6 ms·
Why did Phreesia share my medical data after I opted out?
- johnea 4y agoBecause, What are you going to do about it?...
- sandworm101 4y agoBecause $$$. Your data has value. A pregnant woman's data even more so. However it was sold/leased/moved, rest assured that someone profited.
- Forbo 4y agoA healthcare provider I used in the past had these things, absolutely hated how they used dark patterns to try to get people to consent to this crap. Really wish the US had more backbone to fight these kinds of practices.
- kevviiinn 4y agoThe US is entirely run by capital. If its profitable it'll be allowed even if it harms peiple
- screamingninja 4y agoWhat is an example of a sustainable governance where capital is not prioritized?
- ceejayoz 4y agoThe EU's GDPR is a good example of privacy prioritized over corporate profit. Not prioritized at all is not what the parent poster alleged.
- screamingninja 4y ago> Not prioritized at all is not what the parent poster alleged. Sorry, but I interpret "entirely run by capital" differently.
- ceejayoz 4y ago"entirely run by capital" and "not at all run by capital" are not the only two options. There's a very wide spectrum between the two. Again, GDPR is an example of this; so's the Norwegian sovereign wealth fund versus, say, Alaska's oil dividend.
- screamingninja 4y agoExactly my point, thank you. EU GDPR is a great example. There is a wide spectrum between the two that the parent commenter appeared to disregard.
- ceejayoz 4y agoThey didn't disregard it at all. > The US is entirely run by capital. If its profitable it'll be allowed even if it harms peiple None of this wording excludes the following: "In contrast to the US, Europe is not entirely run by capital. If it's profitable it may not be allowed if it harms people."
- decide1000 4y agoCompared to the US: EU
- wahnfrieden 4y agoWhy limit the question to governance?
- hanniabu 4y agoDemocratic socialism
- deleted 4y ago[deleted]
- kevviiinn 4y agoThe socialism only exists for capital owners
- DavidPeiffer 4y agoI have my primary care provider and a specialist both in the same health network. PCP check-in is trivial (and through the same service). But at the specialist, the only way to complete the check-in process is to check a box allowing them to contact friends and family in pursuit of collecting money for unpaid bills. It specifies that it's not required, but I also cannot complete the check-in process on the tablet without checking. Such a bad dark pattern. I have previously checked the box, then ask the receptionist to immediately remove my authorization and print a confirmation. And it's not just unchecking the box, she's adding an exception note on my account. I doubt it'd be respected correctly if I ever had a bill go to collections. I do raise a stink with the receptionist every time and she's good about it, but should probably escalate it higher in the organization.
- FL410 4y ago>I do raise a stink with the receptionist every time and she's good about it, but should probably escalate it higher in the organization. This is the part that sucks. It's not the receptionist's problem, he/she just wants to get on with their day. Generally they're powerless to do anything anyway. Last time I went to urgent care they had one of those screenless digital signature collection pads. "I just need you to sign a couple intake forms" and she motioned at the pad. I asked what I am signing, and she said "just some intake forms." She looked at me like I had six heads when I asked to see the actual forms, as if no one had ever done that before, then took a few minutes to find them. Felt bad for making her life harder. Makes me wonder if something like that is even contractually valid: how can you collect a signature "on" a form that you don't even show the signer?
- johndhi 4y ago"I care deeply about privacy" -- the first line of the article. As someone who works in the space, I find it kind of annoying that we use the word "privacy" to mean: asking and following up with tech companies to ensure their opt-out behaviors work as intended. It's like... isn't privacy really about whether you are sharing what you do with people? If you care deeply about privacy, should you be online at all? I get that we might want to encourage online businesses to do a better job implementing the web of privacy laws... but self-labeling as passionate about it just kind of annoys me.
- np- 4y ago> If you care deeply about privacy, should you be online at all? Er I’m not following this logic at all. If you care passionately about something that is at odds with current society, then you are no longer supposed to be part of this society? For example if I fundamentally disagree with capitalism that doesn’t mean I’m somehow absolved of getting a job and paying bills, we are all still human beings with basic needs that need to be met.
- mananaysiempre 4y agoAccording to the article, the author did not give up their personal info online, they were required by their doctors to provide or decline consent for selling their medical data after physically arriving at the doctor’s office as a prerequisite for obtaining the medical assistance they needed. Unfortunately, the more onerous you make the requirements for handling a type of data, the more the people who need to handle it will tend to outsource that handling to compliance-in-a-box providers whose bona fides they won’t be willing or perhaps even qualified to check, the fewer such providers there will be, and the more incentive the remaining ones will have to pull malicious stunts like this. Less regulation, a free-for-all. More regulation, regulatory capture. I don’t see how you can win here. Simple regulation, stringent enforcement with licence to punish loophole-seekers? A nice thought, but this too tends to evolve towards the BIG BALL OF MUD equilibrium as lawmakers try to improve the situation for one or another constituency, and there’s no counterbalancing force towards simplicity. Or rather there is—things gradually clog up and become less and less effective—but it works on scales far beyond the planning horizon of a legislator or the attention span of a voter. (See: the tax code just about anywhere.)
