They don't even get into the repercussions of loading externally-hosted JavaScript into a secure page.<p>We avoid this entirely (also hosting medical data), though it's been a bit of extra work to do so.<p>I'm sure Chartbeat, Mathtag, Mixpanel, Google, etc. are reasonably careful about their security, and of course they would suffer as well if one of the servers/scripts was compromised and the breach was made public.<p>But in short -- healthcare.org's security <i>relies</i> on the idea that <i>none</i> of these many 3rd parties will ever have a CDN server compromised, for example. Or (in other situations) have the NSA demand access.<p>It just takes one -- and then an "improved" script could be delivered to only clients visiting a single targeted site, or even specific targeted clients. The normal customer just sees the lock icon and can verify that there's a secure connection to the main host; but there are actually many other connections going on to other hosts, and any of them may provide a script that can access any sensitive data on the page.