5 ms·

Why are the hospitals installing a FB/Meta tracker in patient portals? HIPAA is generally taken seriously in industry - this is a weird oversight.

api 4y ago
It's not uncommon for shit like that to be in a template that gets used across an organization.
willcipriano 4y ago
"but we want to know how long they stay on each page of the app and it's free!" Was the response I got when I explained the issue with Google Analytics in patient portals.
- xbar 4y ago
  This is a common refrain, and the implementers are baffled by any security or privacy concern about it.
  - wolpoli 4y ago
    Unless it is made into a regulatory compliance concern, they don't want to hear about it.
- alistairSH 4y ago
  I'm guess I'm just surprised that the product owner (or whoever tends to fill that role in this space) isn't intimately aware of the privacy concerns. There's an entire market of HIPAA-compliant data storage/processing/etc. If there isn't a HIPAA-compliant web metrics solution, I guess that's my million-dollar idea (free for the taking, I have zero interest in building it myself).
  - deleted 4y ago
    [deleted]
- system16 4y ago
  I've had so many clients insist that Google Analytics is absolutely necessary for their site or app since they need the to know as much as possible about who is visiting. In most cases these same clients never even look at the analytics as the dashboard is too confusing and generating reports too cumbersome.
  - willcipriano 4y ago
    I can confirm that they did not use any of the data collected.
    - 908087 4y ago
  - thewebcount 4y ago
    Can you elaborate on this? It's a patient portal. The patient is logged in, so you know who's visiting. They're visiting pages on your site tied to their own accounts, so you know as much as you can about what they're doing. Why do they need Google involved on this? I don't even understand the concept the clients are trying to convey. It's like someone saying, "I need to go to the store to get milk," but you open their refrigerator and it's full of gallon jugs of milk. What am I not understanding?
    - system16 4y ago
      IP/location, device used to access, browser used, time spent on the site, other demographics and interests data that may not be part of their user profile but is available thanks to Google tracking cookies, etc. Most (all?) of which could be developed on their own of course, but that costs more than a one liner to set up Google Analytics. And again, none of this info was ever actually used. They just felt very strongly that they needed it to better understand their users and improve the experience at some far off future date.
  - sizzle 4y ago
    Isn’t matomo open source?
cratermoon 4y ago
It's probably an element of the Electronic Health Records system they use. EHR systems are massive and complex, and the health care facilities are barely aware of all the functions and features. I'd say this is a failure of oversight on the EHR providers.
- ehr891063 4y ago
  I work at Epic. This is not true. Hospitals have the ability to customize the portal we offer and add in what they want. We're not shipping with Meta Pixel enabled. They added this and didn't understand the full consequences (I hope). When we learned and understood the consequences, we called every customer to share what we know and investigate if they're impacted. I can't speak to why the consequences weren't more obvious. I don't know. I do know that Epic cares deeply about this and I know that it pisses me off that this happens. But the tech people at hospitals are people and make mistakes. They're likely driven by the business needs and don't have time to fully vet everything. I think this is a consequence of the American health system and want to implement these products to increase profitability.
  - cratermoon 4y ago
    I had no idea which EHR vendor was involved. Edit: I didn't read far enough into the story. I see that Epic was mentioned by name. I stand by my assertion that it's on the EHR vendor. Did those hospitals specifically enable the private health data be sent?
    - ehr891063 4y ago
      Yes. They specifically added Meta Pixel or added something else that added Meta Pixel.
jonnat 4y ago
Because they are for-profit businesses and as such have a strong incentive to spend in ads and for these ads to be as effective as possible. FB and Google are just giving them the means to do so; we should be asking why it is that hospitals are allowed to have these strong economic incentives to begin with.
m463 4y ago
I complained to kaiser permanente that that they had googletagmanager/doubleclick links all over their site. This includes the pages to contact my doctor, view test results or even the feedback link for my complaint. They played dumb for a while, but finally said "the website is a convenience". They also would not delete my account.
soared 4y ago
Hospitals advertise, just like any other business. I’ve ran campaigns (not Facebook) for maternity wards, cancer centers, rehab, etc. You need to track conversions and exclude current customers, so you need to place trackers in a lot of different places. And you give clear instruction to the marketing guy to not grab any pii, but they might do it anyway.

