12 ms·

I have a semi-related anecdote about surprises from devices. I use a CPAP. After a year, I went back to the doctor for a followup, and was asked to bring the S

I have a semi-related anecdote about surprises from devices. I use a CPAP. After a year, I went back to the doctor for a followup, and was asked to bring the SD card so they could review the data it collects. The device records the times and duration of use, various settings, and some metrics on breathing (apnea events, etc). I knew it recorded this stuff on an SD card. I brought the card to the appointment, but the doctor said "I don't need that, I have your data here." It turns out that the CPAP contains a cellular modem, and it phones home and reports in real-time. I had no idea this thing was recording any data at all. It wasn't verbally disclosed to me by either the doctor or the equipment technicians. I imagine there's something buried in the fine print of the (long lost) documentation, possibly even in the fine print of some form I signed, but I was caught off guard and none too pleased. I've since done some research on this and discussed it with my new doctor when it came time to get a new CPAP. The doctor acted surprised by me having a problem with it. She immediately jumped to the defense of the manufacturer and insurance company, claiming that they "needed" that data. She said that if I disabled it, insurance would refuse coverage. This is insanely invasive, even with disclosure, and ought to be illegal without explicit, obvious verbal and written disclosure. The insurance defense is complete bullshit. For one, I paid cash for the CPAP because I had a high-deductible insurance plan and would have had to pay out-of-pocket anyway (and never claimed it even for the deductible offset). I realize a CPAP isn't a fridge, and there's at least a case to be made for insurance enforcing compliance (at least when insurance claims are involved). I don't agree with the undisclosed enforcement mechanism, nor do I agree that treatment should be contingent on monitoring (it is for some other treatments, but not for most; no one is monitoring diet, exercise, drug use, cigarette consumption, or other risky behaviors, and threatening to withhold treatment for non-compliance). Anyway, I've ranted enough, but there's a serious problem with the normalization of surveillance technology.

