I once worked in a charity providing mental health services to people without insurance, or who wanted to not have their insurance record the service for whatever reasons.

I once had a homeless man that I would see regularly. We set up each appointment at the end of the preceding appointment, because the only other way to get a hold of this person would be to call the fast food place he worked at, during his work hours, which weren’t consistent. This man did not own a phone, or any other electronic device. His facebook, and all of his online activity was done at his local library. I emphasize this because I need it to be stressed that there was no way any algorithm could connect his location to mine. There was no way for a system to recognize that his device was near mine, because he did not have a device. There was no way for any of his online habits to be algorithmically connected to mine, at all.

One session, we’re speaking. The only devices in our small, sound proofed room, were my cell phone, a digital clock not connected to any system, and a digital camera, turned off, and also not connected to any system. He mentions that he’s been contacted by someone who wants him to move to the Phillipines. We briefly discuss flights and work in the Phillipines. Then we move on to other things, yadda yadda, end session.

By the end of the day, I’m getting ads on Facebook for flights to the Phillipines. Freaked me the fuck out because those sessions are HIPAA protected. From then on I kept my phone turned off, and in a completely different room in our building than any of my sessions with any patient. Never ever had it happen again.