3 ms·

Are they sharing health data?

by lupire 3y ago

unglaublich 3y ago
Well, you generally browse the pages that are relevant to your health concerns, so it's indirect health data. It's how building a profile works. No one tells Google or Facebook "Zack likes Ferrari", but Zack's browsing of Ferrari articles tells that about him.
nemomarx 3y ago
Knowing you visited a hospital at a certain time and date would be health data, right? Are they just sharing like, email addresses in a big list, or are they giving metadata about when people show up?
- ceejayoz 3y ago
  It depends, basically. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/guidance... > Regulated entities may also have unauthenticated webpages, which are webpages that do not require users to log in before they are able to access the webpage, such as a webpage with general information about the regulated entity like their location, visiting hours, employment opportunities, or their policies and procedures. Tracking technologies on many unauthenticated webpages do not have access to individuals’ PHI; in this case, a regulated entity’s use of such tracking technologies is not regulated by the HIPAA Rules. However, in some cases, tracking technologies on unauthenticated webpages may have access to PHI, in which case the HIPAA Rules apply to the regulated entities’ use of tracking technologies and disclosures to the tracking technology vendors. Regulated entities are required to “[e]nsure the confidentiality, integrity, and availability of all electronic PHI the [regulated entity] creates, receives, maintains, or transmits.” Thus, regulated entities that are considering the use of online tracking technologies should consider whether any PHI will be transmitted to a tracking technology vendor, and take appropriate steps consistent with the HIPAA Rules.
xxs 3y ago
of course not - only visited pages, time spent on them, stuff like that.
- TheNewsIsHere 3y ago
  That greatly depends on implementation. I’ve been implementing Google Ads, Analytics, and Tag Manager for a medical practice recently. Google’s official stance is that PHI is categorically prohibited to send to Ads/Analytics services, but it’s very easy for a marketing firm to unwittingly do. Thankfully I’m working with a conscientious marketing firm and our client is diligent and well meaning, so it’s easy to avoid the pitfalls, but naively following many integration walkthroughs could have you sending entire form content to Google (or others). I’m sure that’s one of the reason Google explicitly says “don’t put us on your EMR pages” (paraphrased).
  - xxs 3y ago
    I didn't imply ads at all - google analytics has quite extensive info about the patient, the 'user', as is. The visited sites/subsections and stuff would be quite revealing. Just using the same massive aggregator as your metrics provider is where it gets wrong.
    - TheNewsIsHere 3y ago
      That’s true! Our client is a small practice in pediatrics so we don’t face the same challenges as say, the Mayo Clinic would, in trying to avoid profiling based on indirect information. Most people aren’t going to be browsing the Betty Ford clinic for fun. They’re looking for something specific. That’s juicy for analytics. I’m glad I don’t have to deal with that challenge. (Conversion matching quality isn’t a fun challenge either. We’ve landed at “the practice will have to do that themselves to avoid the privacy obstacles”.)
- ldayley 3y ago
  Like when you visit “cancer patient support resources” and read for a while…
skywhopper 3y ago
Which doctors you go to and what types of specialities you search for can tell a lot about a person. Oh, did they search for mental health clinics? Or dialysis treatment? Or abortion providers? Or gender reassignment surgery? Or vasectomy providers? Depending on where the widgets are placed, they might could tell when your appointments are or what messages you send to your doctor through their clinic's website.

Are they sharing health data?

by lupire 3y ago

Are they sharing health data?

Well, you generally browse the pages that are relevant to your health concerns, so it's indirect health data. It's how building a profile works. No one tells Google or Facebook "Zack likes Ferrari", but Zack's browsing of Ferrari articles tells that about him.

nemomarx 3y ago

Knowing you visited a hospital at a certain time and date would be health data, right? Are they just sharing like, email addresses in a big list, or are they giving metadata about when people show up?

ceejayoz 3y ago
It depends, basically. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/guidance... > Regulated entities may also have unauthenticated webpages, which are webpages that do not require users to log in before they are able to access the webpage, such as a webpage with general information about the regulated entity like their location, visiting hours, employment opportunities, or their policies and procedures. Tracking technologies on many unauthenticated webpages do not have access to individuals’ PHI; in this case, a regulated entity’s use of such tracking technologies is not regulated by the HIPAA Rules. However, in some cases, tracking technologies on unauthenticated webpages may have access to PHI, in which case the HIPAA Rules apply to the regulated entities’ use of tracking technologies and disclosures to the tracking technology vendors. Regulated entities are required to “[e]nsure the confidentiality, integrity, and availability of all electronic PHI the [regulated entity] creates, receives, maintains, or transmits.” Thus, regulated entities that are considering the use of online tracking technologies should consider whether any PHI will be transmitted to a tracking technology vendor, and take appropriate steps consistent with the HIPAA Rules.

xxs 3y ago

of course not - only visited pages, time spent on them, stuff like that.

TheNewsIsHere 3y ago
That greatly depends on implementation. I’ve been implementing Google Ads, Analytics, and Tag Manager for a medical practice recently. Google’s official stance is that PHI is categorically prohibited to send to Ads/Analytics services, but it’s very easy for a marketing firm to unwittingly do. Thankfully I’m working with a conscientious marketing firm and our client is diligent and well meaning, so it’s easy to avoid the pitfalls, but naively following many integration walkthroughs could have you sending entire form content to Google (or others). I’m sure that’s one of the reason Google explicitly says “don’t put us on your EMR pages” (paraphrased).
- xxs 3y ago
  I didn't imply ads at all - google analytics has quite extensive info about the patient, the 'user', as is. The visited sites/subsections and stuff would be quite revealing. Just using the same massive aggregator as your metrics provider is where it gets wrong.
  - TheNewsIsHere 3y ago
    That’s true! Our client is a small practice in pediatrics so we don’t face the same challenges as say, the Mayo Clinic would, in trying to avoid profiling based on indirect information. Most people aren’t going to be browsing the Betty Ford clinic for fun. They’re looking for something specific. That’s juicy for analytics. I’m glad I don’t have to deal with that challenge. (Conversion matching quality isn’t a fun challenge either. We’ve landed at “the practice will have to do that themselves to avoid the privacy obstacles”.)
ldayley 3y ago
Like when you visit “cancer patient support resources” and read for a while…

skywhopper 3y ago

Which doctors you go to and what types of specialities you search for can tell a lot about a person. Oh, did they search for mental health clinics? Or dialysis treatment? Or abortion providers? Or gender reassignment surgery? Or vasectomy providers? Depending on where the widgets are placed, they might could tell when your appointments are or what messages you send to your doctor through their clinic's website.