5 ms·

The thing is, HIPAA doesn't apply here. HIPAA doesn't actually cover "anything medical." It only covers (approximately) things involved in getting insurance to

by lmkg 4y ago

The thing is, HIPAA doesn't apply here. HIPAA doesn't actually cover "anything medical." It only covers (approximately) things involved in getting insurance to pay for medical treatment. GoodRx did not touch the consumer's insurance, so they "complied" with HIPAA by not being a covered entity in the first place. At the Federal level, the only broad general protections for medical data are (apparently) some FTC fine print. The fact that this exists at all means that medical data is treated more seriously than other forms of personal data, but as you can see that is a very low bar to clear (literally doesn't exist).

jollofricepeas 4y ago
Not exactly. This is inaccurate in part. HIPAA governs covered entities and business associates (BA) who work on behalf of a CE. Covered Entities are healthcare providers or insurance companies. CEs are required to have their BAs sign business associate agreement where they’re regulated under HIPAA. GoodRx convinced patients to provide them their health information directly. Unless, they’ve signed a BAA with a CE, the FTC is the only government body with regulatory power here however I would imagine there’s a legal firm prepping a class action against GoodRx right now as well. The class action is what will be expensive for them. The fact that they have been fined is what should make the action hopefully a slam dunk. Sources: - https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg... - https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html https://www.hhs.gov/hipaa/for-professionals/security/laws-re...
- mrguyorama 4y ago
  Since when has a class action lawsuit EVER cost a company a real amount of money?
  - porknubbins 4y ago
    I think you have it backwards- class actions frequently cost companies a significant amount of money. Its just that spread across millions the verdict or settlement is close to worthless from the plaintiffs perspective.
  - jollofricepeas 4y ago
    The class action for the WellPoint (Anthem) breach was $115 million. That smells like real money to me. The total cost for the biggest healthcare breach was around $500 million give or take.
  - deleted 4y ago
    [deleted]
- SkyPuncher 4y ago
  You've missed a part. For providers, they must be HIPAA compliant "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard." It seems unlikely that GoodRx was processing data that met that standard. https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...
  - jollofricepeas 4y ago
    Actually, they were… There’s no wiggle room here unless the data has been de-identified (a high barrier). It wasn’t. The standard you’re refering to is for e-PHI which is “individually identifiable health information.” You’ll want to see the Privacy Rule for details but GoodRx shared email addresses, phone numbers and mobile identifiers according to the FTC complaint. https://www.ftc.gov/system/files/ftc_gov/pdf/goodrx_complaint_for_permanent_injunction_civil_penalties_and_other_relief.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/goodrx_complain...
    - SkyPuncher 4y ago
      The complaint pretty clearly states the FTC does not view them as a covered entity. There are several statements, but the most clear is near the end of page 23: > In truth and in fact, GoodRx is not a HIPAA-covered entity, and its privacy and information practices did not comply with HIPAA’s requirements. Further, on page 25, they define them as a "vendor of personal health records" - which explicitly excludes covered entities (definition on page 19). ----- This is consistent with my understanding of a covered entity. Without the "transactions for which HHS has adopted a standard", GoodRx is not a covered entity. Further, even if they were a covered entity, it's possible for them to segment their HIPAA and non-HIPAA compliant business units. This is called a "hybrid entity". ---- Interestingly, the FTC is pinging them on for a misleading representation of being a covered entity. Since GoodRX was not a covered entity, they were not technically violating HIPAA.
      - jollofricepeas 4y ago
- helsinkiandrew 4y ago
  > I would imagine there’s a legal firm prepping a class action Already filed: https://www.classaction.org/news/class-action-alleges-goodrx-secretly-shares-prescription-treatment-data-with-facebook-google https://www.classaction.org/news/class-action-alleges-goodrx... If their 11M subscribers are each worth ~$500 that might be a little more of a deterrent.
  - deleted 4y ago
    [deleted]
pyuser583 4y ago
What’s getting the company in trouble with the FTC is their statements about protecting patient privacy. I really wish the FTC did this more often. If you’re marketing your service as privacy focused, you can just sell your customers data. Plenty of services start out as free-speech/privacy focused, but change their tune once advertisers make demands. That should be allowed. If you built your community by promising privacy, you shouldn’t be able to go back in that easily. Lock in is a real thing. Abusing it is wrong.

