5 ms·

Actually, they were… There’s no wiggle room here unless the data has been de-identified (a high barrier). It wasn’t. The standard you’re refering to is for e-

Actually, they were… There’s no wiggle room here unless the data has been de-identified (a high barrier). It wasn’t. The standard you’re refering to is for e-PHI which is “individually identifiable health information.” You’ll want to see the Privacy Rule for details but GoodRx shared email addresses, phone numbers and mobile identifiers according to the FTC complaint. https://www.ftc.gov/system/files/ftc_gov/pdf/goodrx_complaint_for_permanent_injunction_civil_penalties_and_other_relief.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/goodrx_complain...

SkyPuncher 4y ago
The complaint pretty clearly states the FTC does not view them as a covered entity. There are several statements, but the most clear is near the end of page 23: > In truth and in fact, GoodRx is not a HIPAA-covered entity, and its privacy and information practices did not comply with HIPAA’s requirements. Further, on page 25, they define them as a "vendor of personal health records" - which explicitly excludes covered entities (definition on page 19). ----- This is consistent with my understanding of a covered entity. Without the "transactions for which HHS has adopted a standard", GoodRx is not a covered entity. Further, even if they were a covered entity, it's possible for them to segment their HIPAA and non-HIPAA compliant business units. This is called a "hybrid entity". ---- Interestingly, the FTC is pinging them on for a misleading representation of being a covered entity. Since GoodRX was not a covered entity, they were not technically violating HIPAA.
- jollofricepeas 4y ago
  A clarification… I’m not saying that they are a CE only that if they were then the data is clearly PHI and had not been de-identified per the standard that you referenced previously.
- catchnear4321 4y ago
  It seems important to break out this quote. > on page 25, they define them as a "vendor of personal health records" So the FTC itself considers GoodRX an entity primarily focused on selling the health information of individuals. Just in case anyone though it was something else.
vba616 4y ago
>unless the data has been de-identified (a high barrier) It is claimed something like half the population can be uniquely identified just with DOB, gender, and zip code. "A high barrier" is ambiguous - it could mean that it is high because it's difficult and expensive to comply with the legal standards - or it could mean it provides a high level of protection against uniquely identifying subjects. I'm betting 100% of the former and 0% of the latter.
- jollofricepeas 4y ago
  De-identification is a hard problem. All of the major enterprise healthcare organizations have dedicated analysts who work solely on de-identifying datasets so that the data can be used for commercial purposes.
  - JohnFen 4y ago
    > De-identification is a hard problem. It's such a hard problem that it is not achievable except in very specific circumstances, such as if the data is just a single single datapoint or if the data is aggregated with a lot of other data, and the original individual datapoints are deleted. In practice, whenever you hear anyone claim they've "anonymized" or "de-identified" your data, if you assume that's not true, you're much more likely to be right than wrong.
salawat 4y ago
Worked in the space, and GoodRx would get transactions off the same pipelines every other PBM did... If that doesn't make them a CE, then somebody has some 'splaining to do.
- jkaplowitz 4y ago
  I think you're right that someone has some 'splaining to do, but that someone is the legislators who specified such a narrow scope, and/or possibly the regulators if they didn't incorporate the broadest scope allowed by the law into the regulations. Here is who qualifies as a CE: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities... How does GoodRx fit into any of these categories? I don't see it.
- SkyPuncher 4y ago
  It seems unclear is a PBM is actually required to be HIPAA compliant. It's possible some health care providers (think large hospitals) enforce HIPAA via contractual obligations without federal law directly requiring PBMs to be covered entities. That would give a path for GoodRx to interact without being in violation of HIPAA.
  - salawat 4y ago
    PBM's are definitely CE's under HIPAA.

SkyPuncher 4y ago

The complaint pretty clearly states the FTC does not view them as a covered entity. There are several statements, but the most clear is near the end of page 23: > In truth and in fact, GoodRx is not a HIPAA-covered entity, and its privacy and information practices did not comply with HIPAA’s requirements. Further, on page 25, they define them as a "vendor of personal health records" - which explicitly excludes covered entities (definition on page 19). ----- This is consistent with my understanding of a covered entity. Without the "transactions for which HHS has adopted a standard", GoodRx is not a covered entity. Further, even if they were a covered entity, it's possible for them to segment their HIPAA and non-HIPAA compliant business units. This is called a "hybrid entity". ---- Interestingly, the FTC is pinging them on for a misleading representation of being a covered entity. Since GoodRX was not a covered entity, they were not technically violating HIPAA.

jollofricepeas 4y ago
A clarification… I’m not saying that they are a CE only that if they were then the data is clearly PHI and had not been de-identified per the standard that you referenced previously.
catchnear4321 4y ago
It seems important to break out this quote. > on page 25, they define them as a "vendor of personal health records" So the FTC itself considers GoodRX an entity primarily focused on selling the health information of individuals. Just in case anyone though it was something else.

vba616 4y ago

>unless the data has been de-identified (a high barrier) It is claimed something like half the population can be uniquely identified just with DOB, gender, and zip code. "A high barrier" is ambiguous - it could mean that it is high because it's difficult and expensive to comply with the legal standards - or it could mean it provides a high level of protection against uniquely identifying subjects. I'm betting 100% of the former and 0% of the latter.

jollofricepeas 4y ago
De-identification is a hard problem. All of the major enterprise healthcare organizations have dedicated analysts who work solely on de-identifying datasets so that the data can be used for commercial purposes.
- JohnFen 4y ago
  > De-identification is a hard problem. It's such a hard problem that it is not achievable except in very specific circumstances, such as if the data is just a single single datapoint or if the data is aggregated with a lot of other data, and the original individual datapoints are deleted. In practice, whenever you hear anyone claim they've "anonymized" or "de-identified" your data, if you assume that's not true, you're much more likely to be right than wrong.

salawat 4y ago

Worked in the space, and GoodRx would get transactions off the same pipelines every other PBM did... If that doesn't make them a CE, then somebody has some 'splaining to do.

jkaplowitz 4y ago
I think you're right that someone has some 'splaining to do, but that someone is the legislators who specified such a narrow scope, and/or possibly the regulators if they didn't incorporate the broadest scope allowed by the law into the regulations. Here is who qualifies as a CE: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities... How does GoodRx fit into any of these categories? I don't see it.
SkyPuncher 4y ago
It seems unclear is a PBM is actually required to be HIPAA compliant. It's possible some health care providers (think large hospitals) enforce HIPAA via contractual obligations without federal law directly requiring PBMs to be covered entities. That would give a path for GoodRx to interact without being in violation of HIPAA.
- salawat 4y ago
  PBM's are definitely CE's under HIPAA.