3 ms·

This is pretty wild. HIPAA does not fuck around, even a minor infringement is taken very seriously. The lawsuits are gonna be something else.

coldcode 4y ago
Maybe that's new, when I was a HIPAA architect for a health related company, I rarely saw anyone being sued or even investigated (mid 2000s). Given how many violations I saw there (and complained about) nothing ever changed because they felt no one would do anything to them.
- claytongulick 4y ago
  It has changed a lot since then. 2015 was a huge overhaul of HIPAA and its enforcement. Prior to that, it was just a polite suggestion.
  - Optimal_Persona 4y ago
    +1 I work in publicly funded mental health and our responses to possible/actual HIPAA breaches are monitored very closely by our funders. So even if an event occurs that is not deemed to be an actual breach, if our response/investigation/corrective action is found to be unsatisfactory, our county/state/fed contracts, foundation grants, and Joint Commission Accreditation could be altered/canceled.
- danielvaughn 4y ago
  Really? That's surprising to me. I worked a hospital job for several years, and had heard of employees making minor infractions who were fired and sued by both the hospital as well as the patient(s). Though those were individuals, things could be different if you're a corporation [rolls eyes pessimistically].
  - hn_throwaway_99 4y ago
    9 times out of 10 those types of infractions are intentional, stuff like this: https://www.reliasmedia.com/articles/11576-13-hospital-workers-fired-for-snooping-in-britney-spears-medical-records https://www.reliasmedia.com/articles/11576-13-hospital-worke...
TuringNYC 4y ago
>> even a minor infringement is taken very seriously. The lawsuits are gonna be something else. Would be great to have a retrospective on this a year from now. I realize it isnt HIPPA, but from what I see from Credit Agency breaches, regulations are often just suggestions and there are no real consequences. Would be happy to see otherwise.
SkyPuncher 4y ago
If this is anything like GoodRx, they're not viewed as a covered entity.
hn_throwaway_99 4y ago
That's actually a common misconception, that HIPAA infringements mean people are going to jail for a long time or something. While infringements are taken seriously, and intentional infringement (e.g. looking up the records of a famous celebrity being treated in your hospital without reason to) results in hefty penalities, 99% sure this was a case of them using Google Analytics/Tag Manager and accidentally tagging stuff with protected PII fields. Yes, definitely a serious issue, but on my scale of "breaches I would be concerned about", this one would actually be relatively low.

coldcode 4y ago

Maybe that's new, when I was a HIPAA architect for a health related company, I rarely saw anyone being sued or even investigated (mid 2000s). Given how many violations I saw there (and complained about) nothing ever changed because they felt no one would do anything to them.

claytongulick 4y ago
It has changed a lot since then. 2015 was a huge overhaul of HIPAA and its enforcement. Prior to that, it was just a polite suggestion.
- Optimal_Persona 4y ago
  +1 I work in publicly funded mental health and our responses to possible/actual HIPAA breaches are monitored very closely by our funders. So even if an event occurs that is not deemed to be an actual breach, if our response/investigation/corrective action is found to be unsatisfactory, our county/state/fed contracts, foundation grants, and Joint Commission Accreditation could be altered/canceled.
danielvaughn 4y ago
Really? That's surprising to me. I worked a hospital job for several years, and had heard of employees making minor infractions who were fired and sued by both the hospital as well as the patient(s). Though those were individuals, things could be different if you're a corporation [rolls eyes pessimistically].
- hn_throwaway_99 4y ago
  9 times out of 10 those types of infractions are intentional, stuff like this: https://www.reliasmedia.com/articles/11576-13-hospital-workers-fired-for-snooping-in-britney-spears-medical-records https://www.reliasmedia.com/articles/11576-13-hospital-worke...

TuringNYC 4y ago

>> even a minor infringement is taken very seriously. The lawsuits are gonna be something else. Would be great to have a retrospective on this a year from now. I realize it isnt HIPPA, but from what I see from Credit Agency breaches, regulations are often just suggestions and there are no real consequences. Would be happy to see otherwise.

SkyPuncher 4y ago

If this is anything like GoodRx, they're not viewed as a covered entity.

hn_throwaway_99 4y ago

That's actually a common misconception, that HIPAA infringements mean people are going to jail for a long time or something. While infringements are taken seriously, and intentional infringement (e.g. looking up the records of a famous celebrity being treated in your hospital without reason to) results in hefty penalities, 99% sure this was a case of them using Google Analytics/Tag Manager and accidentally tagging stuff with protected PII fields. Yes, definitely a serious issue, but on my scale of "breaches I would be concerned about", this one would actually be relatively low.