4 ms·

Doesn't allow data sharing from GoodRX to FB, Google etc. But does allow Amazon to purchase One Medical. I feel like both are pretty bad. But I am trying to und

Doesn't allow data sharing from GoodRX to FB, Google etc. But does allow Amazon to purchase One Medical. I feel like both are pretty bad. But I am trying to understand the logic between allowing one and not the other? Am I missing something? Also $1.5 million, in relative terms, seems pretty small. So again, data violations just seem to be the cost of doing business.

mfer 4y ago
Do you realize that you are talking about two very different situations. In one situation you have a company sharing data with other companies and the laws around that form of data sharing. In the other situation you have what companies can own or buy in terms of other companies. The situations are very different.
- ThaDood 4y ago
  I might not be articulating my point super well since this is HN and I hate typing long drawout thoughts on boards. That being said I understand the situations are different but to me, the sentiment still feels like it should be applied? On one hand you have the FTC fining a company for violations of data sharing, which I am assuming of the one of the concerns is patient privacy. Which to me, seems like a net good thing. Again I would prefer it to be more, but better then not doing nothing at all I suppose. On the other hand, you have one giant company with access to mounds of consumer data purchasing even more sensitive healthcare data without even a blink of the eye. Why was this not challenged? Why fine one company? I might be overthinking it but it seems like a misalignment of priorities. The point of the FTC is to protect consumers, shouldn't both have been investigated? I guess that was the point I was trying to make. Idk, I feel like I'm just rambling at this point.
  - 8ytecoder 4y ago
    (Someone more knowledgeable should correct me if I’m wrong) But my basic understanding of LLCs, subsidiaries …etc is to create boundaries with parent company - usually to shield the parent company. I really doubt if what you’re claiming is true that Amazon has access to one medical data, they’ll have any form of protection at all. Hypothetically speaking, one medical did something horrid and so disastrous that they’re going to have to pay billions of dollars, Amazon would just wind down that unit and not suffer any major consequences. How would this be allowed if there’s no boundary? Edit: so I looked it up https://www.cnbc.com/2022/07/23/amazon-one-medical-deal-gives-it-access-to-my-most-personal-info.html https://www.cnbc.com/2022/07/23/amazon-one-medical-deal-give... “As required by law, Amazon will never share One Medical customers’ personal health information outside of One Medical for advertising or marketing purposes of other Amazon products and services without clear permission from the customer,” an Amazon spokesperson said in an email. “Should the deal close, One Medical customers’ HIPAA Protected Health Information will be handled separately from all other Amazon businesses, as required by law.” Basically, like I thought, they can’t commingle or share data between the two companies. But if something being clearly illegal isn’t enough to convince people (or even the journalist), then that’s a different much bigger issue. Also this: https://www.investopedia.com/terms/s/subsidiary.asp https://www.investopedia.com/terms/s/subsidiary.asp A subsidiary is an independent company that is more than 50% owned by another firm—called the parent company or holding company. Subsidiaries are separate and distinct legal entities from their parent companies.
    - ThePowerOfFuet 4y ago
