3 ms·

> Two simple questions kept hounding me: did patients know about the transfer of their data to the tech giant? Should they be informed and given a chance to opt

> Two simple questions kept hounding me: did patients know about the transfer of their data to the tech giant? Should they be informed and given a chance to opt in or out? That's literally what HIPAA was created to address. The user doesn't have to opt-in to every single solitary business that touches their data, because there is a chain of business contracts that explicitly dictate what they can do, that originates with the care provider. This is like "blowing the whistle" because your dentist sent your dental impression to a company to create a crown for you. You didn't "opt-in" to that dental company getting your impressions, because your dentist had a contract with them to cover what they would do with it in the first place. Jesus christ.

JohnFen 7y ago
> This is like "blowing the whistle" because your dentist sent your dental impression to a company to create a crown for you. I see a huge difference here, though. the company making my crown doesn't get my complete medical records. They get what is necessary to make the crown. Google is getting everything, to use for purposes beyond the patient's immediate medical needs. > That's literally what HIPAA was created to address. That HIPAA allows this sort of thing to happen is a great reason to pressure lawmakers to improve HIPAA.
- peterwwillis 7y ago
  > Google is getting everything, to use for purposes beyond the patient's immediate medical needs. That claim was never made anywhere in this whistleblower account. Furthermore, it's illegal, and anyone working with health care records knows that. You can't use the records for anything other than what was covered by the business associate contract. It's clear from the letter that the whistleblower literally has no idea at all what's going on, so they got frightened and yelled fire, in hopes that somebody who knows more than them will come and look for a fire. If they did about 30 minutes of research, they'd know that any person whose records are covered by this agreement has the legal right to request from Google all information about how their medical records are being used. All they'd need to do is ask 8 random people to request records from Google, and one of them might be covered. They could then find out the answer, or at least have some kind of evidence of a lack of process or oversight. They have provided none. Multiple times in the letter they mention that the public must consent to this. There is no law requiring this, so really the whistleblower is trying to assert their own opinions about public policy, and using the veiled threat of malfeasance to get press time. I'd expect this anonymous source to out themselves soon so they can lead some kind of public demand for more visibility (hence more regulation). Which might be good, except the HHS (which actually regulates HIPAA claims) already doesn't enforce it much at all. So it's probably just going to be used as a political tool to gain votes without actually improving people's lives.
  - JohnFen 7y ago
    > That claim was never made anywhere in this whistleblower account. I may have misread the various reports and press releases, of course. If so, please do correct me. But I believe that everyone, including Google and the medical group, has mentioned this data is to be used to train a ML engine. > You can't use the records for anything other than what was covered by the business associate contract. My understanding is that the ML use is covered by the BAA. Of course, I haven't read it, so I don't know, but it seems likely. I seriously doubt that anyone is actually overtly and intentionally breaking any laws here.

JohnFen 7y ago

> This is like "blowing the whistle" because your dentist sent your dental impression to a company to create a crown for you. I see a huge difference here, though. the company making my crown doesn't get my complete medical records. They get what is necessary to make the crown. Google is getting everything, to use for purposes beyond the patient's immediate medical needs. > That's literally what HIPAA was created to address. That HIPAA allows this sort of thing to happen is a great reason to pressure lawmakers to improve HIPAA.

peterwwillis 7y ago
> Google is getting everything, to use for purposes beyond the patient's immediate medical needs. That claim was never made anywhere in this whistleblower account. Furthermore, it's illegal, and anyone working with health care records knows that. You can't use the records for anything other than what was covered by the business associate contract. It's clear from the letter that the whistleblower literally has no idea at all what's going on, so they got frightened and yelled fire, in hopes that somebody who knows more than them will come and look for a fire. If they did about 30 minutes of research, they'd know that any person whose records are covered by this agreement has the legal right to request from Google all information about how their medical records are being used. All they'd need to do is ask 8 random people to request records from Google, and one of them might be covered. They could then find out the answer, or at least have some kind of evidence of a lack of process or oversight. They have provided none. Multiple times in the letter they mention that the public must consent to this. There is no law requiring this, so really the whistleblower is trying to assert their own opinions about public policy, and using the veiled threat of malfeasance to get press time. I'd expect this anonymous source to out themselves soon so they can lead some kind of public demand for more visibility (hence more regulation). Which might be good, except the HHS (which actually regulates HIPAA claims) already doesn't enforce it much at all. So it's probably just going to be used as a political tool to gain votes without actually improving people's lives.
- JohnFen 7y ago
  > That claim was never made anywhere in this whistleblower account. I may have misread the various reports and press releases, of course. If so, please do correct me. But I believe that everyone, including Google and the medical group, has mentioned this data is to be used to train a ML engine. > You can't use the records for anything other than what was covered by the business associate contract. My understanding is that the ML use is covered by the BAA. Of course, I haven't read it, so I don't know, but it seems likely. I seriously doubt that anyone is actually overtly and intentionally breaking any laws here.