3 ms·

Very sorry about your pregnancy. But I can assure you that your pregnancy was not revealed to a marketing organization by your doctor or insurance company. HI

Very sorry about your pregnancy. But I can assure you that your pregnancy was not revealed to a marketing organization by your doctor or insurance company. HIPAA prohibits that kind of information transfer, and the consequences of violating the law are severe enough that physicians and insurers are highly unlikely to risk it, for the little bit of dough they'd get by selling the fact of a pregnancy. However, HIPAA only protects information about you gathered by your doctor or insurance company in the course of providing medical care. It does not protect you against data aggregators inferring your condition based on non-medical activities. In the case of pregnancy, it's not unlikely that your condition was inferred from credit card activity or online retail activity. (There is a well known case of a retailer - Target - building a model that inferred a pregnancy in a household based on retail activity; they started sending flyers/adverts to households they had identified as pregnant, and in the process revealed pregnancies of wives or daughters in the household to others who had not been in read in to the news; it did not end well for Target).

Spooky23 5y ago
Respectfully, no. My wife’s pregnancy and expected due date were available on a list sold by zip code, which I know because I purchased it after it was identified by Enfamil. I also learned that my neighbor has type-2 diabetes and another has a child with ADHD, among other things. In my wife’s case, she suffered from an ectopic pregnancy that resulted in a near death experience, and subsequent admission to the OB floor of the hospital. The admission and drugs prescribed are sold/reported in near real-time to various data aggregators, who in turn are able to link them to the ob/gyn who performed the emergency surgery. We think that the admission to the obstetric floor, duration of hospital stay and certain prescriptions trigged a false hit of “pregnant”. This data is poorly anonymized and can be trivially reconstructed. Both an attorney I hired and an investigator from the state health department confirmed that. There was no retail behavioral tracking because the events happened before my wife was aware that she was pregnant. Insurance company and medical data is used for all sorts of practices. The state of Georgia, for example, has a anti-opioid surveillance system that uses Medicaid, private insurance, and behavioral data to identify pregnant women at risk of delivering an opioid addicted child. (Which will cost state Medicaid $1M or more)
- jtbayly 5y ago
  So this is a slam dunk violation of HIPAA, no? What did the lawyer say? Edit: I see now that technically they say it’s anonymized. I’m assuming that’s the answer. So basically HIPAA is privacy theater, the same as we have security theater at the airport now and financial accountability theater and the latest: data privacy theater via GDPR.
  - walnutclosefarm 5y ago
    It is a clear cut HIPAA violation if the data sold to the data aggregator contained personal identifiers of any kind. The standard is not that data be "anonymized" but that all personal identifiers be redacted from the data. This includes dates, addresses (typically the finest grain of address information you can include is the first 3 digits of the zipcode, and sometimes not that), birthdays. The redaction does not mean that data cannot under some circumstances be re-identified, of course. But it's not trivial.

Spooky23 5y ago

Respectfully, no. My wife’s pregnancy and expected due date were available on a list sold by zip code, which I know because I purchased it after it was identified by Enfamil. I also learned that my neighbor has type-2 diabetes and another has a child with ADHD, among other things. In my wife’s case, she suffered from an ectopic pregnancy that resulted in a near death experience, and subsequent admission to the OB floor of the hospital. The admission and drugs prescribed are sold/reported in near real-time to various data aggregators, who in turn are able to link them to the ob/gyn who performed the emergency surgery. We think that the admission to the obstetric floor, duration of hospital stay and certain prescriptions trigged a false hit of “pregnant”. This data is poorly anonymized and can be trivially reconstructed. Both an attorney I hired and an investigator from the state health department confirmed that. There was no retail behavioral tracking because the events happened before my wife was aware that she was pregnant. Insurance company and medical data is used for all sorts of practices. The state of Georgia, for example, has a anti-opioid surveillance system that uses Medicaid, private insurance, and behavioral data to identify pregnant women at risk of delivering an opioid addicted child. (Which will cost state Medicaid $1M or more)

jtbayly 5y ago
So this is a slam dunk violation of HIPAA, no? What did the lawyer say? Edit: I see now that technically they say it’s anonymized. I’m assuming that’s the answer. So basically HIPAA is privacy theater, the same as we have security theater at the airport now and financial accountability theater and the latest: data privacy theater via GDPR.
- walnutclosefarm 5y ago
  It is a clear cut HIPAA violation if the data sold to the data aggregator contained personal identifiers of any kind. The standard is not that data be "anonymized" but that all personal identifiers be redacted from the data. This includes dates, addresses (typically the finest grain of address information you can include is the first 3 digits of the zipcode, and sometimes not that), birthdays. The redaction does not mean that data cannot under some circumstances be re-identified, of course. But it's not trivial.