6 ms·

If I visit a healthcare information website, like webmd.com, and it's unencrypted, then my service provider knows my name, address, and health attributes. If th

If I visit a healthcare information website, like webmd.com, and it's unencrypted, then my service provider knows my name, address, and health attributes. If they kept logs about my visit to those pages, would this be considered PHI under the context of HIPAA? If so, perhaps a lawsuit could force a judge to claim service provider logs are indeed sensitive. Looking for other's thoughts...

hehheh 10y ago
IANAL, but I don't think HIPAA applies. As I understand it, HIPAA only applies to doctor/patient interactions, not situations where the "patient"[1] is looking for data independently. [1] patient is probably the wrong term here, without a doctor/nurse directly involved
- rabboRubble 10y ago
  My health system in Oregon is offering online consultation with medical professionals. I haven't used it yet but it seems more than email and it seems person to person, not person to medical journal article.
TazeTSchnitzel 10y ago
If I email my lawyer, and the email isn't sent over encrypted SMTP, is this a violation of attorney-client privilege…?
- loup-vaillant 10y ago
  You don't email your lawyer. You ask Alphabet to do it for you (gmail). Want to send a mail from home, as should be the norm? First, you need to get through your ISP's firewall. Many block the outgoing SMTP port, and there is nothing you can do about it. Others forbid you to use that port by contract. Some offer an SMTP relay to compensate, but then you're no longer sending your own email. Plus, they often limit you to 40 emails per day or so, and can spy on you, TLS or no. Once your mail is sent, it has to pass through spam filters, and they all blacklist residential IP addresses.
  - bonzini 10y ago
    And Gmail complies to privacy laws indeed. They can scan content automatically to show ads, but they cannot sell a list of people that you exchanged email with, at least not without your consent.
    - loup-vaillant 10y ago
      > They can scan content automatically to show ads This is even worse than manually spying on people: automation gives leverage. Now all we have to do is repurpose these targeted ad engine to deduce things other than buying preferences. Sure, they have their surface ethic (and Alphabet's employees have their actual ethic), but the tools they have in place for total surveillance is downright chilling.
  - extra88 10y ago
    > You don't email your lawyer. You ask Alphabet to do it for you (gmail). I don't know what point you're trying to make. Are you assuming everyone uses Google's webmail interface or their apps? Maybe those blur the lines of classic Internet email delivery but when I use Mail.app to send an email, I am the one doing the emailing, not the Google SMTP server acting as a mail transfer agent (MTA). > Many block the outgoing SMTP port Comcast doesn't, Time Warner doesn't, Verizon doesn't. My hunch is the large majority of U.S. residential ISP customers can connect to an SMTP server other than their ISP's.
    - sedachv 10y ago
      > but when I use Mail.app to send an email, I am the one doing the emailing, not the Google SMTP server acting as a mail transfer agent (MTA) You seem to be confusing the MSA (https://en.wikipedia.org/wiki/Mail_submission_agent https://en.wikipedia.org/wiki/Mail_submission_agent) and the MTA. If today your MUA (Mail.app) tried to connect to the destination mail host via SMTP directly it would get rejected. Some early MUAs did actually do that, but today almost all email gets relayed via an MSA and one or more MTAs.
      - 10y ago
dqv 10y ago
Maybe. But if that happened and then the HHS decided to pursue it, the ISP would claim they're simply a conduit for PHI and that the privacy rule doesn't apply.
- loup-vaillant 10y ago
  Mere conduits have no memory —they wouldn't keep logs, let alone sell them to third parties. If the ISP wants to "simply be a conduit", I can only applaud, as long as they follow the rules of common carriers they just implied by saying so: no snooping, no filtering, no selective throttling, no looking at TCP packets to look for a "25" (SMTP requests) and block them… If they do that, they don't have to follow any privacy rule: they already respect mine.
  - bonzini 10y ago
    I suppose a water "carrier" could have a sieve to filter away unwanted particles, or could add chlorine to kill bacteria, etc. But it certainly couldn't do anything equivalent to keeping or selling logs...
    - subway 10y ago
      The "carrier" ceases to be just a "carrier" at that point. They're now both a "carrier" and a "filter". Sometimes I just want unmolested water.
      - KMag 10y ago
        You and me both, General Ripper.
    - yosamino 10y ago
      Well, they could drugtest your wastewater [0] and measure your water consumption with one of these "smart" meters at small intervals. It's not at the scale of data that an ISP could sift through, but with a little imagination, water can be a source of metadata... [0] http://www.dw.com/en/experts-on-drug-wastewater-analysis-say-its-time-for-policymakers-to-get-onboard/a-16798866 http://www.dw.com/en/experts-on-drug-wastewater-analysis-say...
omouse 10y ago
Tor and VPN up. If this is how ISPs feel we should be treating encryption/privacy as a self-defense thing, kinda like insurance or home security.
- shshhdhs 10y ago
  Sure, but I was more looking for a legal way to fight the service providers on the grounds of an established privacy law.
- cmurf 10y ago
  AT&T, Charter, and others, have toyed with the idea of blocking Tor and VPN unless you buy a higher tier permissing those services. AT&T was charging $30 a month extra for this tier. And even now there are many reports still of performance tuning when using VPN, slowing down the connection. These are classist policies and should be illegal. It is not OK in a civil society to say privacy is a product people buy, rather than a right.
tzs 10y ago
HIPAA privacy requirements apply to "covered entities" and their "business associates". A "covered entity" is a health care provider, a health plan, or a health care clearinghouse [1]. Your ISP would not be a covered entity. If we assume that webmd.com would count as a "health care provider" (probably a questionable assumption) that would not be enough to get your ISP covered as a "business associate". Googling turns up rulings that ISPs are not HIPAA "business associates" when a patient uses them to reach a provider. [1] https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...

hehheh 10y ago

IANAL, but I don't think HIPAA applies. As I understand it, HIPAA only applies to doctor/patient interactions, not situations where the "patient"[1] is looking for data independently. [1] patient is probably the wrong term here, without a doctor/nurse directly involved

rabboRubble 10y ago
My health system in Oregon is offering online consultation with medical professionals. I haven't used it yet but it seems more than email and it seems person to person, not person to medical journal article.

