17 ms·
State Farm uses payment signature for HIPAA disclosure authorization
- numblok 7y agoNot a lawyer but seems like perjury to me.
- deleted 7y ago[deleted]
- kop316 7y agoWhile I very much agree that how they did it is incredibly shady, the person applied to long term disability insurance. I correct me if I am wrong, but isn't it a reasonable thing that an insurance company would want to look at your medical records as a condition of you signing up for one?
- markus92 7y agoThat would actually be illegal in a lot of places. Not sure how it would be in the USA but in most countries in Europe that wouldn't fly. They would be allowed to ask questions about your medical history, but medical records themselves are an absolute no go.
- MandieD 7y agoFor long-term disability insurance in Germany, they can ask for permission to get information from your doctors for conditions you've revealed during the application process, and deny coverage if you do not give them permission. Omitting said conditions would be grounds for non-payment of benefits if what made you unable to work is in any way related to a condition they asked you about and you didn't reveal.
- kop316 7y agoPlaying devil's advocate, why would I as an insurance company want to insure you if I don't have access to your medical records to verify preexisting conditions? I say that because then a person could have a preexisting condition, sign up for insurance, then go on long term disability due to the preexisting condition.
- bb88 7y agoNAL, but isn't that insurance fraud?
- kop316 7y agoIt definitely is, but I imagine that doesn't stop dishonest people.
- ken 7y agoJust because a company has a financial interest in learning a piece of information doesn't make it legal to acquire that information in any possible way. Pasting a signature onto a different document sounds like a clear cut case of fraud.
- kop316 7y agoI'm not disagreeing that the method is shady. I'm saying if I'm the insurance company, why would I offer disability insurance if I can't verify the existence or absence of a preexisting? condition
- ldoughty 7y agoThis doesn't seem shady, the form the tweet posted explicitly said it authorized state farm to request his medical, employment, and other records on his behalf. The only "shady" thing might be not sending the authorization form he signed with their HIPPA request to show the source of the signature, but revealing he's seeking a long term disability claim could also be a HIPPA violation itself... Regardless, the form says he authorized state farm to do exactly what they did: request his medical records without further approval from him (otherwise he might have needed to fill out each additional requests manually, which perhaps was an option if he declined this, we don't know)
- aphyr 7y agoAs I stated in the immediately following tweet in the thread, I was not presented with those forms at signing time. I had no idea they existed or that my signature would be applied to them.
- endogui 7y ago> the form the tweet posted explicitly said ... > the form says he authorized ... You seem to be repeatedly missing the point: he claims to have never seen nor signed this form. The "signature" is decidedly pixellized. The claim is that the insurance company put his name on this form without showing it to him, which both defeats the point of the form and is a crime (forgery) in the US.
- kerkeslager 7y agoForging signatures to fake consent for privacy violations is never reasonable. I get what you're saying, but it's irrelevant, and draws attention away from the crime being committed.
- kop316 7y agoMy point is I really am only hearing one side of the story. If true, I wholeheartedly agree. However, my experience with those "payments" is closer to "I have read the contract, agree to terms, etc." I am given the oppritunity to see the contract to review before I sign it, and walk out with it signed. Also, my point is common sense tells me that state farm would want to see my medical records to make sure I am not lying about previous disabilities (we are talking about disability insurance, not car or renters insurance), and usually you sign a contract for insurance. From a flow standpoint, I can see why state farm would only do one signature if it is all digital versus making the person sign five times, when all it says is "I have reviewed form X and agree." But if someone doesn't actually review all of the documents, then something like this happens.
- kerkeslager 7y agoNo one is confused about why State Farm wants the data. The reason you're not hearing about why they want the data, is that why they want the data is irrelevant. That's not "the other side of the story", that's irrelevant information that doesn't justify State Farm forging signatures to fake consent for privacy violations. There aren't two sides to every story, and this appears to be a case where there is only one side to the story. Do you think that anything you've said justifies State Farm forging signatures to fake consent to violate clients' privacy? If not, why are you polluting the conversation with irrelevant information?
- kop316 7y agoI was trying to be nice to the poster. Being blunt, I think the poster has no idea how insurance works, and didn't bother to read anything while signing up. Now they are upset because they actually read it. Or being less charitable, they did understand the process, and wanted to create fake outrage about it. But the story does not add up to me at all taken at face value.
- nwallin 7y agoIt's the how, not the why. I want a million dollars. Wanting a million dollars is perfectly reasonable, lots of people want a million dollars. It's not reasonable to walk into a bank and cash a check with Bill Gates' forged signature on it. Which is exactly what State Farm did. That's not shady, it's fraud, and it's very illegal.
