4 ms·

> That's on Planned Parenthood. Only in part. Ultimately it's the browser that's sharing the data from PP to FB. It's not like PP is making a direct connection

by js2 4y ago

> That's on Planned Parenthood. Only in part. Ultimately it's the browser that's sharing the data from PP to FB. It's not like PP is making a direct connection from their backend to FB's backend. It's Chrome that's connecting to FB. Apple has demonstrated with Safari that browsers can fight this tracking if they want to. Google has no interest in doing so because their browser doesn't work for the user. It works for the likes of Google, FB, and yes, PP.

judge2020 4y ago
> It's not like PP is making a direct connection from their backend to FB's backend. But it’s possible from the backend: https://developers.facebook.com/docs/marketing-api/app-event-api/ https://developers.facebook.com/docs/marketing-api/app-event...
- js2 4y ago
  Yes, but unlikely what's happening here. I assume incompetence not malice on PP's part. That doesn't excuse this privacy leak. My point is that this isn't all on PP. I consider Google and FB malicious in sharing data in their zeal for dollars. I consider PP incompetent in protecting privacy in its marketing efforts, which yes, also needs dollars, but it's a non-profit and really not in its interests to share this information.
bushbaba 4y ago
Would make for an interesting lawsuit. Should chrome be held liable for violating hipaa.
- thaeli 4y ago
  I don't see how they would be a covered entity.
- tomrod 4y ago
  Yes, as well as other browsers. I have doubts it would win, however, as identifying PHI has several safe harbor clauses (such as unidentifiable at the ZIP2/ZIP3 level, etc.). IP addresses haven't been precise for a long time, to my understanding? (not my area). https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act https://en.wikipedia.org/wiki/Health_Insurance_Portability_a... > An individual who believes that the Privacy Rule is not being upheld can file a complaint with the Department of Health and Human Services Office for Civil Rights (OCR).[37][38] In 2006 the Wall Street Journal reported that the OCR had a long backlog and ignores most complaints. "Complaints of privacy violations have been piling up at the Department of Health and Human Services. Between April of 2003 and November 2006, the agency fielded 23,886 complaints related to medical-privacy rules, but it has not yet taken any enforcement actions against hospitals, doctors, insurers or anyone else for rule violations. A spokesman for the agency says it has closed three-quarters of the complaints, typically because it found no violation or after it provided informal guidance to the parties involved."[39] However, in July 2011, the University of California, Los Angeles agreed to pay $865,500 in a settlement regarding potential HIPAA violations. An HHS Office for Civil Rights investigation showed that from 2005 to 2008, unauthorized employees repeatedly and without legitimate cause looked at the electronic protected health information of numerous UCLAHS patients.[40] > It is a misconception that the Privacy Rule creates a right for any individual to refuse to disclose any health information (such as chronic conditions or immunization records) if requested by an employer or business. HIPAA Privacy Rule requirements merely place restrictions on disclosure by covered entities and their business associates without the consent of the individual whose records are being requested; they do not place any restrictions upon requesting health information directly from the subject of that information.[41][42][43]
ChrisMarshallNY 4y ago
Also, lest we forget, the site designer. Most folks are unaware of the things that can happen, when a Web designer loops in a dependency. The dependencies tend to bring friends. Lots of friends. I'm not sure what the answer is. Many, many folks are incapable of designing sites without the dependencies, and these dependencies often add great value, so "don't do that" isn't really an option. It's easy enough to say "set up a licensing board," but these tend to be a cure, worse than the disease. Incumbents will use them to prevent competition, and governments like to use them as a private piggy bank, like red-light cameras. Paying for the dependencies makes sense (if I make my living on something, it’s only natural that I pay for my tools and raw materials), but the chains can be long, and there can be many parts that simply cannot be paid for, or will get stolen, or corrupted. I think that we need to figure out some way to improve the dependency space, but there's no simple solution. Anyone claiming there is, is trying to sell something that is maybe a bit past its "sell by" date. "There's always an easy solution to every human problem; Neat, plausible and wrong." "The fact that I have no remedy for all the sorrows of the world is no reason for my accepting yours. It simply supports the strong probability that yours is a fake." -H. L. Mencken

by js2 4y ago

judge2020 4y ago

> It's not like PP is making a direct connection from their backend to FB's backend. But it’s possible from the backend: https://developers.facebook.com/docs/marketing-api/app-event-api/ https://developers.facebook.com/docs/marketing-api/app-event...

