Marco Huesch, a researcher at the University of Southern California, Los Angeles, searched for "depression", "herpes" and "cancer" on various health-related websites and observed that the data was being tracked.
"Confidentiality is threatened by the leakage of information to third parties" through trackers on the websites themselves or on consumers' computers, he wrote in the Journal of the American Medical Association.
Should someone living with depression, herpes or cancer research the condition online, as an increasing number of patients are doing, Asian college of knowledge management the search terms might not remain private, Huesch said.
Disclosure of any conditions could result not only in embarrassment but also job discrimination, he added.
The scientist used freeware privacy tools DoNotTrackMe and Ghostery to detect third party entities on the websites he browsed, and commercial software called Charles, to intercept any transmission of the information he generated to third parties.
Of what he called a "convenience sample" of 20 high-traffic sites, which include the official pages of the National Institutes of Health and the Food and Drug Administration as well as WebMD and Weight Watchers, Set up Business in Hong Kong all had at least one third-party entity, and six or seven on average, he said.
Thirteen out of 20 websites contained third-party elements that tracked user data, said Huesch, highlighting the role of social media plug-ins, storage cabinet which appeared on five of those 13 sites.
Plug-ins such as the Facebook "Like" button allow for "tracking on websites even if the online user is not logged into social media" and "the user does not actually press the social button", he said.
Seven of the 13 websites in question leaked Huesch's searches to tracking entities.
Huesch says the risk of personal or professional embarrassment could "reduce the willingness of some people to access health-related information online".