7 ms·

Yeah but you can't get that genie back in the bottle. Once these data are made available to private industry it's only a matter of lobbyists chipping away at wh

Yeah but you can't get that genie back in the bottle. Once these data are made available to private industry it's only a matter of lobbyists chipping away at whatever protections were initially legislated. See Also: your TV, phone, car, fucking doorbell, and fridge are all spying on you.

tim333 2y ago
The HIPPA rules on health data are fairly strict, otherwise your doctor, hospital and so on could already be doing wrong. Personally I have a dumb TV, car, doorbell and fridge so not much spying there. The phone I'm less sure of.
- chimeracoder 2y ago
  > The HIPPA rules on health data are fairly strict Depends on how you define "strict". They're pretty onerous to comply with, but they don't really provide patients with anywhere near the level of protection that most people think. It's better than nothing, but in reality, your data is being legally shared with an arbitrary number of entities, without your consent, and without any way for you to even know who has access to that data. If that data is breached in any way, in theory the reports are supposed to trickle up the chain eventually. In practice? If it's more than one or two subcontractors deep, you'll probably never find out (unless the breached data is posted publicly and you stumble upon it that way). Also, the cap on penalties is shockingly low: $2 million for all violations of a given provision per calendar year. And that's for willful neglect. If the cause of the violation is determined to be lower than willful neglect, the maximum violation is even lower. For a very large and well-capitalized company, that might as well be a cost of business.
  - peteradio 2y ago
    > your data is being legally shared with an arbitrary number of entities And ILLEGALLY shared via non-conformance with federal laws and data breaches. Just look at the Boeing fiasco and the serious normalization of deviance. You think that doesn't happen when you outsource your entire IT operations offshore to a populace that literally has zero skin in the game.
  - benmanns 2y ago
    And what is your recourse? There's no private cause of action for HIPAA violations.
    - adzm 2y ago
      Finally someone uses the correct acronym
    - tiahura 2y ago
      Bingo. As a new ambulance chaser, I was having some real difficulty getting the medical records for a client - no response for weeks and weeks and weeks. Aha! I thought. HIPAA gives them 30 days(sortof). We'll sue, and surely there's an attorney fee provision in there. Easy money. GOOGLE Wait what? No private cause of action! All I can do is file a complaint with HHS! That said, depending on your state, you may be able to make some sort of colorable common-law claim.
      - randomdata 2y ago
        > GOOGLE Maybe ChatGPT would have given you a more favourable answer?
        forgetfreeman 2y ago
        Seems unlikely since at it's absolute best it's merely synthesizing a mashup of the same information that feeds Google search, and that's assuming it doesn't start seeing shit. Better to go directly to the source so you can at least make an attempt at vetting the credentials/expertise level that went into the information you're viewing instead of guessing how many mommy blogs, spam mills, and reddit comments got sucked into the intake in the process of producing whatever ChatGPT just coughed up.
        randomdata 2y ago
        Going directly to the source did not provide a favourable answer. Did you somehow miss reading the thread before you replied?
- dv_dt 2y ago
  The HIPPA rules may be strict, but my most frequent breach notification for loss of personal info (averaging once every 2-3 years) is from health insurers and practice companies losing my information.
- technofiend 2y ago
  HIPPA rules are easily circumvented unless you as a patient are paying attention: I can't tell you how many forms I've opted out of that wanted to explicitly export my data to third parties and partners that are not HIPPA compliant. And at least for my healthcare providers that use MyCharts, they like to make it part of the echeckin workflow, with no option to refuse. So you're forced to go up to the desk to check in and explicitly reject it each and every time. It's a healthcare dark pattern. And then there are online providers like better health that don't have the option to opt out at all. So you just have to avoid them entirely.
  - ipython 2y ago