larrik 5y ago
Interesting, this was made super clear to me, and even included instructions to leave it plugged in for at least 40 minutes after waking up in the morning so it can communicate. Generally the insurance companies don't like paying for supplies for people who aren't actually using them, and need to see that you use it for an average of 4 hours per night or whatever.
- Lev1a 5y ago
  > need to see that you use it for an average of 4 hours per night or whatever That could just as easily be achieved by the method of locally recording on the SD card GP mentioned above without uploading who-knows-what about the device, your body, maybe even the surrounding area and other people to who-the-fuck-knows-where.
  - margalabargala 5y ago
    This doesn't really solve anything. It can equally easily be recording exactly all of that data into some encrypted format on the SD card, which then gets uploaded to the manufacturer when opened with the proprietary application necessary to view the data. The only difference is the choice over exactly when the data is uploaded, which in the US with its insurance system, results in no choice at all.
- chuckee 5y ago
  > need to see that you use it You mean "want". I'm sure if we let them, they'd try to convince us they also "need" to monitor our diet and exercise (and whatever else would incidentally be recorded) to make sure we're following doctor's recommendations on that.
ggsp 5y ago
> no one is monitoring diet, exercise, drug use, cigarette consumption, or other risky behaviors, and threatening to withhold treatment for non-compliance ... yet.
- bserge 5y ago
  But try to withhold payment if you get no treatment - deary me, no no no, that sends you to jail (really, in some places).
- protomyth 5y ago
  yeah yet https://www.youtube.com/watch?v=RNJl9EEcsoE https://www.youtube.com/watch?v=RNJl9EEcsoE Still on track after a decade
- dylan604 5y ago
  That you know of. All of this data is collected and made available if you are paying for things with a card. Hypothetically, insurance carriers could be seeing exactly what you buy, from where, and how often. If you have a gym membership (as shady as gyms are, it would not surprise me to learn they not only provide membership but attendance records as well), they can glean if you are active. blah blah, metadata is innocent.
  - lotsofpulp 5y ago
    Most people will gladly hand over this information to insurance companies in exchange for lower premiums.
    - dylan604 5y ago
      Most people would ultimately be charged higher premiums if they did hand this data over. Ins: In the last week, you've purchased 3 packages of Oreos, 2 cans of Crisco, 3lbs of 73% ground beef, no vegetables, lots of stuff with high sugar content, high salt content, and very little actual nutritional value. Therefore, we rank you in a high risk category (since you are clearly over 21 years old) based on the fact you also bought 1 carton of cigarettes and 2 cases of beer. Please enjoy your new higher insurance premium.
bserge 5y ago
Insurance is a racket everywhere apparently.
- salawat 5y ago
  It's supposed to be a capital allocation optimizer and risk mitigator. Unfortunately, without hard limits on things, it degenerates to financial control mechanism formost people.
  - Aerroon 5y ago
    I don't see why most common types of insurance aren't offered by governments. The government has the largest pool of cash and it's not like insurance has much room for innovation. Most types of innovation in insurance is about figuring out ways to not pay out insurance claims. Ie 'innovation' by an insurance company means a worse product for the customers.
crote 5y ago
I don't know anything about the laws here - but isn't this medical data? Doesn't HIPAA make this sort of stuff illegal?
- caymanjim 5y ago
  HIPAA doesn't prohibit the collection and sharing of health data. It provides a framework for how such activities must be performed, describes standards and practices for data security, limits whom the data can be shared with, and, yes, requires certain disclosures. But there's no HIPAA violation if your doctor, medical equipment provider/manufacturer, and insurance company share data within those parameters. I'm sure I signed something authorizing it, in the giant stack of paperwork I filled out along the way, but who reads every word of that nonsense? It's practically designed to overwhelm the patient. I read a lot more of those forms than anyone else I know, but I still have to skim a lot and they're always presented in a high-anxiety environment. No one can or should be expected to pay that much attention to legalese in a doctor's office.
- colechristensen 5y ago
  HIPAA enables and restricts data collection, storage, and sharing but in general you consented to it. A current problem with HIPAA is that the consent forms do not clearly enough describe what is being agreed to such that someone can’t make an informed decision and there really isn’t an option to say “no” to things and still receive care without going somewhere else. HIPAA also does not require consent to sharing “deidentified” data which has been shown many times to be relatively easy to unmask to discover who the records belong to. Basically it needs updates from technical and privacy focused people but that’s a hard sell when people don’t really know how things work.
  - macksd 5y ago
    Consent in a medical context honestly means nothing to me anymore. Do you know how many times I've been asked to sign an electronic pad without seeing what I'm signing, asked for the form beforehand, and be told they can't give it to me until I sign it? It's absurd. They just collect an image of your signature and apply it to whatever they want. They will eventually cave if you make a big enough fuss, but unless you're Richard Stallman, no one is going to keep doing that every time. edit: My hack in this case is now to legibly write "Can't see form" as my signature. No one has called me on it yet but I'm dying for the next disputed bill.
horsawlarway 5y ago
I agree that this is both invasive and a huge violation. My wife had pretty severe sleep apnea in the third trimester of her pregnancy, two experiences that make me think this practice needs to be nuked from orbit. 1. We properly read the manual for the device and adjusted the pressure so that it didn't cause problems with burping/ingesting air during sleep. Tissue gets softer in women as they near birth and the body releases a whole host of different hormones - one that gets softer is the pharynx which keeps air out of the stomach as you breathe. After three days - They had the gall to call and inform us that they had noted the change and reset our settings. We had been tracking sleep events on the device ourselves and they hadn't changed (still ~1 per hour while using, the same as the original pressure setting) so there was zero reason for them to do this. 2. After she gave birth, her sleep apnea essentially disappeared (at it's worst it was ~40 events an hour, 3 weeks after birth it was essentially just light snoring again). Did not matter at all - They insisted she use the machine still. Called repeatedly and harassed us. --- It took written revocation of their rights to treat us, and then the threat of a lawsuit before the calls stopped. This needs to be illegal - NOW.
- tartoran 5y ago
  Wow! Im speechless and a bit afraid of what’s to come from the IoT/medical/surveilance industry
- bavell 5y ago
  This is really disturbing and it's disgusting how some companies out there act. We desperately need our leaders to address issues like this but they're all too busy pandering to and being lobbied by the very companies who are doing the abusing...
  - taylodl 5y ago
    Let's generalize this statement - we desperately need leaders. Our current crew of so-called "leaders" are only interested in lining their pockets.
    - jjoonathan 5y ago
reaperducer 5y ago
She said that if I disabled it, insurance would refuse coverage. This is true. That's how i found out that one of my medical devices has s cellular modem: I got a letter from the DME company saying that if i didn't use it more hours, my insurance would refuse to cover it and I'd have to pay the balance. Where i lived, i had terrible cellular service, so i had to get an exemption from the insurance company and make sure to bring the SD card to my doctor quarterly to ensure the insurance company would continue to pay for it.
- dylan604 5y ago
  Have you looked at the data on the SD card? Can it be manipulated in any way as to show that it is being used even if not?
  - caymanjim 5y ago
    I've looked at it. It's not human-friendly, but it's not secured in any way. It would be trivial for anyone with basic programming chops to modify it.
  - reaperducer 5y ago
    Yes. There are programs that will open the files and display the data. Some even make charts. But it was all pretty boring stuff.
PrivateButts 5y ago
