3 ms·

This. Saying “It’s not our fault, it’s yours.” isn’t going to fly when the government comes looking. I remind everyone that there’s a new law about data breache

This. Saying “It’s not our fault, it’s yours.” isn’t going to fly when the government comes looking. I remind everyone that there’s a new law about data breaches in effect. [1] The FTC will want to know what their security posture is and whether that meets HIPAA compliance rules or not. If not, they may lose their HIPAA compliance and be barred from applying, rendering their whole operation illegal under the FTC (s/you can only collect health information under HIPAA/you can but you still need to notify the FTC when you’re breached/). This is a serious HIPAA violation not just a security breach. This defense of theirs isn’t a smart strategy if they want to stay in business not to mention the impending lawsuits. *edit* forgot the link [1] https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0 https://www.ftc.gov/business-guidance/resources/complying-ft... [2] https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule https://www.ftc.gov/legal-library/browse/rules/health-breach...

gosub100 3y ago
In the unlikely event hackers were prosecuted for actually breaking into them, I wonder if there is any material in this release the defendants could use to their benefit: "the purported victim here says in their own words their system was secured properly".
- reactordev 3y ago
  The sad reality is they will be audited, found lacking, slapped with a small fine, told to implement 2FA as a requirement for all accounts, and go about their business. That’s been the precedent the last decade.
dekhn 3y ago
23&Me is not subject to HIPAA, unless they are acting as a health care provider, or business associate (not sure but I don't think they are in this context). Most people misunderstand HIPAA, and think it applies in situations it doesn't. This is not a situation where HIPAA applies. HIPAA is NOT a privacy law. It's a law that mandates portability of medical data, some details of which overlap with privacy.
- reactordev 3y ago
  "Emerging technologies such as genealogical databases (i.e. 23andme and Ancestry) as well as wearable devices and mHealth apps have created a new risk for data privacy that is not covered by HIPAA. These digital health tools are not covered entities therefore they are not required to protect the data they collect under HIPAA. The Department of Health and Human Services nor the Office of Civil Rights have purview over this data or any breach of the consumer's information. Any complaint regarding a breach of consumer's health data is rejected, as there is no controlling law currently for this type of data. Complaints of this type go to the Federal Trade Commission; however, many consumers are never aware that their information is breached, shared or sold to a third party because there is no breach notification requirement in place." - https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7883355/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7883355/ So while 23&me is not under HIPAA compliance rules, they are still under the purview of the FTC according to this. Which would mean that the FTC can examine their security posture and determine if it's adequate or what have you. Odds are they will just be slapped with a fine and back to business as usual. Which kind of makes me upset because we are dealing with DNA and ePHI whether they are HIPAA or not.

gosub100 3y ago

In the unlikely event hackers were prosecuted for actually breaking into them, I wonder if there is any material in this release the defendants could use to their benefit: "the purported victim here says in their own words their system was secured properly".

reactordev 3y ago
The sad reality is they will be audited, found lacking, slapped with a small fine, told to implement 2FA as a requirement for all accounts, and go about their business. That’s been the precedent the last decade.

dekhn 3y ago

23&Me is not subject to HIPAA, unless they are acting as a health care provider, or business associate (not sure but I don't think they are in this context). Most people misunderstand HIPAA, and think it applies in situations it doesn't. This is not a situation where HIPAA applies. HIPAA is NOT a privacy law. It's a law that mandates portability of medical data, some details of which overlap with privacy.

reactordev 3y ago
"Emerging technologies such as genealogical databases (i.e. 23andme and Ancestry) as well as wearable devices and mHealth apps have created a new risk for data privacy that is not covered by HIPAA. These digital health tools are not covered entities therefore they are not required to protect the data they collect under HIPAA. The Department of Health and Human Services nor the Office of Civil Rights have purview over this data or any breach of the consumer's information. Any complaint regarding a breach of consumer's health data is rejected, as there is no controlling law currently for this type of data. Complaints of this type go to the Federal Trade Commission; however, many consumers are never aware that their information is breached, shared or sold to a third party because there is no breach notification requirement in place." - https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7883355/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7883355/ So while 23&me is not under HIPAA compliance rules, they are still under the purview of the FTC according to this. Which would mean that the FTC can examine their security posture and determine if it's adequate or what have you. Odds are they will just be slapped with a fine and back to business as usual. Which kind of makes me upset because we are dealing with DNA and ePHI whether they are HIPAA or not.