5 ms·

Health industry responds to data privacy crackdown

74 points by luu 3y ago

robwwilliams 3y ago
Interesting grey zone and I am glad to see this tightening of US regulations on identifiable health related data. Could imagine doing this though just from a good set of labeled photos.
mjevans 3y ago
It would be easiest to just ban ads targeted by anything OTHER than the non-customized on page content. It's fine for ads to be targeted based on what's seen. It's _possibly_ OK to target ads by __large__ regional geographic area. (E.G. traceroute seems to say your IP is near Major Big City, so that huge region or a TTL circle around it is an OK ad pool.) Anything more specific is ripe for abuse and should just not be allowed. Comparatively that specificity would be roughly equivalent to traditional TV, Cable and 'Print' media. This is specificity as consumer privacy protection. I'm against most types of ads generally from a mental health stance.
- Nextgrid 3y ago
  Indeed, the main problem is that we've decided to legalize spyware and are now trying to contain the damage of that decision by playing whack-a-mole and trying to plug all the holes downstream. Making spyware illegal (whether it's for ad targeting, or analytics, or "improving your experience") and enforcing CFAA-like penalties on company executives that knowingly violate the law would fix this problem overnight and for good.
  - BSEdlMMldESB 3y ago
    since when has turning something illegal for which there already exists demand has ever solved a problem of this sort? just one examples that I can't take out of my mind as the consequences are everywhere around me: war on drugs (and the original alcohol prohibition)
    - idle_zealot 3y ago
      We're not talking banning something with demand from consumers like alcohol or other recreational drugs, we're talking about banning a harmful practice that companies engage in. Banning spyware is more akin to labor laws or environmental protections. Specifically it'd be a form of consumer protection.
      - eastbound 3y ago
        It’s impossible to run marketing operations without GA and even session recording. I entered a business where I pushed back for years, but at one point, you need to do it.
        TeMPOraL 3y ago
        That's only because everyone else is using it. Banning it outright levels the playing field, and nobody needs it anymore. Marketing, in the limit, is a zero-sum game (negative-sum, if you put a non-zero price on all the resources and labor wasted).
    - rypskar 3y ago
      CFC-gasses, leaded gasoline, and DDT are the first I can think of. There are lots of cases where a ban of something harmful done by companies have successfully been banned
- s1artibartfast 3y ago
  I don't disagree with personalized advertising, but this would be the way to do it. You have to attack the incentive, otherwise people will just come up with more nuanced and complicated ways to collect profitable data. Chipping away at collection routes for a trillion dollar industry simply won't work
nielsbot 3y ago
"A series of federal data privacy crackdowns is complicating how health care companies market their services online." Surprised this is the lede. Seems the biggest news is "problematic and widespread" "telehealth companies...violating their customers’ privacy"
- zdragnar 3y ago
  Anyone who isn't in health doesn't need to be HIPAA compliant, and thus isn't likely to do so. That means that pretty much every possible service that is commonly used is off-limits. JIRA is an especially frustrating, but not entirely uncommon, example: to get them to sign a BAA, you need a massive contact. That means no bug reports can go into JIRA with anything resembling the actual bug other than very vague info, so your internal customers (i.e. clinicians and customer service) have to jump through extra hoops just to file an issue. I would love a world where HIPAA level compliance was standard for all PII across all industries. Until then, people will keep making mistakes. Imagine this: you have two websites, a marketing site and a separate subdomain for your actual "app". There's a login button on the marketing site that redirects the user to the subdomain login page. Marketing adds GA to the marketing site to track conversations. Congratulations! You've just violated HIPAA, because the rules apply to "past, current and future users" meaning that Google could theoretically identify people who were interested in either creating an account or wanted to log into your website. "But our company has a BAA with Google! We use all sorts of their products, right?" Wrong! Analytics is the one essential business software that Google refuses to cover with a BAA, which alone should tell you why you ought never browse the internet without uorigin and co. I'm not making excuses for anyone. This is really important stuff to understand. It's also not always entirely obvious just exactly how leaky the entire SAAS world is to business people making what, in any other job, are obvious decisions.
  - nradov 3y ago
    In my experience working on healthcare products, tools like Jira where you can't store PHI don't present serious obstacles. Usually you can document the steps to reproduce a defect using fake data. You're going to need it anyway for the automated test script to close the defect. And if you do need PHI at some stage of the process you can link to it from the Jira issue instead of storing it in Jira directly.
whimsicalism 3y ago
I think the reality is that the public & media have decided they hate 'tech' and every industry is trying to distance themselves from the label to avoid regulatory scrutiny.
EdwardDiego 3y ago
I'm waiting for the first HIPAA violations due to ChatGPT etc. to be punished. The amount of FOMO coming out of C-suites around "AI" is sadly predictable.