api 4y ago

It's not uncommon for shit like that to be in a template that gets used across an organization.

willcipriano 4y ago

"but we want to know how long they stay on each page of the app and it's free!" Was the response I got when I explained the issue with Google Analytics in patient portals.

xbar 4y ago
This is a common refrain, and the implementers are baffled by any security or privacy concern about it.
- wolpoli 4y ago
  Unless it is made into a regulatory compliance concern, they don't want to hear about it.
alistairSH 4y ago
I'm guess I'm just surprised that the product owner (or whoever tends to fill that role in this space) isn't intimately aware of the privacy concerns. There's an entire market of HIPAA-compliant data storage/processing/etc. If there isn't a HIPAA-compliant web metrics solution, I guess that's my million-dollar idea (free for the taking, I have zero interest in building it myself).
- deleted 4y ago
  [deleted]
system16 4y ago
I've had so many clients insist that Google Analytics is absolutely necessary for their site or app since they need the to know as much as possible about who is visiting. In most cases these same clients never even look at the analytics as the dashboard is too confusing and generating reports too cumbersome.
- willcipriano 4y ago
  I can confirm that they did not use any of the data collected.
  - 908087 4y ago
- thewebcount 4y ago
  Can you elaborate on this? It's a patient portal. The patient is logged in, so you know who's visiting. They're visiting pages on your site tied to their own accounts, so you know as much as you can about what they're doing. Why do they need Google involved on this? I don't even understand the concept the clients are trying to convey. It's like someone saying, "I need to go to the store to get milk," but you open their refrigerator and it's full of gallon jugs of milk. What am I not understanding?
  - system16 4y ago
    IP/location, device used to access, browser used, time spent on the site, other demographics and interests data that may not be part of their user profile but is available thanks to Google tracking cookies, etc. Most (all?) of which could be developed on their own of course, but that costs more than a one liner to set up Google Analytics. And again, none of this info was ever actually used. They just felt very strongly that they needed it to better understand their users and improve the experience at some far off future date.
- sizzle 4y ago
  Isn’t matomo open source?

cratermoon 4y ago

It's probably an element of the Electronic Health Records system they use. EHR systems are massive and complex, and the health care facilities are barely aware of all the functions and features. I'd say this is a failure of oversight on the EHR providers.

ehr891063 4y ago
I work at Epic. This is not true. Hospitals have the ability to customize the portal we offer and add in what they want. We're not shipping with Meta Pixel enabled. They added this and didn't understand the full consequences (I hope). When we learned and understood the consequences, we called every customer to share what we know and investigate if they're impacted. I can't speak to why the consequences weren't more obvious. I don't know. I do know that Epic cares deeply about this and I know that it pisses me off that this happens. But the tech people at hospitals are people and make mistakes. They're likely driven by the business needs and don't have time to fully vet everything. I think this is a consequence of the American health system and want to implement these products to increase profitability.
- cratermoon 4y ago
  I had no idea which EHR vendor was involved. Edit: I didn't read far enough into the story. I see that Epic was mentioned by name. I stand by my assertion that it's on the EHR vendor. Did those hospitals specifically enable the private health data be sent?
  - ehr891063 4y ago
    Yes. They specifically added Meta Pixel or added something else that added Meta Pixel.

jonnat 4y ago

Because they are for-profit businesses and as such have a strong incentive to spend in ads and for these ads to be as effective as possible. FB and Google are just giving them the means to do so; we should be asking why it is that hospitals are allowed to have these strong economic incentives to begin with.

m463 4y ago

I complained to kaiser permanente that that they had googletagmanager/doubleclick links all over their site. This includes the pages to contact my doctor, view test results or even the feedback link for my complaint. They played dumb for a while, but finally said "the website is a convenience". They also would not delete my account.

soared 4y ago

Hospitals advertise, just like any other business. I’ve ran campaigns (not Facebook) for maternity wards, cancer centers, rehab, etc. You need to track conversions and exclude current customers, so you need to place trackers in a lot of different places. And you give clear instruction to the marketing guy to not grab any pii, but they might do it anyway.