3 ms·

For the record this isn't just a OM thing. There is no provision whereby you can request that your valid, correct medical data be deleted. 7 years is a pretty c

by pc86 4y ago

For the record this isn't just a OM thing. There is no provision whereby you can request that your valid, correct medical data be deleted. 7 years is a pretty common timeframe to hold on to stuff in a "just in case" sense, after which point the provider may or may not delete it. Larger providers have a ton of this data and delete it the second they can - when I worked in healthcare software we had large clients who would run deletion scripts twice a day, literally deleting stuff that crossed the 7 year threshold a few hours ago, to keep the storage as minimal as possible. HIPAA cares much more about how you use data and who can get to it and why, than whether or not you have it in the first place (it cares about both to an extent). Calling this "a run around of HIPAA" is pretty silly, honestly.

adregan 4y ago
Perhaps it's "pretty silly," but I would not authorize my health data to be shared with Amazon, and now it shall be against my will. I appreciate your clinical dispassion in this issue, but I believe this demonstrates the difficulty of the public in understanding how little laws actually serve to protect one's privacy as I foolishly thought I might have some say in the matter.
- pc86 4y ago
  If you don't have a clinical relationship with OneMedical post-acquisition, Amazon has no clinical need to access to data, and doing so is a clear HIPAA violation. Clinical data is not the same as browser history or purchase history or ad clicking history or anything like that. The public health interest in being able to generate accurate diagnoses (among other things) from various providers, down to the location/clinic/doctor level, grossly outweighs any one person's right to say "well I don't like this company so take my email out of your database." Taking an extreme example, there are a lot of reporting requirements around HIV. Anonymity is important but the public health interest in accurate reporting outweighs that. Imagine someone being able to tell their local clinic 48 hours after an HIV diagnosis that they need to delete any record that they were ever there. It just doesn't work that way.

by pc86 4y ago

adregan 4y ago

Perhaps it's "pretty silly," but I would not authorize my health data to be shared with Amazon, and now it shall be against my will. I appreciate your clinical dispassion in this issue, but I believe this demonstrates the difficulty of the public in understanding how little laws actually serve to protect one's privacy as I foolishly thought I might have some say in the matter.

pc86 4y ago
If you don't have a clinical relationship with OneMedical post-acquisition, Amazon has no clinical need to access to data, and doing so is a clear HIPAA violation. Clinical data is not the same as browser history or purchase history or ad clicking history or anything like that. The public health interest in being able to generate accurate diagnoses (among other things) from various providers, down to the location/clinic/doctor level, grossly outweighs any one person's right to say "well I don't like this company so take my email out of your database." Taking an extreme example, there are a lot of reporting requirements around HIV. Anonymity is important but the public health interest in accurate reporting outweighs that. Imagine someone being able to tell their local clinic 48 hours after an HIV diagnosis that they need to delete any record that they were ever there. It just doesn't work that way.