I was told about the cellular connection by my respiratory therapist. Mine even has an app that has achievements for proper and continuous usage. It also goes into pretty good detail about what you're screwing up if you aren't getting good mask seal. Even got a call from my therapist after two weeks following up with me about the data he received. AFAIK this is what home medical equipment seems to be moving too. My dad's external pacemaker had a base station that phoned home over cellular as well. If I wasn't wholly depended on the device I'd be very interested in poking around inside of it. I'd be very interested in learning what it's collecting, and maybe someone living in a area with laws allowing users to request their data should follow up with them.
- caymanjim 5y ago
  I like data. I would like to review all the metrics my medical device collects. I'd welcome an app to make it even easier to view. That's all pro-consumer. That can be done by storing data on SD cards; via a USB connection; via built-in Bluetooth or WiFi. It's an easily-solved problem, and with modern wireless networking, something that the average consumer can navigate without much trouble. Even for the most tech-unsavvy patient, a removable SD card that you can bring to your doctor is a fine solution. The problem starts when third parties are involved. Now I've got a CPAP with a cellular modem in it. Where is that data going? Who's processing it? Who are they sharing it with? What are the security precautions? Can they change settings without me knowing? At least the thing doesn't have a microphone on it too... Even beyond medical privacy, I've now got a device that reports where I am and when I'm asleep, to who-knows-who. That's a wealth of data and I have no idea who it's being shared with. I realize that my cellphone is an even better surveillance device, but I trust my cellphone provider a lot more than I trust all the companies involved in CPAP manufacture and monitoring. Google and Apple are a whole lot better at security than some medical company that outsources data management.
  - Aerroon 5y ago
    >At least the thing doesn't have a microphone on it too... How do you know? If they're doing tracking where tracking isn't necessary and don't disclose the full extent of tracking under some penalty for lying, then maybe the machine does have a microphone in it? How would you know without taking it apart? It's not like the doctor or device manufacturer are trustworthy on the privacy front.
hellbannedguy 5y ago
In this case I'm on the fence. Say you are not breathing, and the machine is working, but not up to manufacture's specs. They have the data. They should inform you of a malfunctioning machine? Since they have the data, it's incumbent on them to inform you of the state of the malfunctioning cpac machine? If they don't get back informing you of a faulty machine, a lawyer could subpoena those cell phone records/data? And maybe have a case?
- caymanjim 5y ago
  They don't do any of those things (at least not for me; there's a sibling reply where someone was harassed for non-compliance). If I don't use the device, no one contacts me. I lost power a few times and couldn't use it; I pulled a couple all-nighters over the years; I left it behind on a weekend trip once; I had a stretch of sleeping problems where I didn't sleep more than a couple hours a night for a week; I adjusted the device outside the doctor's parameters; I had innumerable problems with poor mask fit/leaks. All these metrics were broadcast by the CPAP, and all would have been a concern of my doctor, but it's got nothing to do with patient health. This is all about gathering evidence to deny future care, whether it be new equipment or coverage for more extreme situations related to non-compliance.
- deelowe 5y ago
  You can make this argument about literally anything. Should your tires contain GPS trackers and share that info with their manufacturer on the off chance that you sped, drove on the wrong surface, or there was a manufacturing defect that could possibly lead to an accident? This shit needs to stop. It's getting out of hand fast. In just a few years, literally every powered device we own will be logging video, sound, location, and network traffic in real time continuously. What's to stop equifax from leveraging all this new info for credit reports? Insurance companies for premiums? Lawyers for civil defense? Class action lawsuits? Police? Divorce proceedings? We are not heading in a good direction here. A police state is bad in and of itself, but swapping the police with a "free and unregulated market" is infinitely worse.
  - freedomben 5y ago
salawat 5y ago
Welcome to realizing Insurance companies are soft control mechanisms and one of the worst in terms of justifying rampant data aggregation to keep the actuaries busy. Also welcome to privacy violation via undisclosed industry collaboration. You'll find the same pattern pops up just about everywhere.
- lotsofpulp 5y ago
  Do people have the right to lower their own insurance premiums in exchange for voluntarily giving up their data?
  - salawat 5y ago
    Do people have the right through collective indirection to implement blatantly discriminatory control mechanisms that obfuscate the actual costs of things? (I'd argue not.) Do people have the right to sell themselves into slavery? (Not in the United States) There's just some transactions that aren't bueno, because of the higher order effects they cause. I see normalizing surveillance as a case of that. I'm not even sure that most on aggregate even end up realizing premium savings since the data collected just filters into the new base truth for everyone. The more info an insurer has, the more lopsided the state of affairs for everyone else. I'm all for freedom when you aren't just effectively creating soft, coercive, control mechanisms.
    - lotsofpulp 5y ago
      >Do people have the right through collective indirection to implement blatantly discriminatory control mechanisms that obfuscate the actual costs of things? (I'd argue not.) More accurately distributing cost of risks to those engaging in the risky behavior seems like it would be the opposite of obfuscating costs. Tobacco users pay more, why shouldn’t alcohol users? Or sugar users?
jt2190 5y ago
> no one is monitoring diet, exercise, drug use, cigarette consumption, or other risky behaviors, and threatening to withhold treatment for non-compliance). While an employer-sponsored health plan does not “withhold treatment” per se, they definitely draw a line around what they’ll pay for. Part of the physician’s (or more typically the hospital’s or physician group’s) reimbursement is contingent on whether the patient adheres to the treatment regimen [1] which incentivizes things like automated tracking. Even though you have a high-deductible plan, you’re still involving your health insurance provider in the transaction. It’s not quite the same as a “cash for service” relationship. [1] https://www.medscape.com/features/content/6006314 https://www.medscape.com/features/content/6006314
- spookthesunset 5y ago
  > Even though you have a high-deductible plan, you’re still involving your health insurance provider in the transaction Depends. If you are planning to use that amount as part of your deductible, then insurance has a stake in it. If you don't ping your insurance at all, then insurance should have zero say over it at all.
srmarm 5y ago
It's a shame how much great technology will go to waste because businesses work against our best interests and pull shit like this.
- matheusmoreira 5y ago
  Yeah. It's infuriating. It's like we can't trust them not to fuck us over. The technology is good for us but at some point someone somewhere came along and corrupted it with all these "features" that exist solely to serve their business interests.
ScoobleDoodle 5y ago
I’m able to turn off the cell connection on my CPAP with airplane mode. I have a ResMed AirSense 10 that I got 4+ years ago and in the “MyOptions” section it has an “Airplane Mode” menu item which can be set to “On” to turn off the cellular connection. I agree with all that you said about it reporting home and compliance. I also found it surprising how strict it was to be compliant. I needed a 2 or 3 month uninterrupted streak of 4 hour+ usage per night. I had to email the data to my insurance since I had it on airplane mode.
- caymanjim 5y ago
  Yeah, I later learned about the airplane mode option. I would have used that, but at some point the screen on my CPAP (also a ResMed AirSense 10) smashed, so I was unable to engage airplane mode. I was able to get a copy of the ResScan software (intended for clinicians), which allowed me to adjust the pressure and other clinical settings, so I continued to use it (although it was incredibly inconvenient as it involved removing the SD card and using my PC). That's when I tried taking the machine apart and physically disconnecting the modem, but it wouldn't operate that way (and with no screen, I couldn't see if there was some simple dialog I had to dismiss to get it to work with no modem). Really, though, I don't think any of this should apply, as I paid cash out of pocket for both the doctor visits and the CPAP machine itself. No one had any legitimate claim to the data.
xenocyon 5y ago