      > Edit: so I looked it up > https://www.cnbc.com/2022/07/23/amazon-one-medical-deal-gives-it-access-to-my-most-personal-info.html https://www.cnbc.com/2022/07/23/amazon-one-medical-deal-give... > > “As required by law, Amazon will never share One Medical customers’ personal health information outside of One Medical for advertising or marketing purposes of other Amazon products and services without clear permission from the customer,” an Amazon spokesperson said in an email. “Should the deal close, One Medical customers’ HIPAA Protected Health Information will be handled separately from all other Amazon businesses, as required by law.” > Basically, like I thought, they can’t commingle or share data between the two companies. Unfortunately, that's not at all what it says. Amazon has included so many qualifiers that they are disclaiming only a very specific subset of data transfer. I invite you to read it again, word by word and clause by clause.
    - JohnFen 4y ago
      > Amazon will never share One Medical customers’ personal health information outside of One Medical for advertising or marketing purposes of other Amazon products and services without clear permission from the customer Lots of loopholes in there. But even if there weren't, doesn't it feel dangerous to take Amazon at their word with this?
  - mfer 4y ago
    > the sentiment still feels like it should be applied The FTC doesn't operate based on sentiment. Even if the people who work on this have the same feelings they need to operate within laws.
- aj7 4y ago
  Exactly. People are exercising their rage and frustration over the pharma system, when they should be learning to use GoodRx.
LesZedCB 4y ago
hey, they made amazon pinky-swear they wouldn't violate HIPAA. and companies have never reneged immediately after promising not to do bad things. https://www.cnbc.com/2023/01/25/the-live-nation-and-ticketmaster-monopoly-of-live-entertainment.html https://www.cnbc.com/2023/01/25/the-live-nation-and-ticketma... https://www.nytimes.com/2022/11/18/technology/live-nation-ticketmaster-investigation-taylor-swift.html https://www.nytimes.com/2022/11/18/technology/live-nation-ti...
- adrr 4y ago
  HIPAA is a law with real teeth.
  - olliej 4y ago
    yet as we see here those teeth are only applicable to specific classes of businesses - it offers no protection against medical companies selling or leaking your private medical data unless HIPPA applies to the business. There needs to be a law governing the handling of any private medical or health data regardless of business, and that law needs to preclude T&Cs that let a company ignore the law
    - mulmen 4y ago
      This is a civil penalty. It opens the door for class action and criminal investigation, both of which can carry much steeper fines.
renewiltord 4y ago
That's nothing. While the law doesn't allow me (a complete rando) to buy data from United Healthcare, it allows me (a complete rando) to buy shares of AMZN!
- aj7 4y ago
  Forget about UHC. Buy your drugs over the counter with the help of the GoodRx app. Cheaper than Optum.
pyuser583 4y ago
FB and Google are marketing companies. Amazon is a retailer. Nothing odd about retailers acquiring other retailers.
hedora 4y ago
You’re not missing anything. It’s basically illegal for public companies to hold data without offering it for sale. (Have enough money to buy 51% of Google? You can buy all their data!) This could sort of thing could be prevented by Terms of Service agreements, but in practice, companies always reserve the right to change their ToS in the future, and almost always have vague carve outs for internal use of customer data. There’s a similar problem for any private companies that have outstanding debt or payment obligations. If they default or go bankrupt, then the courts will force them to sell user data to help generate the missing cash. This will override any user agreements, since the creditors are generally first in line when a company goes under. The only difference between One Medical and GoodRX here is that One Medical only sold account data to one advertising firm (that I know of).