js2 4y ago
Yes, but unlikely what's happening here. I assume incompetence not malice on PP's part. That doesn't excuse this privacy leak. My point is that this isn't all on PP. I consider Google and FB malicious in sharing data in their zeal for dollars. I consider PP incompetent in protecting privacy in its marketing efforts, which yes, also needs dollars, but it's a non-profit and really not in its interests to share this information.

bushbaba 4y ago

Would make for an interesting lawsuit. Should chrome be held liable for violating hipaa.

thaeli 4y ago
I don't see how they would be a covered entity.
tomrod 4y ago
Yes, as well as other browsers. I have doubts it would win, however, as identifying PHI has several safe harbor clauses (such as unidentifiable at the ZIP2/ZIP3 level, etc.). IP addresses haven't been precise for a long time, to my understanding? (not my area). https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act https://en.wikipedia.org/wiki/Health_Insurance_Portability_a... > An individual who believes that the Privacy Rule is not being upheld can file a complaint with the Department of Health and Human Services Office for Civil Rights (OCR).[37][38] In 2006 the Wall Street Journal reported that the OCR had a long backlog and ignores most complaints. "Complaints of privacy violations have been piling up at the Department of Health and Human Services. Between April of 2003 and November 2006, the agency fielded 23,886 complaints related to medical-privacy rules, but it has not yet taken any enforcement actions against hospitals, doctors, insurers or anyone else for rule violations. A spokesman for the agency says it has closed three-quarters of the complaints, typically because it found no violation or after it provided informal guidance to the parties involved."[39] However, in July 2011, the University of California, Los Angeles agreed to pay $865,500 in a settlement regarding potential HIPAA violations. An HHS Office for Civil Rights investigation showed that from 2005 to 2008, unauthorized employees repeatedly and without legitimate cause looked at the electronic protected health information of numerous UCLAHS patients.[40] > It is a misconception that the Privacy Rule creates a right for any individual to refuse to disclose any health information (such as chronic conditions or immunization records) if requested by an employer or business. HIPAA Privacy Rule requirements merely place restrictions on disclosure by covered entities and their business associates without the consent of the individual whose records are being requested; they do not place any restrictions upon requesting health information directly from the subject of that information.[41][42][43]

ChrisMarshallNY 4y ago

Also, lest we forget, the site designer. Most folks are unaware of the things that can happen, when a Web designer loops in a dependency. The dependencies tend to bring friends. Lots of friends. I'm not sure what the answer is. Many, many folks are incapable of designing sites without the dependencies, and these dependencies often add great value, so "don't do that" isn't really an option. It's easy enough to say "set up a licensing board," but these tend to be a cure, worse than the disease. Incumbents will use them to prevent competition, and governments like to use them as a private piggy bank, like red-light cameras. Paying for the dependencies makes sense (if I make my living on something, it’s only natural that I pay for my tools and raw materials), but the chains can be long, and there can be many parts that simply cannot be paid for, or will get stolen, or corrupted. I think that we need to figure out some way to improve the dependency space, but there's no simple solution. Anyone claiming there is, is trying to sell something that is maybe a bit past its "sell by" date. "There's always an easy solution to every human problem; Neat, plausible and wrong." "The fact that I have no remedy for all the sorrows of the world is no reason for my accepting yours. It simply supports the strong probability that yours is a fake." -H. L. Mencken