I have a CPAP machine. Your doctor is telling the truth. If insurance is involved (even if it's a high-deductible plan and you haven't hit the deductible), they typically require the data verifying usage. You're directing blame at the doctor, but it's the insurance company making the rules, not the doctor.
- AnimalMuppet 5y ago
  Doesn't matter. It's not OK for the doctor to do this, and it's not OK for the insurance company either.
- caymanjim 5y ago
  I didn't direct any blame at anyone, although I do think the equipment provider was negligent in not explicitly making me aware of the modem. And there was no insurance involvement. I paid cash for the doctor and I paid cash for the CPAP. I could have reported it to my insurer so that it would have come off my deductible, but I didn't (mostly because I'm lazy, but also in large part because I only have insurance for something like cancer that would bankrupt me). I told my new doctor I didn't want a modem in the replacement CPAP and told her why, and was surprised that she really didn't seem to get it.
  - xenocyon 5y ago
    In that case, depending on your hardware, you might be able to simply disable wireless transmission (on my CPAP machine, this is called "Airplane Mode").
mcguire 5y ago
"I brought the card to the appointment, but the doctor said "I don't need that, I have your data here." It turns out that the CPAP contains a cellular modem, and it phones home and reports in real-time. I had no idea this thing was recording any data at all. It wasn't verbally disclosed to me by either the doctor or the equipment technicians. I imagine there's something buried in the fine print of the (long lost) documentation, possibly even in the fine print of some form I signed, but I was caught off guard and none too pleased." Really? My doctor and the dude who configured and walked me through the CPAP use both emphasized that it collected data on the SD card but that its cell modem would also report the data to the doctor and the supplier. And keep in mind, a CPAP is kind of invasive by nature.
officeplant 5y ago
Makes me wonder what would happen if you just put it in a faraday cage and blamed poor cell coverage at your home.
mensetmanusman 5y ago
Imagine a future employer bringing up how many times you snored last night.
- matheusmoreira 5y ago
  Imagine your car refusing to start because you didn't get your required CPAP sleep last night.
seized 5y ago
If your CPAP is like mine it has a 2G modem. Mine stopped working when those networks were shut down, so it's SD card only now. Forces the solution nicely.
matheusmoreira 5y ago
Aren't CPAP usage patterns supposed to be medical information? That's frightening.
zzo38computer 5y ago
> It turns out that the CPAP contains a cellular modem, and it phones home and reports in real-time. I had no idea this thing was recording any data at all. It wasn't verbally disclosed to me by either the doctor or the equipment technicians. I imagine there's something buried in the fine print of the (long lost) documentation, possibly even in the fine print of some form I signed, but I was caught off guard and none too pleased. I should think that perhaps the legal requirements should be: 1. Its capability of wireless communcation, and a brief description of what it does, and the power and frequency it uses, should be clearly marked on the package. 2. The included documentation should need to describe the details of the wireless communication, including whatever is mentioned on the package. 3. There should be required it can be disabled without disabling its other functions, and this feature must be documented. The other things that you mention too, should be applicable. I agree with you that "I don't agree with the undisclosed enforcement mechanism, nor do I agree that treatment should be contingent on monitoring" and that "This is insanely invasive, even with disclosure, and ought to be illegal without explicit, obvious verbal and written disclosure". The medical devices should not be doing such surveillance (and medical devices should ideally not require a computer, either).
- HeyLaughingBoy 5y ago
  > medical devices should ideally not require a computer, I can accept that you may have no knowledge of the ridiculous complexity of modern medical devices, but if you're a software developer I would expect that you realize there are computers in everything The device isn't "surveilling" you. It's reporting therapy-relevant, and probably device performance, information that is actually important both to the clinic and the device manufacturer. The "low-tech" alternative would be you going into the physician's office once a week for a checkup. I'm pretty sure most people would prefer that it upload the data.
  - zzo38computer 5y ago
    > I can accept that you may have no knowledge of the ridiculous complexity of modern medical devices That is correct, I don't know. However, they are made more complicated and then might fail (e.g. if the power runs out). > if you're a software developer I would expect that you realize there are computers in everything Many things do these days, but I think that computers should not be needed in everything, even some that do. > The "low-tech" alternative would be you going into the physician's office once a week for a checkup. I'm pretty sure most people would prefer that it upload the data. Yes, although it shouldn't be required, in case a few people do prefer an alternative (that isn't the only one, although it is a possibility).
NGRhodes 5y ago
Conversely, I have a new F&P CPAP machine and it was clear this machine has a built sim card and an app can be used to download the data via bluetoothfrom is explained in the instructions. My Sleep Doctor even told me. I don't have to worry about insurance compliance (mine is through the NHS, UK).
coryfklein 5y ago
I was very fortunate to be warned about these CPAP woes and hassles by a friend who went through it before I did. His advice? If you think you might have sleep apnea, do NOT get diagnosed, just buy a CPAP machine second hand and see if it helps you feel better. I did, and the CPAP helped a lot. Eventually I figured out that simply sleeping reclined (on a triagle pillow) actually gave me 90% of the benefits with 0% of the hassle of the mask though.
- caymanjim 5y ago
  It's valuable to have a doctor who can help you diagnose the problem and get the machine set correctly; technicians who can help with mask fitting and explain proper usage and maintenance; and followups to monitor effects. Some people might be able to manage those things on their own, and I certainly feel that people who already saw a doctor and own a CPAP should be able to manage their care if nothing changes. I don't think it's good advice to self-diagnose, buy used equipment, and hope you get it right. CPAP quality degrades over time, for one. Some people might benefit from a CPAP, but really need a more complex and expensive machine like a BiPAP. Some people have central sleep apnea rather than obstructive sleep apnea. Some people would be better off with surgery or implanted devices. These are not things one should be figuring out on one's own. If none of that is convincing, in the US it's illegal to sell a CPAP to someone without a prescription. I honestly don't care about that part, and if I knew how to order a new CPAP directly (perhaps from Canada or something), I would personally do it and skip the doctors entirely, but I don't think it's good advice, especially before you're properly diagnosed.
  - pareidolia 5y ago
    > If none of that is convincing, in the US it's illegal to sell a CPAP to someone without a prescription. Like that means anything. I've bought a DSX900 ASV machine from the US, no problem. I've been self-treating UARS for 4 years now. None of the "sleep doctors" I've talked to even understand the thing, I had to do everything myself.
danudey 5y ago
I was made aware of this feature on my CPAP machine, though it was only mentioned in passing. I'm not super crazy about sending the data to the manufacturer, but I do very much like having it available to my sleep therapist. As an example: recently, I started snoring more and more, though I didn't realize the extent of it until my wife told me that she couldn't sleep at all the night before. Concerned, I called my sleep therapist, and they brought up my file, looked at the data, and made an adjustment to the settings (I presume the pressure) right there while I was on the phone. The next night, my wife and I both slept great. That said, I wasn't given the explicit choice to opt in or to opt out, and while I would have chosen to opt in, I'd wager there are a ton of people out there just like you who would be very upset to know that their sleep patterns are being sent to another company (or anywhere, really) without their consent.
obloid 5y ago
I discovered the cellular modem in my cpap shortly after I got it and promptly took it out. If you're interested in monitoring your own sleep data check out sleepyhead https://sleepyhead.jedimark.net/ https://sleepyhead.jedimark.net/. It's a great app, but unfortunately it looks like the developer is no longer working on the project.
chy3dz 5y ago
That is unacceptable response from your doctor. I feel like I'd be looking for a new doctor after that.