- hamburglar 7y agoThere is no problem with the fact that they want the information. However, if they want this information, they have to get his consent to obtain it. They faked that consent by putting his signature on a document he didn't sign. That's the problem.
- dzdt 7y agoAt my pediatrician's office the norm is to sign forms without seeing them at all. The receptionist has a computer screen; the patient has a signature pad with no display. They will say "please sign for permission to treat" then "please sign again for HIPAA approval" and so on. I think you could ask to see the forms, but it would be breaking the social norms to do so. You would instantly be a "difficult" patient.
- marcinzm 7y agoGiven that the forms are basically lawsuit protection seems like that'd be a risky approach depending on how determined the lawyer suing is.
- kop316 7y agoI disagree that it break social norms. If I am agreeing to something, I want to know what I am agreeing to. If I get treated like I am "difficult", I would say you should be shopping around for a different pediatrician.
- jiveturkey 7y agoThe definition of social norm is what most other people think. Do you not realize that most people will just sign the form without reading or checking? That is the norm.
- snowwrestler 7y agoA social norm is what other people expect from you. It arises from commonalities within the group, but has an additional component of expectation. Not every deviation from typical behavior violates a social norm. I don't think it's a relevant concept here, because even if the rest of the patients don't read the HIPAA documents, they also don't care whether you read them. The staff don't care either, even if they have to do a little extra work so you can. Shouting loudly in the waiting room would be a good example of violating a social norm--people generally expect each other to speak normally/quietly in a medical office.
- 7y ago
- jrockway 7y agoI feel like signatures are completely meaningless at this point. Applying a picture of someone's signature to a document they didn't sign is certainly shady, and I hope is found to be illegal. But I think we're pretty far gone on signatures being any sort of authentication mechanism. Already you can "e-sign" all sorts of legal documents with no verification of your identity whatsoever. (Meanwhile, one time my bank did check my signature when I was withdrawing what seems now like a tiny amount of money. They decided it didn't match, and then I had to submit a new signature sample before I could have my money. This was after showing them a driver's license, passport, and entering the PIN on my debit card in front of the clerk. Several years later, different bank, I wrote a check for $30,000 to a doctor by logging into my bank with an 8 character no-capital-letters-allowed password.) I feel like the direction that the standard is going is that you are assumed to have signed something if you benefited from signing that document. So you can't slip through the cracks by not signing something, it's just assumed that you signed it now. This fake signature is just an acknowledgement that signatures are useless. "If we issued you insurance, you signed every form. Prove otherwise." And my feeling is they will probably prevail in court on that, because signatures died a long time ago.
- aguyfromnb 7y ago>Already you can "e-sign" all sorts of legal documents with no verification of your identity whatsoever. Well, not really. If you e-sign a document, it's not like there's no traceable provenance to the signature to establish your identity. To what email were the documents delivered? What computer/device were they signed from? At what location were they signed? Sure, all of those things can be "faked", but they really only matter if the signature is disputed. In this case, that's happened, and it will be quite easy to prove he didn't sign the documents. >This fake signature is just an acknowledgement that signatures are useless This is a bit of a reach. Signatures are not meant to be a secure identity measure. If the story is as explained in the Tweet, it's fraud, and that fraud can be proven thanks to what was or was not actually signed. The story doens't end with the insurance company pointing to the signature and saying, "Look, there it is".
- gruez 7y ago
- ginko 7y agoWould have been nice if they said what State Farm was. A Wikipedia search led me to this article about state owned farms in the Soviet Union: https://en.wikipedia.org/wiki/Sovkhoz https://en.wikipedia.org/wiki/Sovkhoz Doing some more searching it seems to be an insurance company in the US.
- franciscop 7y agoIt's linked in the tweet: https://twitter.com/StateFarm https://twitter.com/StateFarm https://www.statefarm.com/ https://www.statefarm.com/
- consultutah 7y agoLargest property casualty insurance company in the United States.
- glofish 7y agoAs always it is all about intent. Did the OP agree to have his information disclosed in return to getting disability insurance? If they did then there is no problem here. It seems that people are getting hung up on the wrong issue. Filling in and signing endless pieces of paper at the doctor's office is the most annoying experience. I wish my signature was applied directly. Of course, I would like to be informed of what I agree to in simple brief terms. Putting massive documents in front of me that will sign automatically anyway makes no difference.
