3 ms·

They sell the data to nobody. It's considered PHI so covered by HIPAA. Dexcom has to trace custody of the data from the sensor to app to wherever it goes, so it

by mlsu 3y ago

They sell the data to nobody. It's considered PHI so covered by HIPAA. Dexcom has to trace custody of the data from the sensor to app to wherever it goes, so it is encrypted the whole way. Nobody has access unless the patient wants them to.

autoexec 3y ago
Their own privacy policy says they share data for marketing purposes. I don't think they'd do that without any compensation and their app includes personalized ads. HIPAA only covers "protected health information" and not all of the data collected by their products. They also state: "You can ask us not to use or share certain protected health information for treatment, payment, or our operations. We are not required to agree to your request" Once a year you can also request that they send you a report on who they shared your data with and why without paying them for it, but it will not include anything involving "treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make)." see https://www.dexcom.com/notice-of-privacy-practices https://www.dexcom.com/notice-of-privacy-practices
- mlsu 3y ago
  I'm bet they probably do collect e.g. your phone's operating system and use that to figure out which market segment you belong to. But as far as I know Dexcom doesn't have any agreements with anyone to sell their user's data; If they have ads in the dex app I've never seen one. I would be extremely surprised if that were the case. >You can ask us not to use or share certain protected health information for treatment, payment, or our operations. We are not required to agree to your request What they're talking about here isn't necessarily what you expect. It's that, if you e.g. encounter a bug in the product that they need to disclose to the FDA, you cannot withhold information from them that would prevent them from doing that. Or, if they need to know what kind of diabetes you have so that they can charge your insurance for the correct prescription, you can't say "you're not allowed to share that." (doesn't really apply here, but that's kind of what's meant in that clause). You can see: treatment, payment, or operations. The scope of each of those is kept as small as possible, and they do have audits from time to time ensuring that it is. I assure you that CGM readings, trends, averages, reports, etc. ALL of that stuff is absolutely, positively considered PHI and considered extremely privileged. The only time anyone, even in the company, can see that data is if they are a customer support agent helping a specific customer, or if they are on the data science team looking at broad trends to help e.g. calibrate the product. >Once a year you can also request that they send you a report on who they shared your data with and why without paying them for it, but it will not include anything involving "treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make)." It's because they have extra requirements around storage, retention, etc of that PHI data. It's very likely that they can't send you a report because all parties have much stricter access controls on that data so it can't be aggregated and put in a report without filing a mountain of paperwork. I assure you, these companies do not fuck around with patient data. They don't even do things that give off the appearance of fucking around with patient data, because they know that if the HHS thinks that they are that's millions of dollars in audit costs.
  - chefandy 3y ago
    I'm a lot more concerned by what my insurance company can do with the data than marketing companies-- they regularly deny claims based on data collected by device vendors. In the following article, see: Sleep aid or surveillance device? https://www.npr.org/sections/health-shots/2018/11/21/669751038/you-snooze-you-lose-how-insurers-dodge-the-costs-of-popular-sleep-apnea-devices https://www.npr.org/sections/health-shots/2018/11/21/6697510... Maybe glucose monitoring data is different than sleep data, but I don't see why it would be. In that article, even random customer service representatives had access to his device data despite his asking them to stop storing it. I had a similar experience with a medical device that the person in the article had with their CPAP machine: I yanked a wireless modem out of the thing and stuck a flash card in there, because fuck those creeps. They sent me a very large bill retroactively denying coverage for the device for non-compliance, but luckily I didn't end up having to pay because they accepted the local data I provided without (much of) a fight. But what if the claim wasn't for a comparatively inexpensive machine, and it was for an inpatient medical procedure with surgery, lots of imaging, and a 10k ambulance ride? You better fucking believe I'm not going to voluntarily help them weasel out of coverage.

by mlsu 3y ago

autoexec 3y ago

Their own privacy policy says they share data for marketing purposes. I don't think they'd do that without any compensation and their app includes personalized ads. HIPAA only covers "protected health information" and not all of the data collected by their products. They also state: "You can ask us not to use or share certain protected health information for treatment, payment, or our operations. We are not required to agree to your request" Once a year you can also request that they send you a report on who they shared your data with and why without paying them for it, but it will not include anything involving "treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make)." see https://www.dexcom.com/notice-of-privacy-practices https://www.dexcom.com/notice-of-privacy-practices

mlsu 3y ago
I'm bet they probably do collect e.g. your phone's operating system and use that to figure out which market segment you belong to. But as far as I know Dexcom doesn't have any agreements with anyone to sell their user's data; If they have ads in the dex app I've never seen one. I would be extremely surprised if that were the case. >You can ask us not to use or share certain protected health information for treatment, payment, or our operations. We are not required to agree to your request What they're talking about here isn't necessarily what you expect. It's that, if you e.g. encounter a bug in the product that they need to disclose to the FDA, you cannot withhold information from them that would prevent them from doing that. Or, if they need to know what kind of diabetes you have so that they can charge your insurance for the correct prescription, you can't say "you're not allowed to share that." (doesn't really apply here, but that's kind of what's meant in that clause). You can see: treatment, payment, or operations. The scope of each of those is kept as small as possible, and they do have audits from time to time ensuring that it is. I assure you that CGM readings, trends, averages, reports, etc. ALL of that stuff is absolutely, positively considered PHI and considered extremely privileged. The only time anyone, even in the company, can see that data is if they are a customer support agent helping a specific customer, or if they are on the data science team looking at broad trends to help e.g. calibrate the product. >Once a year you can also request that they send you a report on who they shared your data with and why without paying them for it, but it will not include anything involving "treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make)." It's because they have extra requirements around storage, retention, etc of that PHI data. It's very likely that they can't send you a report because all parties have much stricter access controls on that data so it can't be aggregated and put in a report without filing a mountain of paperwork. I assure you, these companies do not fuck around with patient data. They don't even do things that give off the appearance of fucking around with patient data, because they know that if the HHS thinks that they are that's millions of dollars in audit costs.
- chefandy 3y ago
  I'm a lot more concerned by what my insurance company can do with the data than marketing companies-- they regularly deny claims based on data collected by device vendors. In the following article, see: Sleep aid or surveillance device? https://www.npr.org/sections/health-shots/2018/11/21/669751038/you-snooze-you-lose-how-insurers-dodge-the-costs-of-popular-sleep-apnea-devices https://www.npr.org/sections/health-shots/2018/11/21/6697510... Maybe glucose monitoring data is different than sleep data, but I don't see why it would be. In that article, even random customer service representatives had access to his device data despite his asking them to stop storing it. I had a similar experience with a medical device that the person in the article had with their CPAP machine: I yanked a wireless modem out of the thing and stuck a flash card in there, because fuck those creeps. They sent me a very large bill retroactively denying coverage for the device for non-compliance, but luckily I didn't end up having to pay because they accepted the local data I provided without (much of) a fight. But what if the claim wasn't for a comparatively inexpensive machine, and it was for an inpatient medical procedure with surgery, lots of imaging, and a 10k ambulance ride? You better fucking believe I'm not going to voluntarily help them weasel out of coverage.