larrik 5y ago

Interesting, this was made super clear to me, and even included instructions to leave it plugged in for at least 40 minutes after waking up in the morning so it can communicate. Generally the insurance companies don't like paying for supplies for people who aren't actually using them, and need to see that you use it for an average of 4 hours per night or whatever.

Lev1a 5y ago
> need to see that you use it for an average of 4 hours per night or whatever That could just as easily be achieved by the method of locally recording on the SD card GP mentioned above without uploading who-knows-what about the device, your body, maybe even the surrounding area and other people to who-the-fuck-knows-where.
- margalabargala 5y ago
  This doesn't really solve anything. It can equally easily be recording exactly all of that data into some encrypted format on the SD card, which then gets uploaded to the manufacturer when opened with the proprietary application necessary to view the data. The only difference is the choice over exactly when the data is uploaded, which in the US with its insurance system, results in no choice at all.
chuckee 5y ago
> need to see that you use it You mean "want". I'm sure if we let them, they'd try to convince us they also "need" to monitor our diet and exercise (and whatever else would incidentally be recorded) to make sure we're following doctor's recommendations on that.

ggsp 5y ago

> no one is monitoring diet, exercise, drug use, cigarette consumption, or other risky behaviors, and threatening to withhold treatment for non-compliance ... yet.

bserge 5y ago
But try to withhold payment if you get no treatment - deary me, no no no, that sends you to jail (really, in some places).
protomyth 5y ago
yeah yet https://www.youtube.com/watch?v=RNJl9EEcsoE https://www.youtube.com/watch?v=RNJl9EEcsoE Still on track after a decade
dylan604 5y ago
That you know of. All of this data is collected and made available if you are paying for things with a card. Hypothetically, insurance carriers could be seeing exactly what you buy, from where, and how often. If you have a gym membership (as shady as gyms are, it would not surprise me to learn they not only provide membership but attendance records as well), they can glean if you are active. blah blah, metadata is innocent.
- lotsofpulp 5y ago
  Most people will gladly hand over this information to insurance companies in exchange for lower premiums.
  - dylan604 5y ago
    Most people would ultimately be charged higher premiums if they did hand this data over. Ins: In the last week, you've purchased 3 packages of Oreos, 2 cans of Crisco, 3lbs of 73% ground beef, no vegetables, lots of stuff with high sugar content, high salt content, and very little actual nutritional value. Therefore, we rank you in a high risk category (since you are clearly over 21 years old) based on the fact you also bought 1 carton of cigarettes and 2 cases of beer. Please enjoy your new higher insurance premium.

bserge 5y ago

Insurance is a racket everywhere apparently.

salawat 5y ago
It's supposed to be a capital allocation optimizer and risk mitigator. Unfortunately, without hard limits on things, it degenerates to financial control mechanism formost people.
- Aerroon 5y ago
  I don't see why most common types of insurance aren't offered by governments. The government has the largest pool of cash and it's not like insurance has much room for innovation. Most types of innovation in insurance is about figuring out ways to not pay out insurance claims. Ie 'innovation' by an insurance company means a worse product for the customers.

crote 5y ago

I don't know anything about the laws here - but isn't this medical data? Doesn't HIPAA make this sort of stuff illegal?

caymanjim 5y ago
HIPAA doesn't prohibit the collection and sharing of health data. It provides a framework for how such activities must be performed, describes standards and practices for data security, limits whom the data can be shared with, and, yes, requires certain disclosures. But there's no HIPAA violation if your doctor, medical equipment provider/manufacturer, and insurance company share data within those parameters. I'm sure I signed something authorizing it, in the giant stack of paperwork I filled out along the way, but who reads every word of that nonsense? It's practically designed to overwhelm the patient. I read a lot more of those forms than anyone else I know, but I still have to skim a lot and they're always presented in a high-anxiety environment. No one can or should be expected to pay that much attention to legalese in a doctor's office.
colechristensen 5y ago
HIPAA enables and restricts data collection, storage, and sharing but in general you consented to it. A current problem with HIPAA is that the consent forms do not clearly enough describe what is being agreed to such that someone can’t make an informed decision and there really isn’t an option to say “no” to things and still receive care without going somewhere else. HIPAA also does not require consent to sharing “deidentified” data which has been shown many times to be relatively easy to unmask to discover who the records belong to. Basically it needs updates from technical and privacy focused people but that’s a hard sell when people don’t really know how things work.
- macksd 5y ago
  Consent in a medical context honestly means nothing to me anymore. Do you know how many times I've been asked to sign an electronic pad without seeing what I'm signing, asked for the form beforehand, and be told they can't give it to me until I sign it? It's absurd. They just collect an image of your signature and apply it to whatever they want. They will eventually cave if you make a big enough fuss, but unless you're Richard Stallman, no one is going to keep doing that every time. edit: My hack in this case is now to legibly write "Can't see form" as my signature. No one has called me on it yet but I'm dying for the next disputed bill.