74 points by luu 3y ago

Interesting grey zone and I am glad to see this tightening of US regulations on identifiable health related data. Could imagine doing this though just from a good set of labeled photos.

mjevans 3y ago

It would be easiest to just ban ads targeted by anything OTHER than the non-customized on page content. It's fine for ads to be targeted based on what's seen. It's _possibly_ OK to target ads by __large__ regional geographic area. (E.G. traceroute seems to say your IP is near Major Big City, so that huge region or a TTL circle around it is an OK ad pool.) Anything more specific is ripe for abuse and should just not be allowed. Comparatively that specificity would be roughly equivalent to traditional TV, Cable and 'Print' media. This is specificity as consumer privacy protection. I'm against most types of ads generally from a mental health stance.

Nextgrid 3y ago
Indeed, the main problem is that we've decided to legalize spyware and are now trying to contain the damage of that decision by playing whack-a-mole and trying to plug all the holes downstream. Making spyware illegal (whether it's for ad targeting, or analytics, or "improving your experience") and enforcing CFAA-like penalties on company executives that knowingly violate the law would fix this problem overnight and for good.
- BSEdlMMldESB 3y ago
  since when has turning something illegal for which there already exists demand has ever solved a problem of this sort? just one examples that I can't take out of my mind as the consequences are everywhere around me: war on drugs (and the original alcohol prohibition)
  - idle_zealot 3y ago
    We're not talking banning something with demand from consumers like alcohol or other recreational drugs, we're talking about banning a harmful practice that companies engage in. Banning spyware is more akin to labor laws or environmental protections. Specifically it'd be a form of consumer protection.
    - eastbound 3y ago
      It’s impossible to run marketing operations without GA and even session recording. I entered a business where I pushed back for years, but at one point, you need to do it.
      - TeMPOraL 3y ago
        That's only because everyone else is using it. Banning it outright levels the playing field, and nobody needs it anymore. Marketing, in the limit, is a zero-sum game (negative-sum, if you put a non-zero price on all the resources and labor wasted).
  - rypskar 3y ago
    CFC-gasses, leaded gasoline, and DDT are the first I can think of. There are lots of cases where a ban of something harmful done by companies have successfully been banned
s1artibartfast 3y ago
I don't disagree with personalized advertising, but this would be the way to do it. You have to attack the incentive, otherwise people will just come up with more nuanced and complicated ways to collect profitable data. Chipping away at collection routes for a trillion dollar industry simply won't work

nielsbot 3y ago

"A series of federal data privacy crackdowns is complicating how health care companies market their services online." Surprised this is the lede. Seems the biggest news is "problematic and widespread" "telehealth companies...violating their customers’ privacy"

zdragnar 3y ago
Anyone who isn't in health doesn't need to be HIPAA compliant, and thus isn't likely to do so. That means that pretty much every possible service that is commonly used is off-limits. JIRA is an especially frustrating, but not entirely uncommon, example: to get them to sign a BAA, you need a massive contact. That means no bug reports can go into JIRA with anything resembling the actual bug other than very vague info, so your internal customers (i.e. clinicians and customer service) have to jump through extra hoops just to file an issue. I would love a world where HIPAA level compliance was standard for all PII across all industries. Until then, people will keep making mistakes. Imagine this: you have two websites, a marketing site and a separate subdomain for your actual "app". There's a login button on the marketing site that redirects the user to the subdomain login page. Marketing adds GA to the marketing site to track conversations. Congratulations! You've just violated HIPAA, because the rules apply to "past, current and future users" meaning that Google could theoretically identify people who were interested in either creating an account or wanted to log into your website. "But our company has a BAA with Google! We use all sorts of their products, right?" Wrong! Analytics is the one essential business software that Google refuses to cover with a BAA, which alone should tell you why you ought never browse the internet without uorigin and co. I'm not making excuses for anyone. This is really important stuff to understand. It's also not always entirely obvious just exactly how leaky the entire SAAS world is to business people making what, in any other job, are obvious decisions.
- nradov 3y ago
  In my experience working on healthcare products, tools like Jira where you can't store PHI don't present serious obstacles. Usually you can document the steps to reproduce a defect using fake data. You're going to need it anyway for the automated test script to close the defect. And if you do need PHI at some stage of the process you can link to it from the Jira issue instead of storing it in Jira directly.

whimsicalism 3y ago

I think the reality is that the public & media have decided they hate 'tech' and every industry is trying to distance themselves from the label to avoid regulatory scrutiny.

EdwardDiego 3y ago

I'm waiting for the first HIPAA violations due to ChatGPT etc. to be punished. The amount of FOMO coming out of C-suites around "AI" is sadly predictable.