7 ms·

As someone who has been in the "healthtech" area for several years now, none of this looks at all new to me. Am I missing something, or do companies typically p

As someone who has been in the "healthtech" area for several years now, none of this looks at all new to me. Am I missing something, or do companies typically play much more "fast and loose" with data than I've seen? In my experience, you don't send data anywhere you don't have a BAA. Period, full stop.

anonymouse008 4y ago
The amount of practitioners that attempt to send me PHI after just a phone call is mind boggling. Not to mention, how many practitioners don't separate their guest network from their back of house - or just have a standard ISP provided Wifi Router. The world operates on much trust.
glasss 4y ago
I've been doing B2B IT for years, and I'm glad to hear that the tech part of the health industry takes this more seriously than the health part. There's not a single doctor's office or hospital I'm aware of that is HIPAA compliant, and the vast majority of doctors ask us what a BAA is when we try to get one set up with them.
- actually_a_dog 4y ago
  No shit huh? Well, score one more for Kaiser, I guess. FYI, my therapist is HIPAA compliant. I’m not sure he counts in your view though, because he is a former software engineer.
- Ancapistani 4y ago
  > There's not a single doctor's office or hospital I'm aware of that is HIPAA compliant That mirrors my experience. My GP has a sign-in sheet at the receptionist's desk where you have to write your name when you arrive. They put a single line through your name when you're checked in. Worse, it's usually a notebook that's just turned to a new page every day. If you grabbed that notebook you'd have a list of everyone who visited that office for the past month or so, complete with dates and times.
wswope 4y ago
I’ve never worked anywhere it wasn’t taken extremely seriously either, but I think this is the big news story that HHS is responding to: https://themarkup.org/privacy/2022/12/13/out-of-control-dozens-of-telehealth-startups-sent-sensitive-health-information-to-big-tech-companies https://themarkup.org/privacy/2022/12/13/out-of-control-doze.... Classic tale of VC-backed “startups” going the Uber/Airbnb route and deciding the established rules aren’t worth following.
- Nextgrid 4y ago
  > Classic tale of VC-backed “startups” going the Uber/Airbnb route and deciding the established rules aren’t worth following. As long as penalties are lower than the profits (and no execs go to jail), the rules aren't actually worth following. Maybe the real innovation of the tech sector in the last decade is figuring out that established laws aren't actually enforced anywhere well enough so you may as well break them.
- malisper 4y ago
  It's not just start ups here. Lots of hospitals and hospital groups have trackers like Google Analytics installed on their website. From the HHS[0] in many cases this is considered sharing health information with Google: > For example, tracking technologies could collect an individual’s email address and/or IP address when the individual visits a regulated entity’s webpage to search for available appointments with a health care provider. In this example, the regulated entity is disclosing PHI to the tracking technology vendor, and thus the HIPAA Rules apply.
Nextgrid 4y ago
> In my experience, you don't send data anywhere you don't have a BAA. Period, full stop. This really depends on what you consider health data, which itself varies based on how big the marketing team is and the company's desire to obtain "growth & engagement". The below is from an EU perspective, but I'm sure the same would apply in the US. I have been involved in a EU-based HealthTech that had the Facebook SDK (and maybe others too) in the app that fingerprinted the device and pinged Facebook on each run, without user consent nor adequate disclosure (buried in the privacy policy doesn't apply, nor was the privacy policy granular enough about the fingerprinting because Facebook itself doesn't publish any details on it). Were they sending health data? No. But I'd argue that the simple fact that you use a health app and when you use it (and from where, derived from IP address) itself is a major breach. Of course, regardless of the healthcare context, this was also an obvious GDPR breach, but good luck getting any kind of enforcement against that given that the vast majority of apps are equally contaminated by these spyware SDKs. I have seen a similar issue on a UK-based patient portal (the system here is so that third-parties are used to allow patients to access their government-maintained health record and schedule appointments) - full of trackers which had complete access to the page and Javascript context.
- malisper 4y ago
  > Were they sending health data The recent guidance from the HHS[0] indicates in many cases installing Google Analytics or the Facebook SDK would be considered sending health data to Google or Facebook and therefore be considered a HIPAA violation. From the HHS[0]: > Tracking technologies on a regulated entity’s user-authenticated webpages generally have access to PHI. Such PHI may include, for example, an individual’s IP address, medical record number, home or email addresses, dates of appointments, or other identifying information that the individual may provide when interacting with the webpage. [0] https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...
  - johndhi 4y ago
    Does the guidance only apply to user-authenticated web pages? the article suggests 'the website' is all PHI, which I personally find to be an insane interpretation of HIPAA. edit: I found the answer. it's pretty reasonable. basically, no, HIPAA doesn't apply there.
Spooky23 4y ago
The providers lean on you for the heavy lift. The weakness is always at the integration points. It’s all pretty meaningless anyway, lots of real health data is legally leaked via insurance and pharmacy data feeds.
AnEro 4y ago
Same, I'm kind of scared of what others have been doing up too now to warrant this.
fitzrocks 4y ago
You are correct - this is not new. It's the HHS reaffirming what the law says as written. way too many companies got loosey goosey with this stuff. The mental gymnastics we'd hear from healthcare companies "oh our legal team said it's okay to have Facebook installed here because [convoluted and totally not kosher reasoning]" was crazy when you'd review the law as written. Startups, hospital systems, payers...doesn't matter how much resources or the company's particular compliance stance. You'd be amazed where these companies are sending data to Google and Facebook data without consent and without BAAs in place. HHS here is specifically going after larger health networks and hospital systems (typically way more compliance focused than your average healthtech startup).

