With the support of Benjamin Sonntag, co-founder of the association La Quadrature du Net, French Radio conducted an extensive investigation to try to understand whether Doctolib was fulfilling its promise to “end-to-end encryption of healthcare data” of its users. The results tests were published on May 20, 2022. They show that data encryption is not complete.
The encryption of ” end to end “ is still not a reality on Doctolib
After having exchanged data with Facebook and Outbrain in Germany, in particular the keywords typed by users in the platform’s search engine, Doctolib ensured that the personal data of its users were now end-to-end encrypted. The French startup even obtained a certification a few months ago which attests to the security of users’ health data. However, a recent survey by French Radio performed with La Quadrature du Net shows that data encryption is not complete.
Elon Musk meets Brazilian President Jair Bolsonaro to discuss satellites
In a press release published recently, Doctolib nevertheless guaranteed that “This technology makes it strictly impossible for any other person to access this data, including in support or maintenance operations”. This is not what the tests carried out by the public radio show. Investigators found that information regarding the user’s past and upcoming medical appointments was still accessible ” clear “, unencrypted. That’s not all, some Doctolib employees have access to the health data of users of the service.
A malicious employee could misappropriate the data
French Radio specifies that this is particularly the case backup managers, system administrators, and all other people who manage the network and servers. Among the accessible information, we find the first and last names of the patient, the date of the appointment, the name and specialty of the doctor consulted and even the reason for the consultation. The investigation cell nevertheless specifies that the attachments exchanged between the patient and his doctor are well protected.
Doctolib acknowledged the flaw by specifying that a number “very few employees have access to medical appointments, at specific times and for specific reasons, within the framework of support functions”. The platform ensures that if appointment data is not end-to-end encrypted, it’s because “this would prevent the usefulness and proper functioning of the service”. For example, users could not receive their appointment reminder by e-mail or text message. La Quadrature du Net makes it clear that this situation is not illegal. However, it is risky. A malicious employee could divert the data or transmit it to a third party.