13 ms·
Telehealth startup Cerebral shared millions of patients’ data with advertisers
- smn1234 4y agoconfused as the following statements are conflated: 'shared ... data collected' and 'disclosed the security lapse' so was this intentional, unintentional, negligent ?
- lazyfanatic 4y agoyou know how it is, cookies in bed @ midnight, then they get everywhere and somehow they sell all your information to advertisers. C'mon Technology, amiriteguys?
- blakesterz 4y agoHoly crap. Sometimes I see headlines like this and then the details aren't all that bad. This one is all that bad. They gave it all away. They do call it "inadvertent" though. "The information disclosed may have included name, phone number, email address, date of birth, IP address, Cerebral client ID number, and other demographic or information. The information disclosed may also have included the service the individual selected, assessment responses, and certain associated health information, subscription plan type, appointment dates and other booking information, treatment, and other clinical information, health insurance/pharmacy benefit information (for example, plan name and group/member numbers), and insurance co-pay amount." Because Cerebral is a telehealth startup and handles confidential patient data, it’s considered a company covered under the U.S. health privacy law known as HIPAA. According to a list of health-related security lapses under investigation by the U.S. Department of Health and Human Services, which oversees and enforces HIPAA, Cerebral’s data lapse is the second-largest breach of health data in 2023.
- danielvaughn 4y agoThis is pretty wild. HIPAA does not fuck around, even a minor infringement is taken very seriously. The lawsuits are gonna be something else.
- coldcode 4y agoMaybe that's new, when I was a HIPAA architect for a health related company, I rarely saw anyone being sued or even investigated (mid 2000s). Given how many violations I saw there (and complained about) nothing ever changed because they felt no one would do anything to them.
- claytongulick 4y agoIt has changed a lot since then. 2015 was a huge overhaul of HIPAA and its enforcement. Prior to that, it was just a polite suggestion.
- Optimal_Persona 4y ago+1 I work in publicly funded mental health and our responses to possible/actual HIPAA breaches are monitored very closely by our funders. So even if an event occurs that is not deemed to be an actual breach, if our response/investigation/corrective action is found to be unsatisfactory, our county/state/fed contracts, foundation grants, and Joint Commission Accreditation could be altered/canceled.
- danielvaughn 4y agoReally? That's surprising to me. I worked a hospital job for several years, and had heard of employees making minor infractions who were fired and sued by both the hospital as well as the patient(s). Though those were individuals, things could be different if you're a corporation [rolls eyes pessimistically].
- hn_throwaway_99 4y ago9 times out of 10 those types of infractions are intentional, stuff like this: https://www.reliasmedia.com/articles/11576-13-hospital-workers-fired-for-snooping-in-britney-spears-medical-records https://www.reliasmedia.com/articles/11576-13-hospital-worke...
- TuringNYC 4y ago
- falcolas 4y ago> Cerebral’s data lapse is the second-largest breach of health data in 2023. We're not even three full months into 2023, and this is the second biggest? I can't even comprehend how anybody thought this was a good idea. Really thinking that basing our economy's primary motivator on human greed isn't doing us many favors right now, not when it's so easy for bad actors to out-earn any and all penalties.
- mistrial9 4y agothis is not new -- in the 1980s I recall the story of a sales agent who figured out that radio station license renewal or sale was subject to strict conditions as part of protecting market areas. So when a radio station was approaching FCC license deadline, this sales agent discovered that pre-bidding on the license before the legal renewal started, and then pre-selling that license to interested parties as if they had control of it, was very profitable; rinse, repeat. A sales-boiler room was setup in Florida and stations across the USA got the treatment. Everyone gets paid. When sleepy enforcement caught up, the guy terminated all his willing sales guys with some cash to be quiet, and literally hid in his sister-in-law's basement for more than two years, with lots of money to pay bills.
- falcolas 4y agoIMO, the problem is that they no longer have to hide. They pay a pittance of a fine (usually a pittance because the fine amount is static and set a decade+ ago) and keep right on doing it.
- p1esk 4y agobasing our economy's primary motivator on human greed isn't doing us many favors right now How would you fix it?