horsawlarway 5y ago

I agree that this is both invasive and a huge violation. My wife had pretty severe sleep apnea in the third trimester of her pregnancy, two experiences that make me think this practice needs to be nuked from orbit. 1. We properly read the manual for the device and adjusted the pressure so that it didn't cause problems with burping/ingesting air during sleep. Tissue gets softer in women as they near birth and the body releases a whole host of different hormones - one that gets softer is the pharynx which keeps air out of the stomach as you breathe. After three days - They had the gall to call and inform us that they had noted the change and reset our settings. We had been tracking sleep events on the device ourselves and they hadn't changed (still ~1 per hour while using, the same as the original pressure setting) so there was zero reason for them to do this. 2. After she gave birth, her sleep apnea essentially disappeared (at it's worst it was ~40 events an hour, 3 weeks after birth it was essentially just light snoring again). Did not matter at all - They insisted she use the machine still. Called repeatedly and harassed us. --- It took written revocation of their rights to treat us, and then the threat of a lawsuit before the calls stopped. This needs to be illegal - NOW.

tartoran 5y ago
Wow! Im speechless and a bit afraid of what’s to come from the IoT/medical/surveilance industry
bavell 5y ago
This is really disturbing and it's disgusting how some companies out there act. We desperately need our leaders to address issues like this but they're all too busy pandering to and being lobbied by the very companies who are doing the abusing...
- taylodl 5y ago
  Let's generalize this statement - we desperately need leaders. Our current crew of so-called "leaders" are only interested in lining their pockets.
  - jjoonathan 5y ago

reaperducer 5y ago

She said that if I disabled it, insurance would refuse coverage. This is true. That's how i found out that one of my medical devices has s cellular modem: I got a letter from the DME company saying that if i didn't use it more hours, my insurance would refuse to cover it and I'd have to pay the balance. Where i lived, i had terrible cellular service, so i had to get an exemption from the insurance company and make sure to bring the SD card to my doctor quarterly to ensure the insurance company would continue to pay for it.

dylan604 5y ago
Have you looked at the data on the SD card? Can it be manipulated in any way as to show that it is being used even if not?
- caymanjim 5y ago
  I've looked at it. It's not human-friendly, but it's not secured in any way. It would be trivial for anyone with basic programming chops to modify it.
- reaperducer 5y ago
  Yes. There are programs that will open the files and display the data. Some even make charts. But it was all pretty boring stuff.

PrivateButts 5y ago

I was told about the cellular connection by my respiratory therapist. Mine even has an app that has achievements for proper and continuous usage. It also goes into pretty good detail about what you're screwing up if you aren't getting good mask seal. Even got a call from my therapist after two weeks following up with me about the data he received. AFAIK this is what home medical equipment seems to be moving too. My dad's external pacemaker had a base station that phoned home over cellular as well. If I wasn't wholly depended on the device I'd be very interested in poking around inside of it. I'd be very interested in learning what it's collecting, and maybe someone living in a area with laws allowing users to request their data should follow up with them.

caymanjim 5y ago
I like data. I would like to review all the metrics my medical device collects. I'd welcome an app to make it even easier to view. That's all pro-consumer. That can be done by storing data on SD cards; via a USB connection; via built-in Bluetooth or WiFi. It's an easily-solved problem, and with modern wireless networking, something that the average consumer can navigate without much trouble. Even for the most tech-unsavvy patient, a removable SD card that you can bring to your doctor is a fine solution. The problem starts when third parties are involved. Now I've got a CPAP with a cellular modem in it. Where is that data going? Who's processing it? Who are they sharing it with? What are the security precautions? Can they change settings without me knowing? At least the thing doesn't have a microphone on it too... Even beyond medical privacy, I've now got a device that reports where I am and when I'm asleep, to who-knows-who. That's a wealth of data and I have no idea who it's being shared with. I realize that my cellphone is an even better surveillance device, but I trust my cellphone provider a lot more than I trust all the companies involved in CPAP manufacture and monitoring. Google and Apple are a whole lot better at security than some medical company that outsources data management.
- Aerroon 5y ago
  >At least the thing doesn't have a microphone on it too... How do you know? If they're doing tracking where tracking isn't necessary and don't disclose the full extent of tracking under some penalty for lying, then maybe the machine does have a microphone in it? How would you know without taking it apart? It's not like the doctor or device manufacturer are trustworthy on the privacy front.

hellbannedguy 5y ago

In this case I'm on the fence. Say you are not breathing, and the machine is working, but not up to manufacture's specs. They have the data. They should inform you of a malfunctioning machine? Since they have the data, it's incumbent on them to inform you of the state of the malfunctioning cpac machine? If they don't get back informing you of a faulty machine, a lawyer could subpoena those cell phone records/data? And maybe have a case?

caymanjim 5y ago
They don't do any of those things (at least not for me; there's a sibling reply where someone was harassed for non-compliance). If I don't use the device, no one contacts me. I lost power a few times and couldn't use it; I pulled a couple all-nighters over the years; I left it behind on a weekend trip once; I had a stretch of sleeping problems where I didn't sleep more than a couple hours a night for a week; I adjusted the device outside the doctor's parameters; I had innumerable problems with poor mask fit/leaks. All these metrics were broadcast by the CPAP, and all would have been a concern of my doctor, but it's got nothing to do with patient health. This is all about gathering evidence to deny future care, whether it be new equipment or coverage for more extreme situations related to non-compliance.
deelowe 5y ago
You can make this argument about literally anything. Should your tires contain GPS trackers and share that info with their manufacturer on the off chance that you sped, drove on the wrong surface, or there was a manufacturing defect that could possibly lead to an accident? This shit needs to stop. It's getting out of hand fast. In just a few years, literally every powered device we own will be logging video, sound, location, and network traffic in real time continuously. What's to stop equifax from leveraging all this new info for credit reports? Insurance companies for premiums? Lawyers for civil defense? Class action lawsuits? Police? Divorce proceedings? We are not heading in a good direction here. A police state is bad in and of itself, but swapping the police with a "free and unregulated market" is infinitely worse.
- freedomben 5y ago

salawat 5y ago

Welcome to realizing Insurance companies are soft control mechanisms and one of the worst in terms of justifying rampant data aggregation to keep the actuaries busy. Also welcome to privacy violation via undisclosed industry collaboration. You'll find the same pattern pops up just about everywhere.