- ldoughty 7y agoThe first few bullet points scream "you authorize SF to get your medical information and history". This is an application for long term disability, so they are trying to prove he's medically disabled by getting documentation from an authoritative source, which could only be accomplished by going to the doctors offices and insurers directly. Isn't this basically power of attorney? He signed a form that explicitly stated he authorized SF can get his medical information (along other things). What's the purpose of such a form except to NOT go back to him to sign 12 documents from different companies to release info one by one?
- aphyr 7y ago<sigh> Again, if you read the thread, you would also know that I could not possibly have agreed to these terms, because I didn't know they existed.
- 7y ago
- aphyr 7y agoRestating this for folks in the comments who didn't read: When I applied for a policy, my agent provided me with an electronic signature pad at payment time. I understood that I was providing my consent to apply for coverage, and to pay for that policy. I do contract review as a part of my job, and read legal language carefully before signing. Just before I left the building, they provided me with a folder full of informational material--a bunch of ads for state farm services and disability coverage in general, some policy overviews, etc. I set it on the counter when I got home, and planned to read it later--work was incredibly busy that week. It turned out that State Farm had applied my payment signature to additional forms without my knowledge: a HIPAA authorization form and consent for State Farm to draw my blood and test it for HIV. I was provided neither verbal nor written information prior to signing that I was agreeing to either of these terms. I was not given a chance to review these agreements prior to signing. I didn't ask to see them, because I didn't know they were even a thing. State Farm started pulling my health records from my old doctors. One of them thought it looked sketchy, and called me to confirm. My reaction was something like "What the fuck". They emailed me a copy of the forms, and that was the first time I learned I'd "agreed" to disclose my health records. Sure enough, they were in the folder: buried behind the ads and policy information. If I'd flipped through the folder in full before walking out the door, I could have run back in and insisted they cancel the authorization. I immediately called State Farm, informed them they did not have my consent, and demanded they destroy any records they'd obtained. They said they'd do that. I've been waiting for them to confirm they've destroyed those records since, uh... May, I guess. The folder's still on top of my desk; I've been meaning to follow up with a HIPAA complaint. Started getting the state regulatory bodies involved, but haven't finished that process. I had a detailed conversation with my agent at State Farm where we talked about the importance of informed consent and presenting people with paperwork prior to signing. He actually told me that not only was this standard procedure, but that he didn't actually know how to get a copy of the forms to show to customers so they could review before signing: the workflow State Farm designed didn't actually produce forms until the signature was already in place. I don't fault my agent specifically for this; I fault State Farm's training and workflow. My understanding from talking with state regulators is that I'd have to initiate a complaint specifically against my agent, which is less than ideal. I like him and I don't want to fuck up his business, and he didn't understand that contracts require a meeting of the minds. This is, IMO, a systemic problem requiring better training and software design, and those are both State Farm corporate issues.
- teeray 7y agoI had this happen to me at a gym once. They had a promotion where it was a fixed price for a month of access. I handed over my card, signed on the payment pad, and walked out the door. When I got home, I found an onerous contract in my inbox with my signature plastered all over it from that signature pad agreeing to automatic payments, absurd cancellation requirements, BS involving my credit, etc. Fortunately, my state had a three day right of recision, so I was able to instantly nullify it despite their protests that it must go through the cancellation process.
- dillonmckay 7y agoYou can also sign ‘Refuse to sign’.
- swalsh 7y agoOnerous contracts are literally gyms business model.
- teeray 7y agoOh, I was well aware. I only accepted because this was presented as a one time purchase. The fraud was when they presented the signature pad as your standard payment authorization and then transparently forged my signature on documents I never saw or was made aware of before signing.
- jaywalk 7y agoAt least they had the courtesy to send you the contracts you'd "signed."
- o10449366 7y agoA few months ago I had the option to sign up for two gyms: One right by my house for $15 a month, another much farther away for $120 a month. I decided to go with the more expensive gym, not because any of the facilities were better, but because the $15 a month gym had a ridiculous number of stipulations in the contract, a 6 months notice for cancellation, minimum 1 year contract with auto renewal, ambiguous "service fees" and electronic payment fees, etc. etc. etc. The more expensive gym is month to month, cancel anytime for no reason at all, no bullshit. Well worth the extra money to not have to deal with any nonsense.
- exabrial 7y agoImagine signing in the hacker news with only a username and no password... That's what credit card numbers are. Passwords / pins aren't even a good solution either: some sort of pki/cryptographic signatures are.
- jrochkind1 7y agothis can't be legal, right?
