3 ms·

So this is a slam dunk violation of HIPAA, no? What did the lawyer say? Edit: I see now that technically they say it’s anonymized. I’m assuming that’s the ans

So this is a slam dunk violation of HIPAA, no? What did the lawyer say? Edit: I see now that technically they say it’s anonymized. I’m assuming that’s the answer. So basically HIPAA is privacy theater, the same as we have security theater at the airport now and financial accountability theater and the latest: data privacy theater via GDPR.

walnutclosefarm 5y ago
It is a clear cut HIPAA violation if the data sold to the data aggregator contained personal identifiers of any kind. The standard is not that data be "anonymized" but that all personal identifiers be redacted from the data. This includes dates, addresses (typically the finest grain of address information you can include is the first 3 digits of the zipcode, and sometimes not that), birthdays. The redaction does not mean that data cannot under some circumstances be re-identified, of course. But it's not trivial.