5 ms·

> Neither patients nor doctors have been notified I guess this isn't a HIPAA violation?

McDev 7y ago
Further down: ... privacy experts said it appeared to be permissible under federal law. That law, the Health Insurance Portability and Accountability Act of 1996, generally allows hospitals to share data with business partners without telling patients, as long as the information is used “only to help the covered entity carry out its health-care functions.”
- ta1234567890 7y ago
  Thank you and Wow! That is a very broad statement within HIPAA and subject to interpretation, which leaves a huge door open for marketers to "help covered entities carry out their health-care functions"
  - dmix 7y ago
    The point of HIPAA wasn’t really consumer privacy protection. It’s mostly just a side effect.
  - pkaye 7y ago
    HIPAA has lots of loopholes. For example "Covered entities must implement reasonable safeguards to limit incidental, and avoid prohibited, uses and disclosures." There is no requirements to have sound proof walls. If your neighbor in the shared room overhears a conversation with a doctor, too bad.
    - spiznnx 7y ago
      My doctor's lobby has a sign that says "please wait in line here, to respect the privacy of other patients", about 4 feet from the desk. The desk itself is probably wider than 4 feet.
  - wffurr 7y ago
    s/marketers/machine learning researchers and healthcare software designers.
  - noelsusman 7y ago
    Marketing is specifically called out in the law as not being a healthcare function. It requires a separate authorization of consent from each patient before any of their data can be used for marketing purposes.
- rkagerer 7y ago
  Is the "carry out its health-care functions" argument a stretch? Something is seriously broken with a system that lets them give away your health data without your consent, and the lack of anonymization only compounds the injury.
bilbo0s 7y ago
There is a loophole in HIPAA. Basically, a hospital can give data to a partner if it has to in order to deliver care. But it was meant for, just as a for instance, your doctor gives a few DICOM studies to GE because they are going to concert on modifying the settings on a CT scanner to do some wiz-bang thing everyone thinks will help the patient. (Maybe even other patients down the line?) Giving it to Google so they can serve you ads, er, um, I mean, "recommend different treatments" to you, kind of stretches the letter of the law. And definitely breaks the spirit of the law in my opinion.
- shadowgovt 7y ago
  It's not even really a loophole. The letters in HIPAA stand for "portability" and "accountability." Privacy doesn't show up anywhere in the acronym. While privacy's importance in healthcare is important and is codified in other laws, HIPAA's whole deal is to try and standardize a system by which those other laws can be followed, not "guarantee consumer privacy" as an end of HIPAA law itself.
- sukilot 7y ago
  > your doctor gives a few DICOM studies to GE because they are going to concert on modifying the settings on a CT scanner Is that actually allowed without patient consent?
  - bilbo0s 7y ago
    No. Patient consent is part of the whole "everyone thinks [it] will help" part. Not really sure how Google finagled their access? It's odd when neither the doctor, nor the patient knows. I wonder if even the hospital administrators knew? Or is this a decision that was made at the system level and the average hospital CEO at Ascension was none the wiser?
    - froindt 7y ago
      I hate how patient consent is typically implemented. I've seen two ER's firsthand who have someone come in with a computer, ask some questions about insurance and all, then say "please sign for the HIPPA privacy form, and again to release the information to your insurance provider". For all you know, you're signing away for an assisted suicide and authorizing your organs to be transplanted. I refuse to sign on the pad, I'm the patient who asks for it to be printed out on paper, signs it, and gets a copy too.

Further down: ... privacy experts said it appeared to be permissible under federal law. That law, the Health Insurance Portability and Accountability Act of 1996, generally allows hospitals to share data with business partners without telling patients, as long as the information is used “only to help the covered entity carry out its health-care functions.”

ta1234567890 7y ago
Thank you and Wow! That is a very broad statement within HIPAA and subject to interpretation, which leaves a huge door open for marketers to "help covered entities carry out their health-care functions"
- dmix 7y ago
  The point of HIPAA wasn’t really consumer privacy protection. It’s mostly just a side effect.
- pkaye 7y ago
  HIPAA has lots of loopholes. For example "Covered entities must implement reasonable safeguards to limit incidental, and avoid prohibited, uses and disclosures." There is no requirements to have sound proof walls. If your neighbor in the shared room overhears a conversation with a doctor, too bad.
  - spiznnx 7y ago
    My doctor's lobby has a sign that says "please wait in line here, to respect the privacy of other patients", about 4 feet from the desk. The desk itself is probably wider than 4 feet.
- wffurr 7y ago
  s/marketers/machine learning researchers and healthcare software designers.
- noelsusman 7y ago
  Marketing is specifically called out in the law as not being a healthcare function. It requires a separate authorization of consent from each patient before any of their data can be used for marketing purposes.
rkagerer 7y ago
Is the "carry out its health-care functions" argument a stretch? Something is seriously broken with a system that lets them give away your health data without your consent, and the lack of anonymization only compounds the injury.

bilbo0s 7y ago

There is a loophole in HIPAA. Basically, a hospital can give data to a partner if it has to in order to deliver care. But it was meant for, just as a for instance, your doctor gives a few DICOM studies to GE because they are going to concert on modifying the settings on a CT scanner to do some wiz-bang thing everyone thinks will help the patient. (Maybe even other patients down the line?) Giving it to Google so they can serve you ads, er, um, I mean, "recommend different treatments" to you, kind of stretches the letter of the law. And definitely breaks the spirit of the law in my opinion.

shadowgovt 7y ago
It's not even really a loophole. The letters in HIPAA stand for "portability" and "accountability." Privacy doesn't show up anywhere in the acronym. While privacy's importance in healthcare is important and is codified in other laws, HIPAA's whole deal is to try and standardize a system by which those other laws can be followed, not "guarantee consumer privacy" as an end of HIPAA law itself.
sukilot 7y ago
> your doctor gives a few DICOM studies to GE because they are going to concert on modifying the settings on a CT scanner Is that actually allowed without patient consent?
- bilbo0s 7y ago
  No. Patient consent is part of the whole "everyone thinks [it] will help" part. Not really sure how Google finagled their access? It's odd when neither the doctor, nor the patient knows. I wonder if even the hospital administrators knew? Or is this a decision that was made at the system level and the average hospital CEO at Ascension was none the wiser?
  - froindt 7y ago
    I hate how patient consent is typically implemented. I've seen two ER's firsthand who have someone come in with a computer, ask some questions about insurance and all, then say "please sign for the HIPPA privacy form, and again to release the information to your insurance provider". For all you know, you're signing away for an assisted suicide and authorizing your organs to be transplanted. I refuse to sign on the pad, I'm the patient who asks for it to be printed out on paper, signs it, and gets a copy too.