- moomoo3000 4y agoHeavy fines
- 4y ago
- techwizrd 4y agoHandling confidential patient data does not necessarily mean the organization is a covered entity under HIPAA. One of the organizations I work with receives, stores, and uses significant amounts of confidential patient data, but they are not a covered entity under HIPAA (although they are covered separately under the Privacy Act).
- lmkg 4y agoYou are correct, but despite the article's misunderstanding of HIPAA they are covered by it. The incident is being investigated by HHS, as opposed to the FTC who dealt with the (non-HIPAA-covered) GoodRx incident from like yesterday. According to HHS incident listing[1], the are a Business Associate. This means they handle patient data because they are contracted to do so by a HIPAA-covered entity. I've never heard of Cerebral before (and hopefully I won't again), but that likely means that their customers are the hospitals. [1] https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- jonathankoren 4y ago> I've never heard of Cerebral before (and hopefully I won't again), but that likely means that their customers are the hospitals. Cerebral is a mental health therapy app, but unlike most apps, they also prescribed medicine until very recently. They stopped after the FDA started investigating them for being a pill mill for schedule II controlled substances like adderall (ie amphetamine salts) https://www.theverge.com/2022/5/9/23063356/cerebral-telehealth-prescriptions-investigation-adhd-adderall-doj-dea https://www.theverge.com/2022/5/9/23063356/cerebral-teleheal...
- matheusmoreira 4y agoA corporation prescribing amphetamines? No doctors involved at all? How is that possible?
- prepend 4y ago
- wins32767 4y agoThat's going to be tens of millions of dollars of fines. HIPAA is not anything to mess around with. Data breaches like that are an existential threat to a medtech.
- junon 4y agoIf memory serves the fines stop after 1.5 million. Please someone correct me if I'm misremembering.
- deleted 4y ago[deleted]
- warent 4y agoIt looks like the maximum penalty (if corrected within 30 days) is about $450,000 as of 2022. However, there is apparently an addendum to the law that the State Attorney General is authorized to impose civil penalties in addition to this. As we see, Anthem settled for $115,000,000 for a similar breach. So, yeah, unless Cerebral gets a very lenient AG, they're done. https://www.hipaajournal.com/court-approves-anthem-115-million-data-breach-settlement/ https://www.hipaajournal.com/court-approves-anthem-115-milli... https://www.hipaajournal.com/what-is-the-maximum-penalty-for-violating-hipaa/ https://www.hipaajournal.com/what-is-the-maximum-penalty-for...
- time0ut 4y agoThey bumped it to 1.9 for inflation. There are also criminal jail time penalties though. It depends on intent. Unlikely it would happen though even if it is deserved.
- hef19898 4y agoWell, and than people ridicule Germany because patient files are still handled decentralized, on paper and shared between doctors by fax...
- luckylion 4y agoThey are? All doctors I've been to in the past 10 years have them digitally and will transfer files digitally to your new doctor -- they won't even ask you if you've asked for them to be transferred. It's enough to tell my new doctor where I've previously been and they'll contact them and handle everything else.
- freetinker 4y agoThat’s probably because that’s security by accident, and it’s only in comparison to the shit show we have today. It isn’t security by thoughtful, deliberate design.
- siva7 4y agoNot anymore, the digital patient file is finally ready.
- hef19898 4y agoWith a usage of, what did they say in the news today, 13% ?
- sizzle 4y agoI hope people go to prison over this injustice. Insurance companies probably added this mental health data to our shadow profiles.
- atkailash 4y ago[dead]
- alexpetralia 4y agoAt least 1,400 employees are listed on LinkedIn as working there. Are they all imminently going to be out of a job?
- erellsworth 4y agoI don't know, but if I were one of them I'd for damn sure be polishing my resume.
- uptown 4y agoNot necessarily. A lot of prisons these days have pretty good work-release programs.