anonymouse008 4y ago

The amount of practitioners that attempt to send me PHI after just a phone call is mind boggling. Not to mention, how many practitioners don't separate their guest network from their back of house - or just have a standard ISP provided Wifi Router. The world operates on much trust.

glasss 4y ago

I've been doing B2B IT for years, and I'm glad to hear that the tech part of the health industry takes this more seriously than the health part. There's not a single doctor's office or hospital I'm aware of that is HIPAA compliant, and the vast majority of doctors ask us what a BAA is when we try to get one set up with them.

actually_a_dog 4y ago
No shit huh? Well, score one more for Kaiser, I guess. FYI, my therapist is HIPAA compliant. I’m not sure he counts in your view though, because he is a former software engineer.
Ancapistani 4y ago
> There's not a single doctor's office or hospital I'm aware of that is HIPAA compliant That mirrors my experience. My GP has a sign-in sheet at the receptionist's desk where you have to write your name when you arrive. They put a single line through your name when you're checked in. Worse, it's usually a notebook that's just turned to a new page every day. If you grabbed that notebook you'd have a list of everyone who visited that office for the past month or so, complete with dates and times.

wswope 4y ago

I’ve never worked anywhere it wasn’t taken extremely seriously either, but I think this is the big news story that HHS is responding to: https://themarkup.org/privacy/2022/12/13/out-of-control-dozens-of-telehealth-startups-sent-sensitive-health-information-to-big-tech-companies https://themarkup.org/privacy/2022/12/13/out-of-control-doze.... Classic tale of VC-backed “startups” going the Uber/Airbnb route and deciding the established rules aren’t worth following.

Nextgrid 4y ago
> Classic tale of VC-backed “startups” going the Uber/Airbnb route and deciding the established rules aren’t worth following. As long as penalties are lower than the profits (and no execs go to jail), the rules aren't actually worth following. Maybe the real innovation of the tech sector in the last decade is figuring out that established laws aren't actually enforced anywhere well enough so you may as well break them.
malisper 4y ago
It's not just start ups here. Lots of hospitals and hospital groups have trackers like Google Analytics installed on their website. From the HHS[0] in many cases this is considered sharing health information with Google: > For example, tracking technologies could collect an individual’s email address and/or IP address when the individual visits a regulated entity’s webpage to search for available appointments with a health care provider. In this example, the regulated entity is disclosing PHI to the tracking technology vendor, and thus the HIPAA Rules apply.

Nextgrid 4y ago

> In my experience, you don't send data anywhere you don't have a BAA. Period, full stop. This really depends on what you consider health data, which itself varies based on how big the marketing team is and the company's desire to obtain "growth & engagement". The below is from an EU perspective, but I'm sure the same would apply in the US. I have been involved in a EU-based HealthTech that had the Facebook SDK (and maybe others too) in the app that fingerprinted the device and pinged Facebook on each run, without user consent nor adequate disclosure (buried in the privacy policy doesn't apply, nor was the privacy policy granular enough about the fingerprinting because Facebook itself doesn't publish any details on it). Were they sending health data? No. But I'd argue that the simple fact that you use a health app and when you use it (and from where, derived from IP address) itself is a major breach. Of course, regardless of the healthcare context, this was also an obvious GDPR breach, but good luck getting any kind of enforcement against that given that the vast majority of apps are equally contaminated by these spyware SDKs. I have seen a similar issue on a UK-based patient portal (the system here is so that third-parties are used to allow patients to access their government-maintained health record and schedule appointments) - full of trackers which had complete access to the page and Javascript context.

malisper 4y ago
> Were they sending health data The recent guidance from the HHS[0] indicates in many cases installing Google Analytics or the Facebook SDK would be considered sending health data to Google or Facebook and therefore be considered a HIPAA violation. From the HHS[0]: > Tracking technologies on a regulated entity’s user-authenticated webpages generally have access to PHI. Such PHI may include, for example, an individual’s IP address, medical record number, home or email addresses, dates of appointments, or other identifying information that the individual may provide when interacting with the webpage. [0] https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...
- johndhi 4y ago
  Does the guidance only apply to user-authenticated web pages? the article suggests 'the website' is all PHI, which I personally find to be an insane interpretation of HIPAA. edit: I found the answer. it's pretty reasonable. basically, no, HIPAA doesn't apply there.

Spooky23 4y ago

The providers lean on you for the heavy lift. The weakness is always at the integration points. It’s all pretty meaningless anyway, lots of real health data is legally leaked via insurance and pharmacy data feeds.

AnEro 4y ago

Same, I'm kind of scared of what others have been doing up too now to warrant this.

fitzrocks 4y ago

You are correct - this is not new. It's the HHS reaffirming what the law says as written. way too many companies got loosey goosey with this stuff. The mental gymnastics we'd hear from healthcare companies "oh our legal team said it's okay to have Facebook installed here because [convoluted and totally not kosher reasoning]" was crazy when you'd review the law as written. Startups, hospital systems, payers...doesn't matter how much resources or the company's particular compliance stance. You'd be amazed where these companies are sending data to Google and Facebook data without consent and without BAAs in place. HHS here is specifically going after larger health networks and hospital systems (typically way more compliance focused than your average healthtech startup).