TazeTSchnitzel 10y ago

If I email my lawyer, and the email isn't sent over encrypted SMTP, is this a violation of attorney-client privilege…?

loup-vaillant 10y ago
You don't email your lawyer. You ask Alphabet to do it for you (gmail). Want to send a mail from home, as should be the norm? First, you need to get through your ISP's firewall. Many block the outgoing SMTP port, and there is nothing you can do about it. Others forbid you to use that port by contract. Some offer an SMTP relay to compensate, but then you're no longer sending your own email. Plus, they often limit you to 40 emails per day or so, and can spy on you, TLS or no. Once your mail is sent, it has to pass through spam filters, and they all blacklist residential IP addresses.
- bonzini 10y ago
  And Gmail complies to privacy laws indeed. They can scan content automatically to show ads, but they cannot sell a list of people that you exchanged email with, at least not without your consent.
  - loup-vaillant 10y ago
    > They can scan content automatically to show ads This is even worse than manually spying on people: automation gives leverage. Now all we have to do is repurpose these targeted ad engine to deduce things other than buying preferences. Sure, they have their surface ethic (and Alphabet's employees have their actual ethic), but the tools they have in place for total surveillance is downright chilling.
- extra88 10y ago
  > You don't email your lawyer. You ask Alphabet to do it for you (gmail). I don't know what point you're trying to make. Are you assuming everyone uses Google's webmail interface or their apps? Maybe those blur the lines of classic Internet email delivery but when I use Mail.app to send an email, I am the one doing the emailing, not the Google SMTP server acting as a mail transfer agent (MTA). > Many block the outgoing SMTP port Comcast doesn't, Time Warner doesn't, Verizon doesn't. My hunch is the large majority of U.S. residential ISP customers can connect to an SMTP server other than their ISP's.
  - sedachv 10y ago
    > but when I use Mail.app to send an email, I am the one doing the emailing, not the Google SMTP server acting as a mail transfer agent (MTA) You seem to be confusing the MSA (https://en.wikipedia.org/wiki/Mail_submission_agent https://en.wikipedia.org/wiki/Mail_submission_agent) and the MTA. If today your MUA (Mail.app) tried to connect to the destination mail host via SMTP directly it would get rejected. Some early MUAs did actually do that, but today almost all email gets relayed via an MSA and one or more MTAs.
    - 10y ago

dqv 10y ago

Maybe. But if that happened and then the HHS decided to pursue it, the ISP would claim they're simply a conduit for PHI and that the privacy rule doesn't apply.

loup-vaillant 10y ago
Mere conduits have no memory —they wouldn't keep logs, let alone sell them to third parties. If the ISP wants to "simply be a conduit", I can only applaud, as long as they follow the rules of common carriers they just implied by saying so: no snooping, no filtering, no selective throttling, no looking at TCP packets to look for a "25" (SMTP requests) and block them… If they do that, they don't have to follow any privacy rule: they already respect mine.
- bonzini 10y ago
  I suppose a water "carrier" could have a sieve to filter away unwanted particles, or could add chlorine to kill bacteria, etc. But it certainly couldn't do anything equivalent to keeping or selling logs...
  - subway 10y ago
    The "carrier" ceases to be just a "carrier" at that point. They're now both a "carrier" and a "filter". Sometimes I just want unmolested water.
    - KMag 10y ago
      You and me both, General Ripper.
  - yosamino 10y ago
    Well, they could drugtest your wastewater [0] and measure your water consumption with one of these "smart" meters at small intervals. It's not at the scale of data that an ISP could sift through, but with a little imagination, water can be a source of metadata... [0] http://www.dw.com/en/experts-on-drug-wastewater-analysis-say-its-time-for-policymakers-to-get-onboard/a-16798866 http://www.dw.com/en/experts-on-drug-wastewater-analysis-say...

omouse 10y ago

Tor and VPN up. If this is how ISPs feel we should be treating encryption/privacy as a self-defense thing, kinda like insurance or home security.

shshhdhs 10y ago
Sure, but I was more looking for a legal way to fight the service providers on the grounds of an established privacy law.
cmurf 10y ago
AT&T, Charter, and others, have toyed with the idea of blocking Tor and VPN unless you buy a higher tier permissing those services. AT&T was charging $30 a month extra for this tier. And even now there are many reports still of performance tuning when using VPN, slowing down the connection. These are classist policies and should be illegal. It is not OK in a civil society to say privacy is a product people buy, rather than a right.

tzs 10y ago

HIPAA privacy requirements apply to "covered entities" and their "business associates". A "covered entity" is a health care provider, a health plan, or a health care clearinghouse [1]. Your ISP would not be a covered entity. If we assume that webmd.com would count as a "health care provider" (probably a questionable assumption) that would not be enough to get your ISP covered as a "business associate". Googling turns up rulings that ISPs are not HIPAA "business associates" when a patient uses them to reach a provider. [1] https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...