- siva7 4y agoBut the engineers didn't know, they're innocent
- bilbo0s 4y agoPlease tell me people are not this naive? Look, I'm fairly certain Cerebral has not incurred any criminal liability here. I could be wrong, but based on the information available right now, I don't think they have anything to worry about. That said, if new information comes to light, and it turns out crimes were committed, you can't say "I didn't know." You can't seriously believe that you can help someone commit a crime, and not incur any criminal liability for that act on the grounds of ignorance? Do you think you can be caught with drugs at an airport and expect to be released because "you didn't know" they were there? Engineers, please protect yourselves. It doesn't matter what legal relationship you have with your employer, one of the first principals of criminal law you're exposed to in law school is that one cannot contract away criminal liability. It's not possible. Keep this in mind when you're working at whatever random crypto firm you're at that wants to build an "exchange". Keep it in mind when you're working at Boeing and they ask you to sign a quality document for a part you worked on. Keep it in mind when you're working at a health care startup and they ask you to sign the quality documents they need to register with the FDA for 510(k). (By the way, the way the attorney at my first medical imaging startup explained it to us, each signature is a single count. So you signed a document and initialed it in 7 places? OK, guess what? That's 8 counts of lying to the federal government when everything goes south. We were advised to always keep that in mind.)
- phkahler 4y ago>> The telehealth startup, which exploded in popularity during the COVID-19 pandemic after rolling lockdowns and a surge in online-only virtual health services, disclosed the security lapse That's not a security lapse, it's a straight up violation of HIPPA done for profit. They also seem to suggest that ToS can get around that if only people would read it. Sorry nope.
- jonathankoren 4y agoI came here to say the same thing. This needs a lawsuit. This isn’t some accidental breech. This was intentional. There’s zero reason to be sharing this information.
- edot 4y agoExtremely scammy company. Not surprised. They take credit card information first, then do a questionnaire, then tell you if services for you are available in your area. If they aren’t, you’re still charged and they make it extremely difficult to cancel or get a refund. Had them hang up on me twice. Eventually just did a chargeback.
- coffeebeqn 4y agoA mental health tele health startup. Hey these people are anxious/depressed/bipolar. Wanna sell some “solutions” to them? Maybe this explains some of the (questionable legality) drug ads I get bombarded with on Facebook because I was a cerebral customer for a little bit. I gotta say their “counseling” was hilariously bad and made me cancel it but keep the prescription with my GP. It was like a call center worker reading off a paper giving you “therapy”. I did it twice and was like this is a joke
- JohnFen 4y ago...and yet people sometimes wonder why I avoid using these sorts of services, and why I work so hard to minimize the amount of data that companies learn about me.
- deleted 4y ago[deleted]
- motohagiography 4y agoThere's a real issue with this where another large health company has a captive market, where small providers are being forced to take on the product to integrate with their larger partners, and their ToS has all these terrible loopholes for them to ignore national laws by pretending they have "consent." Health is structured as a radical monopoly, and if you thought pharma were a bit cavalier about people, wait until you see health IT. It's the original platform. Their customers are doctors and hospitals - people are the product.
- qwertyuiop_ 4y agoHealth data startups are mainly in the business for the data and how to monetize it. Not to provide healthcare services. I hope they die with the rising interest rates.
- dahfizz 4y agoStartups are fun when they make websites. I'm never going to trust a "move fast and break things" VC startup with real world things like medicine or food.
- deleted 4y ago[deleted]
- modzu 4y agooh no not my health data!!! seriously though, why do we put health data in some kind of special class worthy of more privacy than anything else? your entire identity is out there -- where you live, when you're home, who you know, what you download, pictures of your children, how much money you have, where your great great fucking grandma is from... tell you one thing, if your health data is not in that list, it soon will be
- bigbillheck 4y agoYou've got a point, it should be illegal to disclose those other kinds of data as well.
- peruvian 4y agoThe therapy/mental health startup space seems like a mess. Tons of companies in the space popped up in the past five years. Don't expect any to be around in five.
- sharemywin 4y agoYou know the start up, mantra: Move fast and break things. apparently the law is one of those things.
- JohnFen 4y ago"Move fast and break things" is a dubious mantra to begin with, but it's downright abhorrent when applied to things like health services.
- naijaboiler 4y agoBy nature and necessarily so, healthcare is not "move fast break things" It's move if and only if we are provably sure that the new movement is an improvement on status quo. "First, Do no harm" is the ethos of the medical world.
- siva7 4y agoThe mantra predates the DevOps revolution and apparently didn't age well.
- whalesalad 4y agoI imagine a lot of them are doing this. My experience with Done (donefirst.com) was super sketchy and terrible. The whole thing is fake it till you make it energy.
