4 ms·

Translation: we are weakening HIPPA privacy protections because, virus. Never mind that a “health emergency” should not really be uncharted territory for a hea

Translation: we are weakening HIPPA privacy protections because, virus. Never mind that a “health emergency” should not really be uncharted territory for a healthcare system, but that’s America for you.

wtallis 7y ago
In some cases, this is just allowing providers to use the same software for telehealth, but now without paying extra for the edition that's certified as HIPAA compliant. Eg. Google's G Suite products don't function any differently if your organization signs a Business Associate Agreement with Google. So as long as healthcare providers are still careful, there doesn't have to be any weakening of privacy, just a reduction in red tape and a (temporary) destruction of the market for overpriced specialty telehealth software services.
- hawkice 7y ago
  There is a deep lesson here about HIPAA in general.
- viraptor 7y ago
  It doesn't work any different for the clients, but it may have different features enabled on the backend. For example Google does live transcribing of the conversation on meet/hangouts. Where does it end up with/without hipaa may be significant.
  - supdatecron 7y ago
    > For example Google does live transcribing of the conversation on meet/hangouts. Can you provide a link to this? I was unaware of it and can't find the feature. I did find that Hangouts Meet offers video recording...
    - wtallis 7y ago
      Hangouts Meet lets you turn on closed captions that are generated on the fly. I'm not aware of any way to save that transcription, so I don't see how it's a privacy concern.
      - viraptor 7y ago
        That's the distinction I mean though: You don't see a way to save it, but it doesn't mean Google doesn't keep the record. What prevents that from happening on calls on amounts which didn't sign HIPAA contracts?
        wtallis 7y ago
        > You don't see a way to save it, but it doesn't mean Google doesn't keep the record. What prevents that from happening on calls on amounts which didn't sign HIPAA contracts? Google's regular G Suite already has terms of service and a privacy policy that appear to me to rule out any obviously HIPAA-violating use of data. If they collect anything from Hangouts Meet, the terms are clear that you still own the data and Google can only use it as necessary to provide the service to you. Absent any evidence to the contrary, it seems reasonable to take Google's legal documents at face value and conclude that there's no functional difference for G Suite core services whether or not you sign a HIPAA agreement with them. It certainly strains credulity to suggest that Google would offer stronger privacy guarantees to HIPAA covered entities than to ordinary enterprise customers, and not even advertise as such. It's fine to say you don't trust Google. It's not reasonable to insinuate that they violate their published terms of service and privacy policies. It's absurd to suggest that the extra penalties associated with HIPAA would be the deciding factor for them to refrain from committing those crimes only against that narrow slice of their customers.
        viraptor 7y ago
        It's not only the company violations that we need to worry about. "provide a service" can mean different things. Are phrases where the transcription wasn't clear sent to people for verification and training? Are transcriptions saved for unsupervised learning? Even if they're not shared with third parties explicitly, what happens when the company itself is breached?
therealcamino 7y ago
That's exactly what they're doing, and they're doing it to save lives. We make many decisions during a crisis that would not make sense otherwise. Without defending any aspects of the US response -- there are a lot that are indefensible -- this health emergency has been uncharted territory for many countries with a variety of approaches to healthcare.

wtallis 7y ago

In some cases, this is just allowing providers to use the same software for telehealth, but now without paying extra for the edition that's certified as HIPAA compliant. Eg. Google's G Suite products don't function any differently if your organization signs a Business Associate Agreement with Google. So as long as healthcare providers are still careful, there doesn't have to be any weakening of privacy, just a reduction in red tape and a (temporary) destruction of the market for overpriced specialty telehealth software services.

hawkice 7y ago
There is a deep lesson here about HIPAA in general.
viraptor 7y ago
It doesn't work any different for the clients, but it may have different features enabled on the backend. For example Google does live transcribing of the conversation on meet/hangouts. Where does it end up with/without hipaa may be significant.
- supdatecron 7y ago
  > For example Google does live transcribing of the conversation on meet/hangouts. Can you provide a link to this? I was unaware of it and can't find the feature. I did find that Hangouts Meet offers video recording...
  - wtallis 7y ago
    Hangouts Meet lets you turn on closed captions that are generated on the fly. I'm not aware of any way to save that transcription, so I don't see how it's a privacy concern.
    - viraptor 7y ago
      That's the distinction I mean though: You don't see a way to save it, but it doesn't mean Google doesn't keep the record. What prevents that from happening on calls on amounts which didn't sign HIPAA contracts?
      - wtallis 7y ago
        > You don't see a way to save it, but it doesn't mean Google doesn't keep the record. What prevents that from happening on calls on amounts which didn't sign HIPAA contracts? Google's regular G Suite already has terms of service and a privacy policy that appear to me to rule out any obviously HIPAA-violating use of data. If they collect anything from Hangouts Meet, the terms are clear that you still own the data and Google can only use it as necessary to provide the service to you. Absent any evidence to the contrary, it seems reasonable to take Google's legal documents at face value and conclude that there's no functional difference for G Suite core services whether or not you sign a HIPAA agreement with them. It certainly strains credulity to suggest that Google would offer stronger privacy guarantees to HIPAA covered entities than to ordinary enterprise customers, and not even advertise as such. It's fine to say you don't trust Google. It's not reasonable to insinuate that they violate their published terms of service and privacy policies. It's absurd to suggest that the extra penalties associated with HIPAA would be the deciding factor for them to refrain from committing those crimes only against that narrow slice of their customers.
        viraptor 7y ago
        It's not only the company violations that we need to worry about. "provide a service" can mean different things. Are phrases where the transcription wasn't clear sent to people for verification and training? Are transcriptions saved for unsupervised learning? Even if they're not shared with third parties explicitly, what happens when the company itself is breached?

therealcamino 7y ago

That's exactly what they're doing, and they're doing it to save lives. We make many decisions during a crisis that would not make sense otherwise. Without defending any aspects of the US response -- there are a lot that are indefensible -- this health emergency has been uncharted territory for many countries with a variety of approaches to healthcare.