38 ms·

This is extremely widely used. I doubt it is going to go anywhere since your interactions with a website have no expectation of privacy from the website owner.

jeroenhd 4y ago
It is widely used. And that's a disgusting disregard of customers' privacy. I very much doubt that this lawsuit will go anywhere. I hope it does, though.
9wzYQbTYsAIc 4y ago
Healthcare related websites do have privacy expectations, as do law services websites, I suspect. I wonder how many hospitals and clinics use insecure technologies to do interaction monitoring of patients and prospective patients. I wouldn’t be surprised if some hospital got sued someday for an employee misusing interaction monitoring for personal benefit.
- mwint 4y ago
  Heh, I could make an argument for Papa John’s being an anti-healthcare website.
- xcskier56 4y ago
  One of the big caveats is that the information must be personally identifiable AND include information about the care of that person. Just my going to the website of a healthcare organization doesn't immediately identify me as a patient of that system, just that I've looked at their website. I've done some digging and I've found many health systems using google analytics, which is not HIPAA compliant. But I've found they only use this on their public pages. From what I can tell, they don't use it in their internal systems that will likely contain PHI. All that said, given the state of IT in healthcare systems, it wouldn't surprise me if some system out there is using a non-HIPAA compliant system for handling PHI. Who? No idea. The other part of HIPAA is that its penalties are WAY stronger than normal privacy laws. If someone knowingly obtains or discloses PHI in violation of the Privacy rule, they may face fines up to $50,000 and one year in jail. The fines and jail goes higher for more malicious violations. These penalties are enforced on the person who broke the law, not the company.
  - 9wzYQbTYsAIc 4y ago
    > One of the big caveats is that the information must be personally identifiable AND include information about the care of that person. That would be pretty easy to have happen with common things like “contact us” or “ask us a question” modules loaded into websites, etc.
pessimizer 4y ago
It's a stretch to call my mouse movements while I have a site loaded, or my unsubmitted input, interactions with a website. There wouldn't be an interaction with the website if the website weren't proactively installing software into my browser to sniff around.
cantSpellSober 4y ago
Privacy is really popular on HN users except when it's contrarion to not care about it

jeroenhd 4y ago

It is widely used. And that's a disgusting disregard of customers' privacy. I very much doubt that this lawsuit will go anywhere. I hope it does, though.

9wzYQbTYsAIc 4y ago

Healthcare related websites do have privacy expectations, as do law services websites, I suspect. I wonder how many hospitals and clinics use insecure technologies to do interaction monitoring of patients and prospective patients. I wouldn’t be surprised if some hospital got sued someday for an employee misusing interaction monitoring for personal benefit.

mwint 4y ago
Heh, I could make an argument for Papa John’s being an anti-healthcare website.
xcskier56 4y ago
One of the big caveats is that the information must be personally identifiable AND include information about the care of that person. Just my going to the website of a healthcare organization doesn't immediately identify me as a patient of that system, just that I've looked at their website. I've done some digging and I've found many health systems using google analytics, which is not HIPAA compliant. But I've found they only use this on their public pages. From what I can tell, they don't use it in their internal systems that will likely contain PHI. All that said, given the state of IT in healthcare systems, it wouldn't surprise me if some system out there is using a non-HIPAA compliant system for handling PHI. Who? No idea. The other part of HIPAA is that its penalties are WAY stronger than normal privacy laws. If someone knowingly obtains or discloses PHI in violation of the Privacy rule, they may face fines up to $50,000 and one year in jail. The fines and jail goes higher for more malicious violations. These penalties are enforced on the person who broke the law, not the company.
- 9wzYQbTYsAIc 4y ago
  > One of the big caveats is that the information must be personally identifiable AND include information about the care of that person. That would be pretty easy to have happen with common things like “contact us” or “ask us a question” modules loaded into websites, etc.

pessimizer 4y ago

It's a stretch to call my mouse movements while I have a site loaded, or my unsubmitted input, interactions with a website. There wouldn't be an interaction with the website if the website weren't proactively installing software into my browser to sniff around.

cantSpellSober 4y ago

Privacy is really popular on HN users except when it's contrarion to not care about it