- anon84873628 4y agoAfter provider mistakes multiple months in a row, and contacting a useless support team, I was eventually able to get to an operations person who knew how to do customer service and sorted the issues out. Thankfully I was able to establish a relationship directly with the new provider before all the pharmacies called shenanigans. (Like it seems many other legit patients did - a failure mode of any two sided marketplace) It's a shame because there is an opportunity to help people by disrupting the traditional healthcare companies. The local large conglomerate Psych department is stuck in the 90s and can't understand why you would want to use medication on the weekends (surely ADHD only matters if it's affecting your ability to work for the man?!) And most independent practices are completely saturated with patients already (assuming they even take your insurance).
- mola 4y agoWell, this is how disrupting the healthcare system looks like. There's no other end state when you make the goal of the system make as much money as possible.
- PragmaticPulp 4y agoCerebral became famous for selling Adderall and Xanax prescriptions as a subscription service. They advertised on social media sites like TikTok. The “patients” were rushed through the minimal telehealth screenings that they could get away with before writing the prescription, as providers were incentivized to do as many calls per hour as they could. Worse, whistleblowers have revealed that the company was encouraging their providers to write more Schedule II prescriptions (high addictive potential) and avoid the non-addictive alternatives because they determined they the Schedule II patients had a higher retention rate: https://www.theverge.com/2022/5/9/23063356/cerebral-telehealth-prescriptions-investigation-adhd-adderall-doj-dea https://www.theverge.com/2022/5/9/23063356/cerebral-teleheal... Multiple major pharmacies refused to fill prescriptions from Cerebral because it was such a blatant internet prescription mill. I was a mentor in a remote mentoring program at a time and it was stunning to see the Slack side conversations where college students were bragging about how easily they were getting high-dose Adderall prescriptions from the company after consultations measured in a couple minutes. One person shared a link to a script people were using that would trigger the providers to increase their dose on every visit, including lying about certain factors to help overcome provider concerns about going into high doses. One student had reached 60mg of Adderall per day (the maximum dose, far above common dosing) and was clearly overstimulated, unwell, and, frankly, hooked on their new stimulant source. Terrible company. It’s going to leave a mark on the availability of ADHD treatment for years to come, I’m afraid.
- whalesalad 4y agoDone did the same thing. Massive growth. A new therapist every month. Pharmacies would stop supporting it, so that would change every month or so too. Absolutely terrible experience. It's easier to buy drugs illegally.
- dymk 4y agoThrough Done, I was given a Zoom meeting with a Florida-based practitioner (I'm on the west coast). They wrote me an Adderall prescription after 15 minutes of questions. This felt sketchy at best, and malpractice at worst. I sought out a real, local doctor with a specialty in mental health, who I could make my primary care physician and have a long-term patient relationship with. Unsurprisingly, that route not only assures that I'm getting good medical treatment, but any Rx issues that pop up are resolved quickly and relatively painlessly.
- Benlights 4y agoPeople are throwing the word fine around, what there needs to be is jail time...
- domrdy 4y agoOn another note, isn't it just fantastic that Amazon made a pinky-swear "promise" to not use patient data it acquired with (Alphabet-backed) OneMedical? I mean, what could possibly go wrong with such an ironclad guarantee? It's not like Amazon has a history of exploiting user data for profit or anything. I feel so much better knowing that our medical information is in such trustworthy hands! https://www.ftc.gov/system/files/ftc_gov/pdf/2210191amazononemedicalkhanslaughterwilsonbedoya.pdf https://www.ftc.gov/system/files/ftc_gov/pdf/2210191amazonon...
- CatWChainsaw 4y ago"I have altered the deal. Pray I do not alter it any further."
- icu 4y agoAmerica is really atrocious when it comes to data protection accountability. I wonder if Cerebral customers will have to sue in a class action to get any legal recourse.
- sjkoelle 4y agowhile sharing data with advertisers is clearly bad, im going to make a contrarian take that allowing hipaa opt out could be very beneficial to peoples health
- bentcorner 4y agoI have wondered more than once if complete and total sharing of all data could lead to new insights that are currently not possible. There is no way this could happen for good reason, but I wonder in an alternate universe what good could come of it.
