Given that these requests are using HTTPS (not that a non-secure POST is any better than a non-secure GET in that regard), could you give some other issues aside from the browser history issue?
Query parameters are public data. They are sent along with every single request from your browser to 3rd parties which is launched from the page! Analytics, image downloads, click-throughs, everything. I think browser history and server logs are actually the lesser evil here.
These query parameters in particular are not search terms, they are PHI you enter to determine the rates you will pay for health insurance. They are basically all the key parameters besides the age of household members which determine the price you will pay for a given insurance plan.
The other big one (as another poster noted below) is server log files. Those may be accessible to someone who shouldn't necessarily have access to the data.
Comments
Given that these requests are using HTTPS (not that a non-secure POST is any better than a non-secure GET in that regard), could you give some other issues aside from the browser history issue?
Query parameters are public data. They are sent along with every single request from your browser to 3rd parties which is launched from the page! Analytics, image downloads, click-throughs, everything. I think browser history and server logs are actually the lesser evil here.
These query parameters in particular are not search terms, they are PHI you enter to determine the rates you will pay for health insurance. They are basically all the key parameters besides the age of household members which determine the price you will pay for a given insurance plan.
The other big one (as another poster noted below) is server log files. Those may be accessible to someone who shouldn't necessarily have access to the data.