by lmkg 4y ago

jollofricepeas 4y ago

Not exactly. This is inaccurate in part. HIPAA governs covered entities and business associates (BA) who work on behalf of a CE. Covered Entities are healthcare providers or insurance companies. CEs are required to have their BAs sign business associate agreement where they’re regulated under HIPAA. GoodRx convinced patients to provide them their health information directly. Unless, they’ve signed a BAA with a CE, the FTC is the only government body with regulatory power here however I would imagine there’s a legal firm prepping a class action against GoodRx right now as well. The class action is what will be expensive for them. The fact that they have been fined is what should make the action hopefully a slam dunk. Sources: - https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg... - https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html https://www.hhs.gov/hipaa/for-professionals/security/laws-re...

mrguyorama 4y ago
Since when has a class action lawsuit EVER cost a company a real amount of money?
- porknubbins 4y ago
  I think you have it backwards- class actions frequently cost companies a significant amount of money. Its just that spread across millions the verdict or settlement is close to worthless from the plaintiffs perspective.
- jollofricepeas 4y ago
  The class action for the WellPoint (Anthem) breach was $115 million. That smells like real money to me. The total cost for the biggest healthcare breach was around $500 million give or take.
- deleted 4y ago
  [deleted]
SkyPuncher 4y ago
You've missed a part. For providers, they must be HIPAA compliant "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard." It seems unlikely that GoodRx was processing data that met that standard. https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...
- jollofricepeas 4y ago
  Actually, they were… There’s no wiggle room here unless the data has been de-identified (a high barrier). It wasn’t. The standard you’re refering to is for e-PHI which is “individually identifiable health information.” You’ll want to see the Privacy Rule for details but GoodRx shared email addresses, phone numbers and mobile identifiers according to the FTC complaint. https://www.ftc.gov/system/files/ftc_gov/pdf/goodrx_complaint_for_permanent_injunction_civil_penalties_and_other_relief.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/goodrx_complain...
  - SkyPuncher 4y ago
    The complaint pretty clearly states the FTC does not view them as a covered entity. There are several statements, but the most clear is near the end of page 23: > In truth and in fact, GoodRx is not a HIPAA-covered entity, and its privacy and information practices did not comply with HIPAA’s requirements. Further, on page 25, they define them as a "vendor of personal health records" - which explicitly excludes covered entities (definition on page 19). ----- This is consistent with my understanding of a covered entity. Without the "transactions for which HHS has adopted a standard", GoodRx is not a covered entity. Further, even if they were a covered entity, it's possible for them to segment their HIPAA and non-HIPAA compliant business units. This is called a "hybrid entity". ---- Interestingly, the FTC is pinging them on for a misleading representation of being a covered entity. Since GoodRX was not a covered entity, they were not technically violating HIPAA.
    - jollofricepeas 4y ago
helsinkiandrew 4y ago
> I would imagine there’s a legal firm prepping a class action Already filed: https://www.classaction.org/news/class-action-alleges-goodrx-secretly-shares-prescription-treatment-data-with-facebook-google https://www.classaction.org/news/class-action-alleges-goodrx... If their 11M subscribers are each worth ~$500 that might be a little more of a deterrent.
- deleted 4y ago
  [deleted]

pyuser583 4y ago

What’s getting the company in trouble with the FTC is their statements about protecting patient privacy. I really wish the FTC did this more often. If you’re marketing your service as privacy focused, you can just sell your customers data. Plenty of services start out as free-speech/privacy focused, but change their tune once advertisers make demands. That should be allowed. If you built your community by promising privacy, you shouldn’t be able to go back in that easily. Lock in is a real thing. Abusing it is wrong.