    100% this. I just visited an urgent care center yesterday for some strep tests. I was given an electronic signature pad and told to sign for "consent to care". No documentation was given to me on what I was signing - just that I needed to sign. I had to ask for a paper copy of the form I was signing, which was handed to me. That document said that "I acknowledge receiving the privacy notice ..." Was that given to me? Of course not. Asking for that - well let's just say I think I was the first person to ever ask for any of this documentation. I'm sure my information has been shared with 30 other entities - for a strep test. It's insane and unenforceable as a patient who just wants to get shit done.
  - andsens 2y ago
    The fact that it is even legal to ask patients to sign away their right to privacy boggles the mind.
    - hollerith 2y ago
      There are already too many restrictive law and rules in the US around healthcare, and here you want to add another restriction.
      - alsetmusic 2y ago
        Ok, I’ll bite. List some concrete examples. Otherwise, I have to land on the default that regulation is good and works better than a free-for-all.
- craigmcnamara 2y ago
  The law is called HIPAA and technology providers sign a BAA(Business Associate Agreement) that states they agree to handle and store your information in compliance with the relevant standards and laws. With tools like OpenAI Whisper and GPT the HIPAA mode means that the tools don't retain any memory of prior interactions. Health tech is built on 3rd party vendors AWS, Google, and Microsoft are huge in the space.
- m3047 2y ago
  Working at the edge of cybersecurity and privacy, you've just stepped in it: there is no "Health Insurance Portability and Privacy Act". It's the "Health Insurance Portability and Accountability Act" (HIPAA). (And I see that noone corrects you below. [edit -- actually a few people do, or the comments are continuing]) Gravity is a fairly strict law too. Maybe you should review what it covers, what it doesn't. The Act greatly expands the "sloshability" of your data, whether the sanctions are appropriate or sufficient to prevent patient harm is debatable.
  - renewiltord 2y ago
    It's a bit unfair since it's an easy mistake to make but I treat HIPPA as the equivalent of seeing a resume that says someone knows SAP, Bash, JAVA, GIT, Perl. The capitalization is kind of bozo-signaling. HIPPA is bozo-signaling. I wouldn't expect right capitalization of FedRAMP. But JAVA vs. Java and HIPPA vs HIPAA just seem like you're not truly familiar.
    - m3047 2y ago
      I'm not sure what your comment is: it's a bit unfair; it's easy to make a mistake; it's bozo-signaling; [you] wouldn't expect right [correct?] capitalization; [something other than capitalization] seem[s] like you're not truly familiar. What's unfair? Are random mistakes unfair (that's a very good philosophical question)? Are we forbidden from learning about other people from their mistakes or from mistakes generally? The parent says: > The HIPPA rules on health data are fairly strict The followons variously say: > I can't tell you how many forms I've opted out of that wanted to explicitly export my data to third parties and partners that are not HIPPA compliant. > I wasn't claiming that MyCharts isn't HIPPA compliant > The HIPPA rules may be strict I'm more convinced that these people are making claims about the heart of what they presume HIPAA to be than I am about my parent poster's intent. According to part of your comment these people are "not truly familiar", but without that surfeit of "P" all over it we wouldn't know. My comment was based on an actual conversation heard in the field while working with what is potentially HIPAA data. As for the parent post, the thought in my mind was is it a mistake? is it a troll? is it a mistake and they thought it was funny so they didn't correct it? I'm willing to give them a tip o' th' hat for the inadvertent glimpse into the bland certitude of inaccuracy.
loceng 2y ago
Well, the reality is likely once they get access to the data, are allowed to use it - they will likely be happy to be grandfathered into their accelerated position if legislation passes to create barriers of entry by preventing such mass data gather/access without express permission - to have an advantage on competition; but generally this won't be a winning tactic in the end because trust is the most important factor, even if consumers aren't driven by that yet as their primary driver.
- forgetfreeman 2y ago
  The mere implication that consumers can be driven by privacy concerns flies in the face of 20 years of observed reality so I'm not sure where you're getting the idea that that is credibly possible. Objectively consumers are driven primarily by convenience, with cost coming in a close second.