lotsofpulp 5y ago
Do people have the right to lower their own insurance premiums in exchange for voluntarily giving up their data?
- salawat 5y ago
  Do people have the right through collective indirection to implement blatantly discriminatory control mechanisms that obfuscate the actual costs of things? (I'd argue not.) Do people have the right to sell themselves into slavery? (Not in the United States) There's just some transactions that aren't bueno, because of the higher order effects they cause. I see normalizing surveillance as a case of that. I'm not even sure that most on aggregate even end up realizing premium savings since the data collected just filters into the new base truth for everyone. The more info an insurer has, the more lopsided the state of affairs for everyone else. I'm all for freedom when you aren't just effectively creating soft, coercive, control mechanisms.
  - lotsofpulp 5y ago
    >Do people have the right through collective indirection to implement blatantly discriminatory control mechanisms that obfuscate the actual costs of things? (I'd argue not.) More accurately distributing cost of risks to those engaging in the risky behavior seems like it would be the opposite of obfuscating costs. Tobacco users pay more, why shouldn’t alcohol users? Or sugar users?

jt2190 5y ago

> no one is monitoring diet, exercise, drug use, cigarette consumption, or other risky behaviors, and threatening to withhold treatment for non-compliance). While an employer-sponsored health plan does not “withhold treatment” per se, they definitely draw a line around what they’ll pay for. Part of the physician’s (or more typically the hospital’s or physician group’s) reimbursement is contingent on whether the patient adheres to the treatment regimen [1] which incentivizes things like automated tracking. Even though you have a high-deductible plan, you’re still involving your health insurance provider in the transaction. It’s not quite the same as a “cash for service” relationship. [1] https://www.medscape.com/features/content/6006314 https://www.medscape.com/features/content/6006314

spookthesunset 5y ago
> Even though you have a high-deductible plan, you’re still involving your health insurance provider in the transaction Depends. If you are planning to use that amount as part of your deductible, then insurance has a stake in it. If you don't ping your insurance at all, then insurance should have zero say over it at all.

srmarm 5y ago

It's a shame how much great technology will go to waste because businesses work against our best interests and pull shit like this.

matheusmoreira 5y ago
Yeah. It's infuriating. It's like we can't trust them not to fuck us over. The technology is good for us but at some point someone somewhere came along and corrupted it with all these "features" that exist solely to serve their business interests.

ScoobleDoodle 5y ago

I’m able to turn off the cell connection on my CPAP with airplane mode. I have a ResMed AirSense 10 that I got 4+ years ago and in the “MyOptions” section it has an “Airplane Mode” menu item which can be set to “On” to turn off the cellular connection. I agree with all that you said about it reporting home and compliance. I also found it surprising how strict it was to be compliant. I needed a 2 or 3 month uninterrupted streak of 4 hour+ usage per night. I had to email the data to my insurance since I had it on airplane mode.

caymanjim 5y ago
Yeah, I later learned about the airplane mode option. I would have used that, but at some point the screen on my CPAP (also a ResMed AirSense 10) smashed, so I was unable to engage airplane mode. I was able to get a copy of the ResScan software (intended for clinicians), which allowed me to adjust the pressure and other clinical settings, so I continued to use it (although it was incredibly inconvenient as it involved removing the SD card and using my PC). That's when I tried taking the machine apart and physically disconnecting the modem, but it wouldn't operate that way (and with no screen, I couldn't see if there was some simple dialog I had to dismiss to get it to work with no modem). Really, though, I don't think any of this should apply, as I paid cash out of pocket for both the doctor visits and the CPAP machine itself. No one had any legitimate claim to the data.

xenocyon 5y ago

I have a CPAP machine. Your doctor is telling the truth. If insurance is involved (even if it's a high-deductible plan and you haven't hit the deductible), they typically require the data verifying usage. You're directing blame at the doctor, but it's the insurance company making the rules, not the doctor.

AnimalMuppet 5y ago
Doesn't matter. It's not OK for the doctor to do this, and it's not OK for the insurance company either.
caymanjim 5y ago
I didn't direct any blame at anyone, although I do think the equipment provider was negligent in not explicitly making me aware of the modem. And there was no insurance involvement. I paid cash for the doctor and I paid cash for the CPAP. I could have reported it to my insurer so that it would have come off my deductible, but I didn't (mostly because I'm lazy, but also in large part because I only have insurance for something like cancer that would bankrupt me). I told my new doctor I didn't want a modem in the replacement CPAP and told her why, and was surprised that she really didn't seem to get it.
- xenocyon 5y ago
  In that case, depending on your hardware, you might be able to simply disable wireless transmission (on my CPAP machine, this is called "Airplane Mode").

mcguire 5y ago

"I brought the card to the appointment, but the doctor said "I don't need that, I have your data here." It turns out that the CPAP contains a cellular modem, and it phones home and reports in real-time. I had no idea this thing was recording any data at all. It wasn't verbally disclosed to me by either the doctor or the equipment technicians. I imagine there's something buried in the fine print of the (long lost) documentation, possibly even in the fine print of some form I signed, but I was caught off guard and none too pleased." Really? My doctor and the dude who configured and walked me through the CPAP use both emphasized that it collected data on the SD card but that its cell modem would also report the data to the doctor and the supplier. And keep in mind, a CPAP is kind of invasive by nature.

