4 ms·

I'm a retired software developer that's worked in just about every healthcare-adjacent industry segment you can imagine with HIPAA compliance being an evergreen

I'm a retired software developer that's worked in just about every healthcare-adjacent industry segment you can imagine with HIPAA compliance being an evergreen issue. I know how this sausage gets made on the back end and let me tell you regardless of what impression has been made to you about compliance and safeguards the reality behind the scenes is always messy. Hundreds of gigs of unanonymized user data lying around on developer machines, getting tossed out accidentally during equipment rollouts, leaky API implementations, half-assed compliance testing, lack of meaningful continuous oversight, vendor services with varying levels of compliance hot-glued together on the back end, outright theft of data, this list is incomplete. I'd recommend a weapons-grade dose of skepticism over any claims of meaningful data privacy as the last 30 years have consistently and comprehensively shown that anything that gets digitized eventually gets outed if there's a financial motivation to do so.

sxg 2y ago
Yes, I do believe what you're telling me—the state of healthcare tech is definitely leagues behind general consumer tech. However, I do think this is a meaningfully different class of issue when it comes to patients' perceptions and actual harms. Patients are afraid of having their health data used against them. For example, revealing medical conditions to potential employers, revealing health information to friends/family, etc. There's a growing mistrust of healthcare institutions in recent years, and there are unfounded accusations of healthcare institutions selling data for financial gain like social media companies and even the DMV (https://www.caranddriver.com/features/a32035408/dmv-selling-driver-data/ https://www.caranddriver.com/features/a32035408/dmv-selling-...). This class of nefarious patient data privacy/security negligence effectively doesn't happen. I've treated patients who are illegal US immigrants, I see patients who use and possess illegal drugs while in the hospital, but they're not reported to anyone. They're simply treated and discharged. Unfortunately, a growing number of patients don't believe this is the case, and we see substantial disparities in levels of care provided to these patients who fear healthcare. I'm not at all dismissing how terrible it is that healthcare tech companies can be lax with patient data. This absolutely needs to be better! But at the same time, this sounds more like incompetence than active malice. Practically speaking, a patient is extremely unlikely to experience actual harm because a developer accidentally took patient data home on a personal laptop. Although, I would love to hear more about what kinds of violations you've seen in your time in health tech? I work with third party vendors from a healthcare institution, and I absolutely want to figure out how to fix this.
- int_19h 2y ago
  With stuff like illegal drugs, so long as records are retained by the hospital, what prevents the feds from coming in later with a warrant to go through them?
  - genewitch 2y ago
    In the US a mere warrant is not enough to pierce doctor patient privilege, afaik. At least i would hope it would take a subpoena or a court order or something of the ilk. Now, though, if a third party accidentally leaks your patient info, or lead pipes are involved
  - sxg 2y ago
    HIPAA trumps the warrant. HIPAA is serious when it says patient data can only be shared for treatment, payment, and hospital operations purposes. Law enforcement is not an allowable reason to disclose patient information without their permission.

sxg 2y ago

Yes, I do believe what you're telling me—the state of healthcare tech is definitely leagues behind general consumer tech. However, I do think this is a meaningfully different class of issue when it comes to patients' perceptions and actual harms. Patients are afraid of having their health data used against them. For example, revealing medical conditions to potential employers, revealing health information to friends/family, etc. There's a growing mistrust of healthcare institutions in recent years, and there are unfounded accusations of healthcare institutions selling data for financial gain like social media companies and even the DMV (https://www.caranddriver.com/features/a32035408/dmv-selling-driver-data/ https://www.caranddriver.com/features/a32035408/dmv-selling-...). This class of nefarious patient data privacy/security negligence effectively doesn't happen. I've treated patients who are illegal US immigrants, I see patients who use and possess illegal drugs while in the hospital, but they're not reported to anyone. They're simply treated and discharged. Unfortunately, a growing number of patients don't believe this is the case, and we see substantial disparities in levels of care provided to these patients who fear healthcare. I'm not at all dismissing how terrible it is that healthcare tech companies can be lax with patient data. This absolutely needs to be better! But at the same time, this sounds more like incompetence than active malice. Practically speaking, a patient is extremely unlikely to experience actual harm because a developer accidentally took patient data home on a personal laptop. Although, I would love to hear more about what kinds of violations you've seen in your time in health tech? I work with third party vendors from a healthcare institution, and I absolutely want to figure out how to fix this.

int_19h 2y ago
With stuff like illegal drugs, so long as records are retained by the hospital, what prevents the feds from coming in later with a warrant to go through them?
- genewitch 2y ago
  In the US a mere warrant is not enough to pierce doctor patient privilege, afaik. At least i would hope it would take a subpoena or a court order or something of the ilk. Now, though, if a third party accidentally leaks your patient info, or lead pipes are involved
- sxg 2y ago
  HIPAA trumps the warrant. HIPAA is serious when it says patient data can only be shared for treatment, payment, and hospital operations purposes. Law enforcement is not an allowable reason to disclose patient information without their permission.