10 ms·
Two points: First, the very act of requesting your data is in a way confirming and verifying the accuracy of the data. Second: Every prescription you've ever f
by Simulacra 7y ago
Two points: First, the very act of requesting your data is in a way confirming and verifying the accuracy of the data.
Second: Every prescription you've ever filled with insurance - and even some without - is recorded by companies like Milliman.[0] When you want to buy life insurance, health insurance, etc. they can request to see what medications you're on, have been on, etc.
[0]. https://clark.com/insurance/how-to-see-your-secret-health-credit-report-files/ https://clark.com/insurance/how-to-see-your-secret-health-cr...
- zzzeek 7y agohow does that not violate HIPAA ? I see it talking about "you can proactively opt out with hipaa" but everything I've ever seen about HIPAA is that all "opting in" needs to be explicitly granted by the patient.
- creaghpatr 7y agoI'm guessing you opt-in when you request a quote.
- yabadabadoes 7y agoIt still sounds sketchy since it sounds like your data is maintained at a 3rd party for a purpose that is not intended (unrelated to your care) on the idea that you may one day opt-in to the unintended use.
- yborg 7y agoWe are all most likely explicitly authorizing this activity in the reams of fine print you sign without reading or otherwise accept by agreeing to service by your local hospital group or pharmacy combine.
- astura 7y agoIf you want life insurance then you are required to give permission to view this data about you. If you don't want to give permission, then you don't get life insurance. https://www.rxhistories.com/irix/medical-data/ https://www.rxhistories.com/irix/medical-data/ >How It Works >1 Applicants sign a HIPAA-compliant authorization, enabling insurers to retrieve their medical information >2 Insurers electronically query Milliman IntelliScript in real-time >3 Milliman instantly gathers information from multiple data sources >4 Irix interprets the data and generates automated decisions based on the insurer's guidelines
- SamBam 7y agoBut I never gave Milliman permission to hold this data, so didn't they already violate HIPAA?
- astura 7y agoSounds like they have hooks into the back end systems to query multiple insurance companies and pharmacies on the fly. - "Milliman instantly gathers information from multiple data sources"
- sethbannon 7y agoLikely deep within the terms and conditions you agreed to with your private health insurance company, you did indeed give permission.
- nosuchuser2 7y agoI think you misunderstand HIPAA. As long as they have a business associate agreement with the pharmacies and serve some vaguely care-adjacent purpose, the pharmacy can share your data with them without your knowledge or consent.
- SamBam 7y agoI can't tell if you're being cynical or serious, but if the latter I can't see how this is correct. From "Pharmacy privacy Requirements here [1], I don't think "business associate agreement [with] some vaguely care-adjacent purpose" meets the standards for information-sharing. Rather the information must be being shared as part of specific treatment for a patient (discussing actual care) or payment. [1] https://www.uspharmacist.com/article/hipaa-privacy-security-and-pharmacy-information-technology https://www.uspharmacist.com/article/hipaa-privacy-security-...
- otikik 7y agoI imagine somewhere in their quoting algorithm they have a conditional like `if potential_customer.opted_out_of_hipaa then quote = max_possible_quote, msg = 'you can lower your quote by sharing your data with us'".
- pc86 7y agoUnlikely
- captainmuon 7y agoHow is that even legal? Isn't patient data specially protected?
- pc86 7y agoYour healthcare providers, pharmacies included, can sign BAAs with other firms that allow them to share the data. Your consent is not required.
- ENOTTY 7y ago> First, the very act of requesting your data is in a way confirming and verifying the accuracy of the data. Could you explain what you mean by that? And also hypothesize some implications of 'confirming and verifying the accuracy of the data'?
- mschuster91 7y agoFor example, checking if you ever had an account at companies mentioned in your data takeout - to spot if someone does shit while using your name/personal information, or some incompetent/malicious clerk mixed up data.
- ineedasername 7y agoThat doesn't verify any data though. At most, it implies a likelihood of having an account, but nothing about the specific data.
- xeromal 7y agoIf they're uncertain of your middle name for instance, uploading your ID just confirms that they had it right or wrong.
- newnewpdro 7y agoIt's obviously contributing more data with a high probability of being all signal and zero noise. Some government IDs even include social security #s, but you're adding a photograph. In the sense of confirming the data, it seems likely to at least attest to the identity being a genuine one associated with that data. Rather than something like a burner phone setup with a bunch of random stuff. Of course people can also have a fake photo ID, but it seems unlikely someone using a totally fabricated existence would be querying for this information and exposing them potentially to closer scrutiny.
- xeRTRex 7y agoAnd the history of every life insurance application an individual filled is collected and shared through a company called MiB[0] to help mitigate fraud. [0]. mib.com
- ekingr 7y ago> Two points: First, the very act of requesting your data is in a way confirming and verifying the accuracy of the data. Same dilemma as hitting the "unsubscribe" link on spam: when doing so you confirm them you have a valid email address. It's a pure act of faith, you hope that they will comply and not take advantage of you even more.
- NCWV 7y agoWow. Dystopia is here. This is messed up.