  - loceng 2y ago
    Have consumers had any really good or inspiring options yet that put privacy first? Most of the pundits of Bitcoin and similar - an evolution of the finance industrial complex - seem to claim that the reason there isn't wider adoption is that the "first killer app" hasn't been developed yet. I'd argue it's because its adoption is motivated by profit-greed, which requires a wealth transfer from new adopters to the ones passing off hodling the bag. Many of the core-fundamental values put forward, what many hope Bitcoin et al would solve, are virtuous and attempting-hoping to solve complex problems - but Bitcoin from a holistic systems perspective, where all consequences are integrated, doesn't fit the bill for what will become the next stable evolution of how society functions with technology. I'd argue similarly to privacy concerns, the solutions that Bitcoin hodlers are aiming for - if they care about such things other than profit from buying low-selling high during pumps and dumps - simply haven't had a viable non-hype and non-greed-driven solution made available yet. This current wave as a result of industrial complexes forming to maximize their ROI at all costs, first-to-market and maximizing profits allows them to dominate - but for how long? Maybe a decade ago now I wrote a blog post on Facebook's governance, pointing out FB's attempt to maximize profit now will certainly increase annual revenues/profits in the short-term - but would you rather have lower profits for 20+ years or higher profits for 5+ years? Mark not being an idea person, not a creative - where everyone in tech should know his story involving the ConnectU twins who had hired him - and so he wasn't able to navigate to design and evolve a system to fully harness the potential of having what's essentially a free marketing platform for him as the controller - instead mostly depending on network effect defense strategies including buying up feature sets like WhatsApp, Instagram, etc - who gained a critical mass that could begin to become a competitor with FB, so no real innovation. The VC industrial complex has been a driver in selecting for all of this, and where acquisitions also suck up and eliminate any up and coming competition that gained enough market share and momentum to be a threat; the incumbent dating and food-delivery platforms-apps are the most obvious for this; the captured MSM is another less obvious version of this, where conglomeration from consolidation has put the power of information control in the hands of fewer and fewer people - why big pharma has been so successful suppressing the majority of negative sentiment about them, as one of multiple parties who are toeing the line and attempting to maintain control with what I call the censorship-suppression-narrative control apparatus; Elon buying Twitter-X created a #ZeroIsASpecialNumber problem in terms of no longer being able to as easily put their hand on the scale of free speech - a blow to their authoritarian-totalitarian and industrial complex dreams, that combination forming fascism. Another example, I think the advertising industrial complex will collapse within the next decade. Ads are probably tied at first with downvoting mechanisms for how detrimental of an effect they have on society - where I don't have time to dive into detailing reasons for either right now; they are not mimicking natural patterns for how information-attention was distributed prior to digital. Business is war, and there are $ trillions at stake - and so who knows what all the various parties, millions to billions of people who most likely mostly blindly follow the status quo system because they believe that they will do better off - those who struggled to get where they are in the manufactured rat race, and holding on for dear life due to fear, when in fact tyranny and scarcity mindset is very expensive - and where the universe provides all the abundance we need, and we can all thrive with proper organization. “Those who love peace must learn to organize as effectively as those who love war.” — Martin Luther King, Jr. Thanks for the convo! Please continue if you're motivated or inspired to! P.S. I had 2 neck surgeries last week, so my pain level is down a lot - and so words are flowing out of me a bit easier, and apparently you inspired me to say far more than I was expecting, so thank you again.
j45 2y ago
WHile US has private healthcare, Canada does not and data does not belong to the private companies.

