4 ms·
And this is why laws like the GDPR are needed: "Journalists recently revealed that Australia’s most popular medical appointment booking app, HealthEngine, rout
by blub 8y ago
And this is why laws like the GDPR are needed:
"Journalists recently revealed that Australia’s most popular medical appointment booking app, HealthEngine, routinely shared 100s of users’ private medical information to personal injury law firms as part of a referral partnership contract.1 Although the company claimed this was only done with users’ consent, these practices were not included in the privacy policy but in a separate “collection notice,” and there was no opportunity for users to opt-out if they wished to use the application (app)."
Too bad most of the worst offenders are in the US or other countries with non-existing privacy laws.
- marcinzm 8y agoThe US has HIPAA which while not perfect would cover any medical data sharing and does have decently sized fines behind it.
- dragonwriter 8y ago> The US has HIPAA which while not perfect would cover any medical data sharing and does have decently sized fines behind it. Because HealthEngine looks like it has business relationships with providers, it would probably be covered by HIPAA through provider BAAs in the US. But if it only had a business relationship with the consumer, ala Google Duplex, and handled medical bookings on the consumer's behalf that would not be the case. So even though the specific case would enjoy covered by HIPAA in the US, it is illustrative of a problem HIPAA may not be adequate to address. HIPAA may actually be dangerous here, because what lay awareness of it exists seems to see it as protecting health data generally, when it only protects health data held by certain entities, and consumer-facing entities that don't have a business relationship with your health provider or insurer aren't covered, and there are plenty of them trying to vacuum up health data.