2 ms·

Healthcare related websites do have privacy expectations, as do law services websites, I suspect. I wonder how many hospitals and clinics use insecure technolo

Healthcare related websites do have privacy expectations, as do law services websites, I suspect. I wonder how many hospitals and clinics use insecure technologies to do interaction monitoring of patients and prospective patients. I wouldn’t be surprised if some hospital got sued someday for an employee misusing interaction monitoring for personal benefit.

mwint 4y ago
Heh, I could make an argument for Papa John’s being an anti-healthcare website.
xcskier56 4y ago
One of the big caveats is that the information must be personally identifiable AND include information about the care of that person. Just my going to the website of a healthcare organization doesn't immediately identify me as a patient of that system, just that I've looked at their website. I've done some digging and I've found many health systems using google analytics, which is not HIPAA compliant. But I've found they only use this on their public pages. From what I can tell, they don't use it in their internal systems that will likely contain PHI. All that said, given the state of IT in healthcare systems, it wouldn't surprise me if some system out there is using a non-HIPAA compliant system for handling PHI. Who? No idea. The other part of HIPAA is that its penalties are WAY stronger than normal privacy laws. If someone knowingly obtains or discloses PHI in violation of the Privacy rule, they may face fines up to $50,000 and one year in jail. The fines and jail goes higher for more malicious violations. These penalties are enforced on the person who broke the law, not the company.
- 9wzYQbTYsAIc 4y ago
  > One of the big caveats is that the information must be personally identifiable AND include information about the care of that person. That would be pretty easy to have happen with common things like “contact us” or “ask us a question” modules loaded into websites, etc.

mwint 4y ago

Heh, I could make an argument for Papa John’s being an anti-healthcare website.

xcskier56 4y ago

One of the big caveats is that the information must be personally identifiable AND include information about the care of that person. Just my going to the website of a healthcare organization doesn't immediately identify me as a patient of that system, just that I've looked at their website. I've done some digging and I've found many health systems using google analytics, which is not HIPAA compliant. But I've found they only use this on their public pages. From what I can tell, they don't use it in their internal systems that will likely contain PHI. All that said, given the state of IT in healthcare systems, it wouldn't surprise me if some system out there is using a non-HIPAA compliant system for handling PHI. Who? No idea. The other part of HIPAA is that its penalties are WAY stronger than normal privacy laws. If someone knowingly obtains or discloses PHI in violation of the Privacy rule, they may face fines up to $50,000 and one year in jail. The fines and jail goes higher for more malicious violations. These penalties are enforced on the person who broke the law, not the company.

9wzYQbTYsAIc 4y ago
> One of the big caveats is that the information must be personally identifiable AND include information about the care of that person. That would be pretty easy to have happen with common things like “contact us” or “ask us a question” modules loaded into websites, etc.