tim333 2y ago

The HIPPA rules on health data are fairly strict, otherwise your doctor, hospital and so on could already be doing wrong. Personally I have a dumb TV, car, doorbell and fridge so not much spying there. The phone I'm less sure of.

chimeracoder 2y ago
> The HIPPA rules on health data are fairly strict Depends on how you define "strict". They're pretty onerous to comply with, but they don't really provide patients with anywhere near the level of protection that most people think. It's better than nothing, but in reality, your data is being legally shared with an arbitrary number of entities, without your consent, and without any way for you to even know who has access to that data. If that data is breached in any way, in theory the reports are supposed to trickle up the chain eventually. In practice? If it's more than one or two subcontractors deep, you'll probably never find out (unless the breached data is posted publicly and you stumble upon it that way). Also, the cap on penalties is shockingly low: $2 million for all violations of a given provision per calendar year. And that's for willful neglect. If the cause of the violation is determined to be lower than willful neglect, the maximum violation is even lower. For a very large and well-capitalized company, that might as well be a cost of business.
- peteradio 2y ago
  > your data is being legally shared with an arbitrary number of entities And ILLEGALLY shared via non-conformance with federal laws and data breaches. Just look at the Boeing fiasco and the serious normalization of deviance. You think that doesn't happen when you outsource your entire IT operations offshore to a populace that literally has zero skin in the game.
- benmanns 2y ago
  And what is your recourse? There's no private cause of action for HIPAA violations.
  - adzm 2y ago
    Finally someone uses the correct acronym
  - tiahura 2y ago
    Bingo. As a new ambulance chaser, I was having some real difficulty getting the medical records for a client - no response for weeks and weeks and weeks. Aha! I thought. HIPAA gives them 30 days(sortof). We'll sue, and surely there's an attorney fee provision in there. Easy money. GOOGLE Wait what? No private cause of action! All I can do is file a complaint with HHS! That said, depending on your state, you may be able to make some sort of colorable common-law claim.
    - randomdata 2y ago
      > GOOGLE Maybe ChatGPT would have given you a more favourable answer?
      - forgetfreeman 2y ago
        Seems unlikely since at it's absolute best it's merely synthesizing a mashup of the same information that feeds Google search, and that's assuming it doesn't start seeing shit. Better to go directly to the source so you can at least make an attempt at vetting the credentials/expertise level that went into the information you're viewing instead of guessing how many mommy blogs, spam mills, and reddit comments got sucked into the intake in the process of producing whatever ChatGPT just coughed up.
        randomdata 2y ago
        Going directly to the source did not provide a favourable answer. Did you somehow miss reading the thread before you replied?
dv_dt 2y ago
The HIPPA rules may be strict, but my most frequent breach notification for loss of personal info (averaging once every 2-3 years) is from health insurers and practice companies losing my information.
technofiend 2y ago
HIPPA rules are easily circumvented unless you as a patient are paying attention: I can't tell you how many forms I've opted out of that wanted to explicitly export my data to third parties and partners that are not HIPPA compliant. And at least for my healthcare providers that use MyCharts, they like to make it part of the echeckin workflow, with no option to refuse. So you're forced to go up to the desk to check in and explicitly reject it each and every time. It's a healthcare dark pattern. And then there are online providers like better health that don't have the option to opt out at all. So you just have to avoid them entirely.
- ipython 2y ago
  100% this. I just visited an urgent care center yesterday for some strep tests. I was given an electronic signature pad and told to sign for "consent to care". No documentation was given to me on what I was signing - just that I needed to sign. I had to ask for a paper copy of the form I was signing, which was handed to me. That document said that "I acknowledge receiving the privacy notice ..." Was that given to me? Of course not. Asking for that - well let's just say I think I was the first person to ever ask for any of this documentation. I'm sure my information has been shared with 30 other entities - for a strep test. It's insane and unenforceable as a patient who just wants to get shit done.
- andsens 2y ago
  The fact that it is even legal to ask patients to sign away their right to privacy boggles the mind.
  - hollerith 2y ago
    There are already too many restrictive law and rules in the US around healthcare, and here you want to add another restriction.
    - alsetmusic 2y ago
      Ok, I’ll bite. List some concrete examples. Otherwise, I have to land on the default that regulation is good and works better than a free-for-all.
craigmcnamara 2y ago
The law is called HIPAA and technology providers sign a BAA(Business Associate Agreement) that states they agree to handle and store your information in compliance with the relevant standards and laws. With tools like OpenAI Whisper and GPT the HIPAA mode means that the tools don't retain any memory of prior interactions. Health tech is built on 3rd party vendors AWS, Google, and Microsoft are huge in the space.
m3047 2y ago
Working at the edge of cybersecurity and privacy, you've just stepped in it: there is no "Health Insurance Portability and Privacy Act". It's the "Health Insurance Portability and Accountability Act" (HIPAA). (And I see that noone corrects you below. [edit -- actually a few people do, or the comments are continuing]) Gravity is a fairly strict law too. Maybe you should review what it covers, what it doesn't. The Act greatly expands the "sloshability" of your data, whether the sanctions are appropriate or sufficient to prevent patient harm is debatable.
- renewiltord 2y ago
  It's a bit unfair since it's an easy mistake to make but I treat HIPPA as the equivalent of seeing a resume that says someone knows SAP, Bash, JAVA, GIT, Perl. The capitalization is kind of bozo-signaling. HIPPA is bozo-signaling. I wouldn't expect right capitalization of FedRAMP. But JAVA vs. Java and HIPPA vs HIPAA just seem like you're not truly familiar.
  - m3047 2y ago
    I'm not sure what your comment is: it's a bit unfair; it's easy to make a mistake; it's bozo-signaling; [you] wouldn't expect right [correct?] capitalization; [something other than capitalization] seem[s] like you're not truly familiar. What's unfair? Are random mistakes unfair (that's a very good philosophical question)? Are we forbidden from learning about other people from their mistakes or from mistakes generally? The parent says: > The HIPPA rules on health data are fairly strict The followons variously say: > I can't tell you how many forms I've opted out of that wanted to explicitly export my data to third parties and partners that are not HIPPA compliant. > I wasn't claiming that MyCharts isn't HIPPA compliant > The HIPPA rules may be strict I'm more convinced that these people are making claims about the heart of what they presume HIPAA to be than I am about my parent poster's intent. According to part of your comment these people are "not truly familiar", but without that surfeit of "P" all over it we wouldn't know. My comment was based on an actual conversation heard in the field while working with what is potentially HIPAA data. As for the parent post, the thought in my mind was is it a mistake? is it a troll? is it a mistake and they thought it was funny so they didn't correct it? I'm willing to give them a tip o' th' hat for the inadvertent glimpse into the bland certitude of inaccuracy.

