3 ms·

I worked at a “digital healthcare” startup. You’d be surprised at the abuse of confidential patient information. They sign BAAs with hospital systems promising

I worked at a “digital healthcare” startup. You’d be surprised at the abuse of confidential patient information. They sign BAAs with hospital systems promising to anonymize and provide analytic services to them. While doing so they “pocket” the raw data. Data that is pilfered to these digital healthcare startups is never coming back or erased. HIPAA is too weak to cover these scenarios. Adding insult to injury a lot of these startups have developers in other countries handling confidential patient information.

kotaKat 4y ago
> While doing so they “pocket” the raw data. Forgot to mention -- often in real time, streaming hot off the EMR over nice friendly XML or HL7! For all you know, the ADT messages already hit the company before you ever even saw a privacy disclosure to sign.
dogleash 4y ago
> I worked at a “digital healthcare” startup. You’d be surprised at the abuse of confidential patient information. Why would I be surprised? The default operating assumption should be that they're absolute scum. I don't understand this game where we all play make-believe that companies are virtuous until proven otherwise.
sterwill 4y ago
How did they decide that this data doesn't need to be protected? If it's PHI (at the covered entity) and accessed through their BAA, it's still PHI and deserves protections. Were they willfully ignoring their obligations?
- qwertyuiop_ 4y ago
  yes them and many other startups I ran into.
dragonwriter 4y ago
> While doing so they “pocket” the raw data. Data that is pilfered to these digital healthcare startups is never coming back or erased. HIPAA is too weak to cover these scenarios. Er, no, its not. HIPAA. absolutely covers this scenario—any PHI they get under a BAA from a covered entity remains PHI and they are restricted in their use just aa if they were a regular covered entity for as long as they have it, and any unauthorized use or disclosure is unlawful and, if wilfull, criminal under HIPAA.

kotaKat 4y ago

> While doing so they “pocket” the raw data. Forgot to mention -- often in real time, streaming hot off the EMR over nice friendly XML or HL7! For all you know, the ADT messages already hit the company before you ever even saw a privacy disclosure to sign.

dogleash 4y ago

> I worked at a “digital healthcare” startup. You’d be surprised at the abuse of confidential patient information. Why would I be surprised? The default operating assumption should be that they're absolute scum. I don't understand this game where we all play make-believe that companies are virtuous until proven otherwise.

sterwill 4y ago

How did they decide that this data doesn't need to be protected? If it's PHI (at the covered entity) and accessed through their BAA, it's still PHI and deserves protections. Were they willfully ignoring their obligations?

qwertyuiop_ 4y ago
yes them and many other startups I ran into.

dragonwriter 4y ago

> While doing so they “pocket” the raw data. Data that is pilfered to these digital healthcare startups is never coming back or erased. HIPAA is too weak to cover these scenarios. Er, no, its not. HIPAA. absolutely covers this scenario—any PHI they get under a BAA from a covered entity remains PHI and they are restricted in their use just aa if they were a regular covered entity for as long as they have it, and any unauthorized use or disclosure is unlawful and, if wilfull, criminal under HIPAA.