- siva7 4y agoWell, denial of healthcare insurance as an example - from the POV of the insurers.
- awinter-py 4y agofwiw the new york state health insurance portal has snap + tiktok integrations that make ajax calls it's too easy to make this mistake throw the book at cerebral, fine, but also legislate 1) private right of action and 2) shared liability by pixel vendors, so individual consumers can catch this early and adtech has like some incentive to not work with health cos
- shagymoe 4y agoAre you telling me that the company who suckered me into creating a roadmap and hiring plan as part of the interview process for the Head of Engineering position and then ghosted me after I presented it has made a horrible technical blunder?! I'm shocked! /s. Fun fact: I gave the "HIPAA Compliance Audit & Actioning" project the highest priority of all their projects. [edit] I dug up my response to their recruiter who contacted me 1.5 years later for an EM role. "Hi <recruiter>, I interviewed with Cerebral in 2020 for Head of Engineering. I put together a slide deck outlining exactly how I would build out the team, including resourcing costs and project prioritization. I then presented this to Kyle, the CEO. I literally never heard back from him or Maddie, even after requesting the status of my candidacy. So, no, I would never be interested in working for Cerebral and I would surely advise everyone I've ever met to avoid the company as well."
- siva7 4y agoThanks for sharing. I guess when some healthcare CEOs are hearing the word HIPAA the cold sweat starts running down.
- neilv 4y ago> News of Cerebral’s years-long data lapse comes just weeks after the U.S. Federal Trade Commission slapped GoodRx with a $1.5 million fine and ordered it to stop sharing patients’ health data with advertisers, and BetterHelp was ordered to pay customers $8.5 million for mishandling users’ data. The amounts seem somewhere between a handslap and a loving caress.
- bilbo0s 4y agoThat's because they didn't get slapped for HIPAA violations. They got fined by the FTC, not HHS. To put it into context, Anthem got hit with USD115 Million in fines for a breach similar to Cerebral's. Just my guess, but I'd put money on Cerebral being finished as a going concern.
- siva7 4y agoThanks. This is what finally ruins it for everyone else in startup land who plays by the rules.
- vegcel 4y agoI signed up and paid for service on Cerebral in California, anyone have the latest scoop on a class action lawsuit forming? I want to get signed on.
- nmstoker 4y agoClearly they ought to be in existential trouble for this, but the companies on the receiving side need to be bollocked (unless they've evidence they promptly reported unsuitable information being shared with them). Come down heavy on all parties and it'll gradually stop happening.
- Eumenes 4y agoI truly don't get Telehealth ... Who TF is using this stuff?
- tasty_freeze 4y agoI can't answer for everyone, just me. I don't know anything about Cerebral, but I started seeing a therapist two days ago, my first time ever. I have nothing serious going on, but I'm getting near retirement and want a sounding board to make sure I'm prepared for such a significant change to my identity. We're doing it remotely. Why? It is really convenient. I'm busy and taking out 50 minutes during work hours is bad enough, but adding another 50 minutes round trip travel time would be much worse.
- SoftTalker 4y agoAgree. I still operate under the assumption that anything I put online will become public at some point. Thus I don’t do much online that has any connection to my real identity. I do my taxes on paper. Telehealth is right out.
- piperswe 4y agoMy rural town doesn't have any psychiatry practices as far as I know. I use telehealth to be able to get treatment from a psychiatry practice in a nearby city without having to drive 90 minutes each way.
- rationalfaith 4y ago[dead]
- austinpena 4y agoAs context (not that it makes it better), but this data is sent hashed[0]. Advertisers that don't send this data are at a severe disadvantage when running ads on social media due to the privacy changes Apple rolled out. Inexcusable behavior, but this is why it was done. [0] https://developers.facebook.com/docs/marketing-api/conversions-api/parameters/ https://developers.facebook.com/docs/marketing-api/conversio...
- rationalfaith 4y ago[dead]
- lofatdairy 4y agoDavid Mou should really have his license to practice revoked. What a fucking clown
- ck425 4y agoAs someone who works for the NHS building systems that handle user data this blows my mind. How was "don't give advertisers personal data" or at the very least "don't give advertisers medical data" not top priority!? This is the type of data breach that people should go to jail for.