10 ms·
Holy crap. Sometimes I see headlines like this and then the details aren't all that bad. This one is all that bad. They gave it all away. They do call it "inad
by blakesterz 4y ago
Holy crap. Sometimes I see headlines like this and then the details aren't all that bad. This one is all that bad.
They gave it all away. They do call it "inadvertent" though.
"The information disclosed may have included name, phone number, email address, date of birth, IP address, Cerebral client ID number, and other demographic or information. The information disclosed may also have included the service the individual selected, assessment responses, and certain associated health information, subscription plan type, appointment dates and other booking information, treatment, and other clinical information, health insurance/pharmacy benefit information (for example, plan name and group/member numbers), and insurance co-pay amount."
Because Cerebral is a telehealth startup and handles confidential patient data, it’s considered a company covered under the U.S. health privacy law known as HIPAA. According to a list of health-related security lapses under investigation by the U.S. Department of Health and Human Services, which oversees and enforces HIPAA, Cerebral’s data lapse is the second-largest breach of health data in 2023.
- danielvaughn 4y agoThis is pretty wild. HIPAA does not fuck around, even a minor infringement is taken very seriously. The lawsuits are gonna be something else.
- coldcode 4y agoMaybe that's new, when I was a HIPAA architect for a health related company, I rarely saw anyone being sued or even investigated (mid 2000s). Given how many violations I saw there (and complained about) nothing ever changed because they felt no one would do anything to them.
- claytongulick 4y agoIt has changed a lot since then. 2015 was a huge overhaul of HIPAA and its enforcement. Prior to that, it was just a polite suggestion.
- Optimal_Persona 4y ago+1 I work in publicly funded mental health and our responses to possible/actual HIPAA breaches are monitored very closely by our funders. So even if an event occurs that is not deemed to be an actual breach, if our response/investigation/corrective action is found to be unsatisfactory, our county/state/fed contracts, foundation grants, and Joint Commission Accreditation could be altered/canceled.
- danielvaughn 4y agoReally? That's surprising to me. I worked a hospital job for several years, and had heard of employees making minor infractions who were fired and sued by both the hospital as well as the patient(s). Though those were individuals, things could be different if you're a corporation [rolls eyes pessimistically].
- hn_throwaway_99 4y ago9 times out of 10 those types of infractions are intentional, stuff like this: https://www.reliasmedia.com/articles/11576-13-hospital-workers-fired-for-snooping-in-britney-spears-medical-records https://www.reliasmedia.com/articles/11576-13-hospital-worke...
- TuringNYC 4y ago>> even a minor infringement is taken very seriously. The lawsuits are gonna be something else. Would be great to have a retrospective on this a year from now. I realize it isnt HIPPA, but from what I see from Credit Agency breaches, regulations are often just suggestions and there are no real consequences. Would be happy to see otherwise.
- SkyPuncher 4y agoIf this is anything like GoodRx, they're not viewed as a covered entity.
- hn_throwaway_99 4y agoThat's actually a common misconception, that HIPAA infringements mean people are going to jail for a long time or something. While infringements are taken seriously, and intentional infringement (e.g. looking up the records of a famous celebrity being treated in your hospital without reason to) results in hefty penalities, 99% sure this was a case of them using Google Analytics/Tag Manager and accidentally tagging stuff with protected PII fields. Yes, definitely a serious issue, but on my scale of "breaches I would be concerned about", this one would actually be relatively low.
- falcolas 4y ago> Cerebral’s data lapse is the second-largest breach of health data in 2023. We're not even three full months into 2023, and this is the second biggest? I can't even comprehend how anybody thought this was a good idea. Really thinking that basing our economy's primary motivator on human greed isn't doing us many favors right now, not when it's so easy for bad actors to out-earn any and all penalties.
- mistrial9 4y agothis is not new -- in the 1980s I recall the story of a sales agent who figured out that radio station license renewal or sale was subject to strict conditions as part of protecting market areas. So when a radio station was approaching FCC license deadline, this sales agent discovered that pre-bidding on the license before the legal renewal started, and then pre-selling that license to interested parties as if they had control of it, was very profitable; rinse, repeat. A sales-boiler room was setup in Florida and stations across the USA got the treatment. Everyone gets paid. When sleepy enforcement caught up, the guy terminated all his willing sales guys with some cash to be quiet, and literally hid in his sister-in-law's basement for more than two years, with lots of money to pay bills.
