5 ms·
HIPPA authorities are going to fine them into oblivion right? Right?
by tmpz22 6y ago
HIPPA authorities are going to fine them into oblivion right? Right?
- leetrout 6y agoJail is on the table for HIPAA violations. I am always afraid to mess with medical data.
- hn_throwaway_99 6y agoJail is on the table if you purposefully steal the data. I was interested so searched for examples of actual HIPAA jail time, and in all the cases I could find the conduct was egregious and with clear intent (e.g. https://mazarsusa.com/ledger/jail-time-for-a-hipaa-violation/ https://mazarsusa.com/ledger/jail-time-for-a-hipaa-violation... ). Misconfiguring your S3 buckets isn't going to hit that level, though that could still result in a hefty fine. This of course all assumes that the AI company got access to the data legally to begin with.
- dmix 6y ago2.5M is just a statistic
- peteretep 6y agoIs there any personal liability for the directors Or investors below jail? Going to be a shame if the company is able to just bankrupt out of this
- paulmendoza 6y agoIt seems pretty hard these days to misconfigure and S3 bucket. The default settings are not public.
- drtillberg 6y agoThe article is about auto accident claims data, which is a great clue that HIPAA actually doesn't apply. From a different part of the Internet[1]: "There are certain gaps [in HIPAA coverage], like if a person meets with an accident on a car; the health insurer as well as the auto insurer shall receive the medical bills of that person. The health insurer is responsible for protecting the health data of this person under HIPAA; the auto insurer on the other hand does not hold that duty." [1] https://www.andrealopezv.com/new-age-security-solutions-to-protect-healthcare-data/ https://www.andrealopezv.com/new-age-security-solutions-to-p...
- leetrout 6y agoFascinating.
- dekhn 6y agoThe company is almost certainly not a covered entity, and therefore HIPAA doesn't apply. The amount of bullshit stated around HIPAA is ridiculous
- leetrout 6y agoCould you elaborate with some links or something? What is a covered entity?
- dekhn 6y agohttps://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Covered%20entities%20are%20defined%20in,which%20HHS%20has%20adopted%20standards https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Cov....
- leetrout 6y agoIn the context of this and ignoring the insurance loophole mentioned (which probably applies here as another poster pointed out) I don’t see how this company wouldn’t be covered as a business associate where HIPAA would extend to them even though, as you point out, they aren’t a coveted entity.
- Chris2048 6y agoThen how are they allowed to handle this data?
- dekhn 6y agoHIPAA has a ton of limitations. It doesn't just apply to everybody handling medical data. For example I worked for a biotech and we processed clinical records, HIPAA didn't apply to us but we complied with the regulations anyway.
- deleted 6y ago[deleted]
- croes 6y agoAnd then? They file for insolvency but the data is still out there.
- ycombonator 6y agoSure if they can catch them. Cense is based in India.
- tmp_ta 6y agoThe "AI company" is literally just two guys in India. One is the app developer and the other has a background in business and project management.