4 ms·

Probably too late, but is there a way to prevent my one medical records from going to Amazon?

adregan 4y ago
Follow up: Called one medical support, and it doesn’t look like there is any data deletion process. Apparently, the heath record will be held for 7 years and the best I can do is delete my account. Hoping a process will soon form but this seems like a run around of HIPAA to me. All you need is enough money to buy a company and you get a lot of juicy health data.
- karaterobot 4y ago
  In theory, under HIPAA, your protected health information (PHI) can't just be given to everybody at Amazon. One Medical can only share it for specific, generally pretty legitimate reasons. HIPAA is pretty strict, and Amazon will be under a lot of scrutiny, so I, personally, would not be worried about them, e.g., using my PHI to try to market stuff to me, or selling it off to the highest bidders. Here are some PDF fact sheets on the uses and disclosures allowed under HIPAA: https://www.hhs.gov/sites/default/files/exchange_health_care_ops.pdf https://www.hhs.gov/sites/default/files/exchange_health_care... https://www.hhs.gov/sites/default/files/exchange_treatment.pdf https://www.hhs.gov/sites/default/files/exchange_treatment.p... The bad news is they probably don't need to do this, because they have more valuable data than this on you already. :\
  - Terretta 4y ago
    > legitimate reasons This is another term that doesn’t legally mean what people colloquially think it means.
- pc86 4y ago
  For the record this isn't just a OM thing. There is no provision whereby you can request that your valid, correct medical data be deleted. 7 years is a pretty common timeframe to hold on to stuff in a "just in case" sense, after which point the provider may or may not delete it. Larger providers have a ton of this data and delete it the second they can - when I worked in healthcare software we had large clients who would run deletion scripts twice a day, literally deleting stuff that crossed the 7 year threshold a few hours ago, to keep the storage as minimal as possible. HIPAA cares much more about how you use data and who can get to it and why, than whether or not you have it in the first place (it cares about both to an extent). Calling this "a run around of HIPAA" is pretty silly, honestly.
  - adregan 4y ago
    Perhaps it's "pretty silly," but I would not authorize my health data to be shared with Amazon, and now it shall be against my will. I appreciate your clinical dispassion in this issue, but I believe this demonstrates the difficulty of the public in understanding how little laws actually serve to protect one's privacy as I foolishly thought I might have some say in the matter.
    - pc86 4y ago
      If you don't have a clinical relationship with OneMedical post-acquisition, Amazon has no clinical need to access to data, and doing so is a clear HIPAA violation. Clinical data is not the same as browser history or purchase history or ad clicking history or anything like that. The public health interest in being able to generate accurate diagnoses (among other things) from various providers, down to the location/clinic/doctor level, grossly outweighs any one person's right to say "well I don't like this company so take my email out of your database." Taking an extreme example, there are a lot of reporting requirements around HIV. Anonymity is important but the public health interest in accurate reporting outweighs that. Imagine someone being able to tell their local clinic 48 hours after an HIV diagnosis that they need to delete any record that they were ever there. It just doesn't work that way.

Follow up: Called one medical support, and it doesn’t look like there is any data deletion process. Apparently, the heath record will be held for 7 years and the best I can do is delete my account. Hoping a process will soon form but this seems like a run around of HIPAA to me. All you need is enough money to buy a company and you get a lot of juicy health data.

karaterobot 4y ago
In theory, under HIPAA, your protected health information (PHI) can't just be given to everybody at Amazon. One Medical can only share it for specific, generally pretty legitimate reasons. HIPAA is pretty strict, and Amazon will be under a lot of scrutiny, so I, personally, would not be worried about them, e.g., using my PHI to try to market stuff to me, or selling it off to the highest bidders. Here are some PDF fact sheets on the uses and disclosures allowed under HIPAA: https://www.hhs.gov/sites/default/files/exchange_health_care_ops.pdf https://www.hhs.gov/sites/default/files/exchange_health_care... https://www.hhs.gov/sites/default/files/exchange_treatment.pdf https://www.hhs.gov/sites/default/files/exchange_treatment.p... The bad news is they probably don't need to do this, because they have more valuable data than this on you already. :\
- Terretta 4y ago
  > legitimate reasons This is another term that doesn’t legally mean what people colloquially think it means.
pc86 4y ago
For the record this isn't just a OM thing. There is no provision whereby you can request that your valid, correct medical data be deleted. 7 years is a pretty common timeframe to hold on to stuff in a "just in case" sense, after which point the provider may or may not delete it. Larger providers have a ton of this data and delete it the second they can - when I worked in healthcare software we had large clients who would run deletion scripts twice a day, literally deleting stuff that crossed the 7 year threshold a few hours ago, to keep the storage as minimal as possible. HIPAA cares much more about how you use data and who can get to it and why, than whether or not you have it in the first place (it cares about both to an extent). Calling this "a run around of HIPAA" is pretty silly, honestly.
- adregan 4y ago
  Perhaps it's "pretty silly," but I would not authorize my health data to be shared with Amazon, and now it shall be against my will. I appreciate your clinical dispassion in this issue, but I believe this demonstrates the difficulty of the public in understanding how little laws actually serve to protect one's privacy as I foolishly thought I might have some say in the matter.
  - pc86 4y ago
    If you don't have a clinical relationship with OneMedical post-acquisition, Amazon has no clinical need to access to data, and doing so is a clear HIPAA violation. Clinical data is not the same as browser history or purchase history or ad clicking history or anything like that. The public health interest in being able to generate accurate diagnoses (among other things) from various providers, down to the location/clinic/doctor level, grossly outweighs any one person's right to say "well I don't like this company so take my email out of your database." Taking an extreme example, there are a lot of reporting requirements around HIV. Anonymity is important but the public health interest in accurate reporting outweighs that. Imagine someone being able to tell their local clinic 48 hours after an HIV diagnosis that they need to delete any record that they were ever there. It just doesn't work that way.