mfer 4y ago

Do you realize that you are talking about two very different situations. In one situation you have a company sharing data with other companies and the laws around that form of data sharing. In the other situation you have what companies can own or buy in terms of other companies. The situations are very different.

ThaDood 4y ago
I might not be articulating my point super well since this is HN and I hate typing long drawout thoughts on boards. That being said I understand the situations are different but to me, the sentiment still feels like it should be applied? On one hand you have the FTC fining a company for violations of data sharing, which I am assuming of the one of the concerns is patient privacy. Which to me, seems like a net good thing. Again I would prefer it to be more, but better then not doing nothing at all I suppose. On the other hand, you have one giant company with access to mounds of consumer data purchasing even more sensitive healthcare data without even a blink of the eye. Why was this not challenged? Why fine one company? I might be overthinking it but it seems like a misalignment of priorities. The point of the FTC is to protect consumers, shouldn't both have been investigated? I guess that was the point I was trying to make. Idk, I feel like I'm just rambling at this point.
- 8ytecoder 4y ago
  (Someone more knowledgeable should correct me if I’m wrong) But my basic understanding of LLCs, subsidiaries …etc is to create boundaries with parent company - usually to shield the parent company. I really doubt if what you’re claiming is true that Amazon has access to one medical data, they’ll have any form of protection at all. Hypothetically speaking, one medical did something horrid and so disastrous that they’re going to have to pay billions of dollars, Amazon would just wind down that unit and not suffer any major consequences. How would this be allowed if there’s no boundary? Edit: so I looked it up https://www.cnbc.com/2022/07/23/amazon-one-medical-deal-gives-it-access-to-my-most-personal-info.html https://www.cnbc.com/2022/07/23/amazon-one-medical-deal-give... “As required by law, Amazon will never share One Medical customers’ personal health information outside of One Medical for advertising or marketing purposes of other Amazon products and services without clear permission from the customer,” an Amazon spokesperson said in an email. “Should the deal close, One Medical customers’ HIPAA Protected Health Information will be handled separately from all other Amazon businesses, as required by law.” Basically, like I thought, they can’t commingle or share data between the two companies. But if something being clearly illegal isn’t enough to convince people (or even the journalist), then that’s a different much bigger issue. Also this: https://www.investopedia.com/terms/s/subsidiary.asp https://www.investopedia.com/terms/s/subsidiary.asp A subsidiary is an independent company that is more than 50% owned by another firm—called the parent company or holding company. Subsidiaries are separate and distinct legal entities from their parent companies.
  - ThePowerOfFuet 4y ago
    > Edit: so I looked it up > https://www.cnbc.com/2022/07/23/amazon-one-medical-deal-gives-it-access-to-my-most-personal-info.html https://www.cnbc.com/2022/07/23/amazon-one-medical-deal-give... > > “As required by law, Amazon will never share One Medical customers’ personal health information outside of One Medical for advertising or marketing purposes of other Amazon products and services without clear permission from the customer,” an Amazon spokesperson said in an email. “Should the deal close, One Medical customers’ HIPAA Protected Health Information will be handled separately from all other Amazon businesses, as required by law.” > Basically, like I thought, they can’t commingle or share data between the two companies. Unfortunately, that's not at all what it says. Amazon has included so many qualifiers that they are disclaiming only a very specific subset of data transfer. I invite you to read it again, word by word and clause by clause.
  - JohnFen 4y ago
    > Amazon will never share One Medical customers’ personal health information outside of One Medical for advertising or marketing purposes of other Amazon products and services without clear permission from the customer Lots of loopholes in there. But even if there weren't, doesn't it feel dangerous to take Amazon at their word with this?
- mfer 4y ago
  > the sentiment still feels like it should be applied The FTC doesn't operate based on sentiment. Even if the people who work on this have the same feelings they need to operate within laws.
aj7 4y ago
Exactly. People are exercising their rage and frustration over the pharma system, when they should be learning to use GoodRx.

LesZedCB 4y ago

hey, they made amazon pinky-swear they wouldn't violate HIPAA. and companies have never reneged immediately after promising not to do bad things. https://www.cnbc.com/2023/01/25/the-live-nation-and-ticketmaster-monopoly-of-live-entertainment.html https://www.cnbc.com/2023/01/25/the-live-nation-and-ticketma... https://www.nytimes.com/2022/11/18/technology/live-nation-ticketmaster-investigation-taylor-swift.html https://www.nytimes.com/2022/11/18/technology/live-nation-ti...

adrr 4y ago
HIPAA is a law with real teeth.
- olliej 4y ago
  yet as we see here those teeth are only applicable to specific classes of businesses - it offers no protection against medical companies selling or leaking your private medical data unless HIPPA applies to the business. There needs to be a law governing the handling of any private medical or health data regardless of business, and that law needs to preclude T&Cs that let a company ignore the law
  - mulmen 4y ago
    This is a civil penalty. It opens the door for class action and criminal investigation, both of which can carry much steeper fines.

renewiltord 4y ago

That's nothing. While the law doesn't allow me (a complete rando) to buy data from United Healthcare, it allows me (a complete rando) to buy shares of AMZN!

aj7 4y ago
Forget about UHC. Buy your drugs over the counter with the help of the GoodRx app. Cheaper than Optum.

pyuser583 4y ago

FB and Google are marketing companies. Amazon is a retailer. Nothing odd about retailers acquiring other retailers.

hedora 4y ago

You’re not missing anything. It’s basically illegal for public companies to hold data without offering it for sale. (Have enough money to buy 51% of Google? You can buy all their data!) This could sort of thing could be prevented by Terms of Service agreements, but in practice, companies always reserve the right to change their ToS in the future, and almost always have vague carve outs for internal use of customer data. There’s a similar problem for any private companies that have outstanding debt or payment obligations. If they default or go bankrupt, then the courts will force them to sell user data to help generate the missing cash. This will override any user agreements, since the creditors are generally first in line when a company goes under. The only difference between One Medical and GoodRX here is that One Medical only sold account data to one advertising firm (that I know of).