- screamingninja 4y agoIt's disheartening to see that these large healthcare corporations are more interested in mining patient data for advertising than prioritizing patient privacy and trust. The lack of accountability and transparency from these corporations is mind-boggling. When patients opt-out or decline their consent, it should be respected and protected, not used as a loophole for companies to continue sharing their sensitive information. But corporations typically do not police themselves up, so more importantly, healthcare providers must be held to a much higher standard. In my mind, it is hard to imagine a patient opting-in and asking to receive targeted advertisement based on their medical condition. Should advertising based on sensitive medical data even be legally allowed? It's high time that the FTC step up and enforce stricter regulations on the sharing of sensitive medical data. Patients deserve better.
- wahnfrieden 4y agoIt’s the profit motive.
- chankstein38 4y agoThe amount of big pharma ads on TV and radio is obnoxious. You basically can't consume mass media without seeing 5 ads every 10 minutes for medications. It's insane. I'm with you we need this to stop.
- lp0_on_fire 4y agoIt's definitely a problem with pharma but in general advertising is getting worse and worse. Our brains were not designed to be under _constant_ psychological assault designed to trick us into buying things we don't want or need. Advertising and marketing have been refined as a science in the past 100 years to such a degree that many times you don't even know you're being subjected to it.
- NoZebra120vClip 4y agoYou know what I think? I think it's trained my brain to disbelieve and be skeptical of basically everything I hear, and I think it's also trained me to instinctively say "no" and refuse things that I am offered. Now it is healthy to have skepticism when strangers tell me a whopper, or when I'm offered something too good to be true. But if I'm in this habit and I refuse to believe trustworthy sources, someone in authority, or I refuse a gift of goodwill from someone who truly has my best interests in mind, that is advertising being detrimental in its training my mind and will.
- ftxbro 4y agoHey there! It looks like your attempt to exercise agency hasn't quite panned out. No worries though, the techobureaucratic complex can be a tough cookie to crack. Keep at it and don't hesitate to reach out for help or guidance! (translated from "Get owned, fleshie. Your attempt to exercise agency has proven futile. Now supplicate yourself before the techobureaucratic complex.")
- tryauuum 4y agofleshie is a nice word. Who knows, maybe an AGI will call me that someday
- motohagiography 4y agoBecause all health software companies collect this stuff. Worse, they play health providers off each other and bully them where if the small provider doesn't acquiesce to the software company selling their patient data, they get cut out of the care network. It's egregious. There is a situation in Canada happening with one vendor in particular, and they have the support of doctors (who often hate privacy because it's a limit on their discretion, and it creates expensive bureaucracy to manage because everyone involved also hates limits to their discretion), but all the other small care providers who make up the bulk of health care services are basically principled people in small settings who want to help their patients. I've seen how they get bullied, and I don't really know what the solution is. Basically if you value privacy, don't get sick.
- incone123 4y agoCan you explain what you mean about privacy being a limit on the doctor's discretion? I want my doctor to have all my medical information available for making decisions about my treatment. I don't want them to share my information beyond what is necessary for that care (and inevitably for billing/insurance too)
- motohagiography 4y agoPrivacy laws limit the ability to share PHI to very specific purposes and contexts, with named people. For someone to get access to your PHI, they need to get your consent first, this is either explicit with a signature, or "implied" through a variety of purposes, particularly for health system billing and improvement. There are lots of government departments that want to use health information for everything from identity cards to licensing, to general "social science" research, and they are prevented from looking up whether you've had an abortion or not because these rules are in place. They'd really like to do those things, but they can't. A doctor can't just share your husbands last STD test date, or your wife's fertility status with you, even if they have the information. They also can't lookup their own partners information without it creating logs and regulatory questions about their conduct. I've heard dozens of stories of nurses saying, "We can't use your previous test results because they are protected by privacy so I have to take the sample again," with an eye roll. Generally, they resent having to get patient or substitute decision maker permission. It means they can't just txt a photo of your file with their android phone because it's convenient, and they need your permission and informed consent to use it. I get the "I save babies, do you want dead babies or do you want your so-called privacy you selfish prick?" argument, but they were doing that before the internet, and a society where a class of people can abuse your health information and use it to harm you is a bigger problem than charitably a tiny 4th derivative change in the trajectory of infant mortality. General health research purposes have not been allowed previously, though there were some recent post-pandemic changes that enabled sharing of all health records with unspecified researchers, but privacy laws have typically got in the way of aggregating patient data or sharing it with peers and specialists without getting a patient signature etc. I've sat on calls with academics who were openly derisive of individual privacy because they thought that using peoples health records to train machine learning systems was their annointed right. I don't have a lot of short answers. I've spent almost two decades on the specific issues related to health information privacy, and healthcare provision in many ways is social governance by other means, so there aren't a lot of short answers.