- sneak 7y agoEverything is legal until someone with authority says it isn't. The way the US system is set up, unless someone has violated criminal law and you can interest a government prosecuting attorney to take interest in the case, you have to hire and pay a lawyer out of your own pocket to threaten/bring a civil case. Most people do not have a civil lawyer on hand, and the costs for even beginning such a thing easily run into the thousands of dollars. Carrying something through to completion can be $20-50k in the best of cases. There is a tremendous power imbalance between private people and large corporations with civil lawyers on staff.
- coding123 7y agoSo maybe it's time we push for real private keys held by people and a signature is a fucking cryptographically proven document.
- chrismeller 7y agoYeah, but who issues those? The government is the obvious answer, blah blah blah Estonia blah blah, but that causes so many other issues... we already have debates over states issuing drivers licenses to “illegals” and “big brother” etc., so I don’t see this idea going over well. At the end of the day it would require that the US government issue an ID to every citizen, green card holder, visa applicant, long term visa holder, etc., illegals be damned... Even if that somehow happened, we now have the single largest hacking target in the world... are you comfortable with that? I’m sure not.
- tomjen3 7y agoNo we don't. Have the government HSM sign a separate key for each state for each month. Have each state HSM sign a separate key for each county for each month. Have each county HSM sign a separate key for each DMV, housing association or whatever, also only valid for a month. No big hacking target because they keys can be locked up or reverted pretty easily and the HSM are on military bases or whatever.
- chrismeller 7y agoI think that is remarkably ignorant. Yes, it works the same way the Chain of Trust does in your browser, but it also means that, at least for <insert time period>, there is a single point of failure. Hardware keys being on military bases doesn’t really fix that, the weak link is still a crappy government server. You also skipped over all the hurdles of recognizing a “person” that we will issue to anyway. Sure, we could ignore that... but then Montana doesn’t recognize signatures from Oregon.
- dwild 7y agoI think you completely lost the context of the conversation, we are talking about improving signatures. Everything you said against using private keys, apply to physical signatures. Sure hacks will surely happens, but they already do happens with signature. At least now you'll get much more traceability and be able to invalidate what needs to be. > You also skipped over all the hurdles of recognizing a “person” that we will issue to anyway. Sure, we could ignore that... but then Montana doesn’t recognize signatures from Oregon. Recognizing what? You are the only one here talking about this being a proof of citizenship. Does your physical signature prove that you are a US citizen? Does it need to? I certainly hope not. For each subsequent argument, please just ask yourself whether this issue apply to physical signature too in a way first.
- martin8412 7y agoIANAL, but isn't this straight up fraud? They have copy pasted a signature for something else onto another contract.
- dboreham 7y agoYes it is. (ianal either).
- salawat 7y agoThis problem is one of the aspects of IT as utilized by the business world that I straight up abhor. Never before in the history of mankind has the bureaucracy taken primacy over getting stuff done. Unfortunately, we seem to have scaled way outside of the capacity for the typical act of contract signing to be anything but fraught with danger. At this point, If I don't have someone to talk with authorized to make and act on contractual amendments in the room, I'm reluctant to sign anything. Hell, even if they are there, I have doubts any amendments would actually be honored given the difficulty and scale of assumptions built into most forms of business automation systems. There has to be a way to get things back on track, but I'm clueless on where to start. Legislation? Public Awareness? Education? What?
- cnst 7y agoMore context: further tweet explains that this was all after he signed on a signature pad. E.g., it's not some sort of conspiracy against him, but what appears to be a "normal business practice", as sad as it is. I think those signature pads are beyond creepy, especially with the way that they're being run by all these companies, where the order in which they give you the documents for examination and the order in which you actually sign them are basically reversed. I've dealt with a few of those pads myself (I think it was at a local municipality and a bank), prompting me to: https://law.stackexchange.com/questions/2148/if-you-sign-a-signature-pad-without-seeing-what-its-for-is-it-binding https://law.stackexchange.com/questions/2148/if-you-sign-a-s...
- jobseeker990 7y agoI wonder why no one has tried to build an AI around TOS and other contracts. It could be trained on 1000s of documents and learn what clauses people want to be made aware of, and/or provide a score from 0-10 on how bad it would be to sign it. To head off the objections: no, it would never be perfect. Yes, there is some risk. But it could be way better for 99% of the population that doesn't read anything they sign.
- Supermancho 7y agoAI isnt a solution to turing problems.
- roynasser 7y agouseGuard.com is similar to this for privacy policies
- quantified 7y agoI can imagine breaches of e-signature images being used in various ways. Another piece of personal info to consider.