officeplant 5y ago

Makes me wonder what would happen if you just put it in a faraday cage and blamed poor cell coverage at your home.

mensetmanusman 5y ago

Imagine a future employer bringing up how many times you snored last night.

matheusmoreira 5y ago
Imagine your car refusing to start because you didn't get your required CPAP sleep last night.

seized 5y ago

If your CPAP is like mine it has a 2G modem. Mine stopped working when those networks were shut down, so it's SD card only now. Forces the solution nicely.

matheusmoreira 5y ago

Aren't CPAP usage patterns supposed to be medical information? That's frightening.

zzo38computer 5y ago

> It turns out that the CPAP contains a cellular modem, and it phones home and reports in real-time. I had no idea this thing was recording any data at all. It wasn't verbally disclosed to me by either the doctor or the equipment technicians. I imagine there's something buried in the fine print of the (long lost) documentation, possibly even in the fine print of some form I signed, but I was caught off guard and none too pleased. I should think that perhaps the legal requirements should be: 1. Its capability of wireless communcation, and a brief description of what it does, and the power and frequency it uses, should be clearly marked on the package. 2. The included documentation should need to describe the details of the wireless communication, including whatever is mentioned on the package. 3. There should be required it can be disabled without disabling its other functions, and this feature must be documented. The other things that you mention too, should be applicable. I agree with you that "I don't agree with the undisclosed enforcement mechanism, nor do I agree that treatment should be contingent on monitoring" and that "This is insanely invasive, even with disclosure, and ought to be illegal without explicit, obvious verbal and written disclosure". The medical devices should not be doing such surveillance (and medical devices should ideally not require a computer, either).

HeyLaughingBoy 5y ago
> medical devices should ideally not require a computer, I can accept that you may have no knowledge of the ridiculous complexity of modern medical devices, but if you're a software developer I would expect that you realize there are computers in everything The device isn't "surveilling" you. It's reporting therapy-relevant, and probably device performance, information that is actually important both to the clinic and the device manufacturer. The "low-tech" alternative would be you going into the physician's office once a week for a checkup. I'm pretty sure most people would prefer that it upload the data.
- zzo38computer 5y ago
  > I can accept that you may have no knowledge of the ridiculous complexity of modern medical devices That is correct, I don't know. However, they are made more complicated and then might fail (e.g. if the power runs out). > if you're a software developer I would expect that you realize there are computers in everything Many things do these days, but I think that computers should not be needed in everything, even some that do. > The "low-tech" alternative would be you going into the physician's office once a week for a checkup. I'm pretty sure most people would prefer that it upload the data. Yes, although it shouldn't be required, in case a few people do prefer an alternative (that isn't the only one, although it is a possibility).

NGRhodes 5y ago

Conversely, I have a new F&P CPAP machine and it was clear this machine has a built sim card and an app can be used to download the data via bluetoothfrom is explained in the instructions. My Sleep Doctor even told me. I don't have to worry about insurance compliance (mine is through the NHS, UK).

coryfklein 5y ago

I was very fortunate to be warned about these CPAP woes and hassles by a friend who went through it before I did. His advice? If you think you might have sleep apnea, do NOT get diagnosed, just buy a CPAP machine second hand and see if it helps you feel better. I did, and the CPAP helped a lot. Eventually I figured out that simply sleeping reclined (on a triagle pillow) actually gave me 90% of the benefits with 0% of the hassle of the mask though.

caymanjim 5y ago
It's valuable to have a doctor who can help you diagnose the problem and get the machine set correctly; technicians who can help with mask fitting and explain proper usage and maintenance; and followups to monitor effects. Some people might be able to manage those things on their own, and I certainly feel that people who already saw a doctor and own a CPAP should be able to manage their care if nothing changes. I don't think it's good advice to self-diagnose, buy used equipment, and hope you get it right. CPAP quality degrades over time, for one. Some people might benefit from a CPAP, but really need a more complex and expensive machine like a BiPAP. Some people have central sleep apnea rather than obstructive sleep apnea. Some people would be better off with surgery or implanted devices. These are not things one should be figuring out on one's own. If none of that is convincing, in the US it's illegal to sell a CPAP to someone without a prescription. I honestly don't care about that part, and if I knew how to order a new CPAP directly (perhaps from Canada or something), I would personally do it and skip the doctors entirely, but I don't think it's good advice, especially before you're properly diagnosed.
- pareidolia 5y ago
  > If none of that is convincing, in the US it's illegal to sell a CPAP to someone without a prescription. Like that means anything. I've bought a DSX900 ASV machine from the US, no problem. I've been self-treating UARS for 4 years now. None of the "sleep doctors" I've talked to even understand the thing, I had to do everything myself.

danudey 5y ago

I was made aware of this feature on my CPAP machine, though it was only mentioned in passing. I'm not super crazy about sending the data to the manufacturer, but I do very much like having it available to my sleep therapist. As an example: recently, I started snoring more and more, though I didn't realize the extent of it until my wife told me that she couldn't sleep at all the night before. Concerned, I called my sleep therapist, and they brought up my file, looked at the data, and made an adjustment to the settings (I presume the pressure) right there while I was on the phone. The next night, my wife and I both slept great. That said, I wasn't given the explicit choice to opt in or to opt out, and while I would have chosen to opt in, I'd wager there are a ton of people out there just like you who would be very upset to know that their sleep patterns are being sent to another company (or anywhere, really) without their consent.

obloid 5y ago

I discovered the cellular modem in my cpap shortly after I got it and promptly took it out. If you're interested in monitoring your own sleep data check out sleepyhead https://sleepyhead.jedimark.net/ https://sleepyhead.jedimark.net/. It's a great app, but unfortunately it looks like the developer is no longer working on the project.

chy3dz 5y ago

That is unacceptable response from your doctor. I feel like I'd be looking for a new doctor after that.