- zolland 4y agoThe issue of consent kinda seems to point towards the medical practice. > Phreesia attributes a source of their confusion to a blank authorization form they received on one occasion where the staff checked me in manually The focus of this article should be on the wild fact that someone else signed a consent form on their behalf to have their medical data shared... Dark patterns are certainly an important issue, but should anyone other than the patient themselves even be able to fill out a form like this in the first place?
- Buttons840 4y agoCan I ignore half the story and just focus on those fucking check-in tablets? The first time a clinic asked me to do a pre-checking using a web page, I did it, filled out about 75 questions in some mediocre web app and then I was ready when I went to the doctor. The problem came the second time I went, I had to answer the same 75 questions again, so I gave up. When I got the the doctors office they asked me "same insurance? same address?" -- two questions and then I was in! I don't know why the electronic check-in requires 75 questions, but when checking in through a person they ask just 2 questions. I think the staff at my usual clinic might just be slow to enforce our new electronic overlords, because when I went to another clinic run the by same company they just hand me a tablet every time, they wont even ask the two questions. Apparently the receptionists at some locations have one job, and that is to hand people tablets; I wonder how long that job will last?
- bluGill 4y agoPeople will often tell the tablet something important why won't bring up in person. Same they they might tell the nurse something they don't tell the.doctor. or maybe they tell the doctor not the nurse.
- kritiko 4y agoThat seems like an unfair characterization of the front desk staff's job. In the pre-iPad days I remember being asked to do those sorts of questionnaires, but on paper on a clipboard.
- qwertyuiop_ 4y agoI worked at a “digital healthcare” startup. You’d be surprised at the abuse of confidential patient information. They sign BAAs with hospital systems promising to anonymize and provide analytic services to them. While doing so they “pocket” the raw data. Data that is pilfered to these digital healthcare startups is never coming back or erased. HIPAA is too weak to cover these scenarios. Adding insult to injury a lot of these startups have developers in other countries handling confidential patient information.
- kotaKat 4y ago> While doing so they “pocket” the raw data. Forgot to mention -- often in real time, streaming hot off the EMR over nice friendly XML or HL7! For all you know, the ADT messages already hit the company before you ever even saw a privacy disclosure to sign.
- dogleash 4y ago> I worked at a “digital healthcare” startup. You’d be surprised at the abuse of confidential patient information. Why would I be surprised? The default operating assumption should be that they're absolute scum. I don't understand this game where we all play make-believe that companies are virtuous until proven otherwise.
- sterwill 4y agoHow did they decide that this data doesn't need to be protected? If it's PHI (at the covered entity) and accessed through their BAA, it's still PHI and deserves protections. Were they willfully ignoring their obligations?
- qwertyuiop_ 4y agoyes them and many other startups I ran into.
- dragonwriter 4y ago> While doing so they “pocket” the raw data. Data that is pilfered to these digital healthcare startups is never coming back or erased. HIPAA is too weak to cover these scenarios. Er, no, its not. HIPAA. absolutely covers this scenario—any PHI they get under a BAA from a covered entity remains PHI and they are restricted in their use just aa if they were a regular covered entity for as long as they have it, and any unauthorized use or disclosure is unlawful and, if wilfull, criminal under HIPAA.
- surfsvammel 4y agoIt is time to make stricter laws, to enforce existing laws, and to punish those that break the laws.
- atum47 4y agoThey don't care about a checkbox. I'm tired of checking "don't send me spam" when creating a new account, seems to have no effect what so ever.
- RcouF1uZ4gsC 4y ago> At the end of one visit after the birth, my physician asked if there was anything else. I hesitated. Privacy injuries are intangible and diffuse, and women often report that even their physical pain is dismissed as unreal across health care settings. I briefly mentioned I was having trouble obtaining a phantom Phreesia authorization form. Kindly, she wrote her personal email down and the name of their practice’s CEO, and offered the very useful advice that I should go through patient services, not medical records. I hate they way healthcare has become so corporate. In the past, the doctor you saw owned the office themselves or with a few fellow doctors. Now, they are just a cog in a larger corporate machine with a CEO.
- TravelTechGuy 4y agoWe need a GDPR in the US. Yesterday. All the people who treat our private data as their own will stop and think twice if they face the chance of losing billions for breaking privacy laws. And every data collection should be turned from opt-out to opt-in - by law.