7 ms·
I would bet they have put access restrictions on these because violating hippa can be a felony whereas in general there are 0 legal requirements to restrict acc
by jtmcmc 9y ago
I would bet they have put access restrictions on these because violating hippa can be a felony whereas in general there are 0 legal requirements to restrict access to internal data to a company generally.
- matheusmoreira 9y agoSo if a company stores medical history data it's only required by law to prevent the data from leaking to the public? It's okay if a system administrator employed by the company has read access to people's medical records?
- arkades 9y agoNo. Anyone internal to the company viewing medical data without an explicit need is in violation of hipaa. But I don’t think that’s what the poster was saying.
- matheusmoreira 9y agoI see. I don't know the details of HIPAA but that seems reasonable. What kinds of needs justify use of the data?
- wallflower 9y agoOne example. A friend of mine who works at a hospital told me about a colleague (a nurse) who looked up her own test results since she was anxious and could not wait using her login to the main system (for providers). She got flagged in the system and reprimanded. Every access is logged.
- northern_lights 9y agoit's worth noting for others that this was almost certainly a hospital policy violation, not a hipaa violation. There's nothing in hipaa that prevents a person from accessing their own record (though I have heard hospital administrators try to claim otherwise).
- arkades 9y agoYou need to be part of a patient’s care team, using that data to further their care. Any other access is a violation. Med students get a little grey area on this because their job is to absorb as much info as possible without necessarily providing care, but even they shouldn’t venture outside the census of their supervising physician.
- EpicEng 9y agoThat's absolutely false. Many other people need to be able to access the data just to keep systems working. I've worked in a HIPAA environment (as well as FDA class 1 / ISO 13485) for nearly 15 years now.
- samstave 9y agoAlso, many companies who deal with medical data, but are say startups but not an actual healthcare provider gets audited for compliance - and it is fairly rigorous and so think of it like a SOX audit, but even further. Some companies have dedicated rooms with limited, tracked, badge access to the machines in that area which are the only machines that can access the data. So if any breach occurs, access can be tracked to individuals.
- matheusmoreira 9y agoSo programs are allowed access to the data, provided they are audited? In my country, one programmer who unfortunately lost his newborn daughter to sepsis decided to make a machine learning program to help doctors diagnose the infection early. The software has access to patient data and it recognizes patterns that match the development of sepsis. It decreased the number of severe sepsis cases per month from 1.5 to 0.5 and cut the waiting time before effective treatment was administered by 60%. People have told me this sort of system would not have been impossible in the USA because of the HIPAA. Is this true?
- jbeckham 9y agoThese types of programs do exist in most insurance companies in the United States. Predictive analytics against claims and clinical data to do early intervention care management is a common thing here. That said, the company has to make sure that only the people that have a clinical need to access the data have access. So the developers would probably use a de-identified data set to write and test the program. Only the clinicians (care management and disease management nurses) would have access to the identified data so they can contact the patient to offer care.
- samstave 9y agoYep - de-identified data is the best way to assure compliance when developing/working-on/dealing with large sensitive data-sets. that said, compliance audits are pretty strict if they are doing it correctly, and not-so-fun. It will be an interesting world when there is a medical-data-firehose pointed at an AI that is looking at all the available med records to do predictive analytics against an entire population.... We are likely a decade from that.
- jtmcmc 9y agosorry if i was unclear. if a company is storing medical history data that falls under HIPPA which is serious. If a company just has data about you that is not medical data then there is no legal requirements as to who can have access to it internally. (So Joe's Sprocket's has a list of everyone who has bought sprockets and their phone numbers - anyone in the company could look at that info and there would be no legal implications)
- matheusmoreira 9y agoI see. I think I misinterpreted the "0 legal requirements" part of your comment. It gave me the impression employees not involved in the care could access medical data. Thanks for clarifying.
- SilasX 9y agoUber has comparative advantage in making itself a difficult target even when there is a strong legal case that they broke the law.
- s2g 9y agoHIPAA violations would have the federal government on the quick. It’s not a “delay and get people to show up to town hall” sort of issue.
- chatmasta 9y agoPeople always repeat this idea that HIPAA is the most serious of all the serious regulations, that you most definitely do not want to violate. Yet I’ve never heard of a major company fined or punished for HIPAA violations. Have there been any such notable incidents in the past few years?
- chasb 9y agoHHS prefers not to use civil monetary penalties, but they hit when they do: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html https://www.hhs.gov/hipaa/for-professionals/compliance-enfor...
- lhorie 9y agoThere are plenty of incidents every year. Just this year, there were 2 already: https://compliancy-group.com/hipaa-fines-directory-year/ https://compliancy-group.com/hipaa-fines-directory-year/
- CaptSpify 9y agoI'd say I'm still skeptical because they have a history of skirting the law. Fool me once...
- hcnews 9y agoidk I feel like the days of Uber fucking up are getting past us with changes in last 6 months. YMMV.
- CaptSpify 9y agoI do fully admit that I haven't been keeping up to date on their latest changes, so that may be true. But IMO, 6 months isn't nearly enough time to forgive the major fuckups that they've been doing
- 0xB31B1B 9y agoThey fired basically every executive and the new CEO has been building the c suite from a fresh start. He’s made a bunch of good moves so far and seems like a mensch.
- stochastic_monk 9y agoBut the new CEO still failed to disclose an enormous breach for months. It’s not fixed.
- lhorie 9y agoWhat in the world are you talking about? As soon as he found out about the 2016 breach, he ran an investigation, found that the chief of security was responsible, fired him, and then came forward to the press about it. IMHO, that couldn't have been handled better.
- stochastic_monk 9y agoReally? You’re aware that people have had their information compromised, including driver’s licenses, and you do an “internal investigation” for months before notifying them? No, you patch the hole and let them know, not wait until you have a scapegoat for better PR. And Aug 30 to Nov 21 is very much “months”.
- rmc 9y agoAl Capone was convicted on tax crimes, could this be the way to get Uber?