loceng 2y ago

Well, the reality is likely once they get access to the data, are allowed to use it - they will likely be happy to be grandfathered into their accelerated position if legislation passes to create barriers of entry by preventing such mass data gather/access without express permission - to have an advantage on competition; but generally this won't be a winning tactic in the end because trust is the most important factor, even if consumers aren't driven by that yet as their primary driver.

forgetfreeman 2y ago
The mere implication that consumers can be driven by privacy concerns flies in the face of 20 years of observed reality so I'm not sure where you're getting the idea that that is credibly possible. Objectively consumers are driven primarily by convenience, with cost coming in a close second.
- loceng 2y ago
  Have consumers had any really good or inspiring options yet that put privacy first? Most of the pundits of Bitcoin and similar - an evolution of the finance industrial complex - seem to claim that the reason there isn't wider adoption is that the "first killer app" hasn't been developed yet. I'd argue it's because its adoption is motivated by profit-greed, which requires a wealth transfer from new adopters to the ones passing off hodling the bag. Many of the core-fundamental values put forward, what many hope Bitcoin et al would solve, are virtuous and attempting-hoping to solve complex problems - but Bitcoin from a holistic systems perspective, where all consequences are integrated, doesn't fit the bill for what will become the next stable evolution of how society functions with technology. I'd argue similarly to privacy concerns, the solutions that Bitcoin hodlers are aiming for - if they care about such things other than profit from buying low-selling high during pumps and dumps - simply haven't had a viable non-hype and non-greed-driven solution made available yet. This current wave as a result of industrial complexes forming to maximize their ROI at all costs, first-to-market and maximizing profits allows them to dominate - but for how long? Maybe a decade ago now I wrote a blog post on Facebook's governance, pointing out FB's attempt to maximize profit now will certainly increase annual revenues/profits in the short-term - but would you rather have lower profits for 20+ years or higher profits for 5+ years? Mark not being an idea person, not a creative - where everyone in tech should know his story involving the ConnectU twins who had hired him - and so he wasn't able to navigate to design and evolve a system to fully harness the potential of having what's essentially a free marketing platform for him as the controller - instead mostly depending on network effect defense strategies including buying up feature sets like WhatsApp, Instagram, etc - who gained a critical mass that could begin to become a competitor with FB, so no real innovation. The VC industrial complex has been a driver in selecting for all of this, and where acquisitions also suck up and eliminate any up and coming competition that gained enough market share and momentum to be a threat; the incumbent dating and food-delivery platforms-apps are the most obvious for this; the captured MSM is another less obvious version of this, where conglomeration from consolidation has put the power of information control in the hands of fewer and fewer people - why big pharma has been so successful suppressing the majority of negative sentiment about them, as one of multiple parties who are toeing the line and attempting to maintain control with what I call the censorship-suppression-narrative control apparatus; Elon buying Twitter-X created a #ZeroIsASpecialNumber problem in terms of no longer being able to as easily put their hand on the scale of free speech - a blow to their authoritarian-totalitarian and industrial complex dreams, that combination forming fascism. Another example, I think the advertising industrial complex will collapse within the next decade. Ads are probably tied at first with downvoting mechanisms for how detrimental of an effect they have on society - where I don't have time to dive into detailing reasons for either right now; they are not mimicking natural patterns for how information-attention was distributed prior to digital. Business is war, and there are $ trillions at stake - and so who knows what all the various parties, millions to billions of people who most likely mostly blindly follow the status quo system because they believe that they will do better off - those who struggled to get where they are in the manufactured rat race, and holding on for dear life due to fear, when in fact tyranny and scarcity mindset is very expensive - and where the universe provides all the abundance we need, and we can all thrive with proper organization. “Those who love peace must learn to organize as effectively as those who love war.” — Martin Luther King, Jr. Thanks for the convo! Please continue if you're motivated or inspired to! P.S. I had 2 neck surgeries last week, so my pain level is down a lot - and so words are flowing out of me a bit easier, and apparently you inspired me to say far more than I was expecting, so thank you again.

j45 2y ago

WHile US has private healthcare, Canada does not and data does not belong to the private companies.