- falcolas 4y agoIMO, the problem is that they no longer have to hide. They pay a pittance of a fine (usually a pittance because the fine amount is static and set a decade+ ago) and keep right on doing it.
- p1esk 4y agobasing our economy's primary motivator on human greed isn't doing us many favors right now How would you fix it?
- moomoo3000 4y agoHeavy fines
- 4y ago
- techwizrd 4y agoHandling confidential patient data does not necessarily mean the organization is a covered entity under HIPAA. One of the organizations I work with receives, stores, and uses significant amounts of confidential patient data, but they are not a covered entity under HIPAA (although they are covered separately under the Privacy Act).
- lmkg 4y agoYou are correct, but despite the article's misunderstanding of HIPAA they are covered by it. The incident is being investigated by HHS, as opposed to the FTC who dealt with the (non-HIPAA-covered) GoodRx incident from like yesterday. According to HHS incident listing[1], the are a Business Associate. This means they handle patient data because they are contracted to do so by a HIPAA-covered entity. I've never heard of Cerebral before (and hopefully I won't again), but that likely means that their customers are the hospitals. [1] https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- jonathankoren 4y ago> I've never heard of Cerebral before (and hopefully I won't again), but that likely means that their customers are the hospitals. Cerebral is a mental health therapy app, but unlike most apps, they also prescribed medicine until very recently. They stopped after the FDA started investigating them for being a pill mill for schedule II controlled substances like adderall (ie amphetamine salts) https://www.theverge.com/2022/5/9/23063356/cerebral-telehealth-prescriptions-investigation-adhd-adderall-doj-dea https://www.theverge.com/2022/5/9/23063356/cerebral-teleheal...
- matheusmoreira 4y agoA corporation prescribing amphetamines? No doctors involved at all? How is that possible?
- prepend 4y ago
- wins32767 4y agoThat's going to be tens of millions of dollars of fines. HIPAA is not anything to mess around with. Data breaches like that are an existential threat to a medtech.
- junon 4y agoIf memory serves the fines stop after 1.5 million. Please someone correct me if I'm misremembering.
- deleted 4y ago[deleted]
- warent 4y agoIt looks like the maximum penalty (if corrected within 30 days) is about $450,000 as of 2022. However, there is apparently an addendum to the law that the State Attorney General is authorized to impose civil penalties in addition to this. As we see, Anthem settled for $115,000,000 for a similar breach. So, yeah, unless Cerebral gets a very lenient AG, they're done. https://www.hipaajournal.com/court-approves-anthem-115-million-data-breach-settlement/ https://www.hipaajournal.com/court-approves-anthem-115-milli... https://www.hipaajournal.com/what-is-the-maximum-penalty-for-violating-hipaa/ https://www.hipaajournal.com/what-is-the-maximum-penalty-for...
- time0ut 4y agoThey bumped it to 1.9 for inflation. There are also criminal jail time penalties though. It depends on intent. Unlikely it would happen though even if it is deserved.
- hef19898 4y agoWell, and than people ridicule Germany because patient files are still handled decentralized, on paper and shared between doctors by fax...
- luckylion 4y agoThey are? All doctors I've been to in the past 10 years have them digitally and will transfer files digitally to your new doctor -- they won't even ask you if you've asked for them to be transferred. It's enough to tell my new doctor where I've previously been and they'll contact them and handle everything else.
- freetinker 4y agoThat’s probably because that’s security by accident, and it’s only in comparison to the shit show we have today. It isn’t security by thoughtful, deliberate design.
- siva7 4y agoNot anymore, the digital patient file is finally ready.
- hef19898 4y agoWith a usage of, what did they say in the news today, 13% ?
- sizzle 4y agoI hope people go to prison over this injustice. Insurance companies probably added this mental health data to our shadow profiles.
- atkailash 4y ago[dead]