stringent controls in place as a check against employees attempting to do this. These controls are more comprehensive than those I've seen at other companies.

I'm assuming it's not the doctor or pharmacist, as that would be a severe breach of HIPAA, I believe. But maybe that is happening...