3 ms·

So… Is it surprising that Engineers in healthcare dont read the actual HIPAA documentation? Use of health data is permitted so long as it’s for payment, treat

So… Is it surprising that Engineers in healthcare dont read the actual HIPAA documentation? Use of health data is permitted so long as it’s for payment, treatment or operations. Disclosures and patient consent are not required. There are helpful summaries on the US Department of Health and Humans Services website of the various rules (Security, Privacy & Notification) Source: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/guidance... This allowance is permitted to covered entities and by extension their vendors (business associates) by HIPAA. If it wasn’t then, theoretically the US healthcare industry would grind to a halt considering the number of intermediaries for a single transaction. Example: Doctor writes script -> EHR -> Pharmacy -> Switch -> Clearinghouse —> PA Processing -> PBM/Plan makes determination Along this flow there are other possible branches and vendors. It’s beyond complex.

aiforecastthway 2y ago
> If it wasn’t then, theoretically the US healthcare industry would grind to a halt considering the number of intermediaries for a single transaction. It just occurred to me that cleaning up our country's data privacy / data ownership mess might have extraordinarily positive second-order effects on our Kafkaesque and criminally expensive healthcare "system". Maybe making it functionally impossible for there to be hundreds of middlemen between me and my doctor would be a... good thing?
- throwaway936r8 2y ago
  I think it would have the opposite effect. We could end up with a few all-in-one systems that would dominate the market and have little incentive to improve or compete on usability and price.
- Spooky23 2y ago
  Only if your mortgage isn’t paid by such a middleman.
- specialist 2y ago
  Correct. Would also mostly stop a lot of scams like identity theft. A national identity service, like a normal mature economy, would be a massive public policy and public health win. But it'd slightly decrease profits. So of course is quite impossible to implement.
outside1234 2y ago
Define operations, because that sounds like a loophole that basically allows you to use it for anything
- connicpu 2y ago
  Basically the only thing you can't do with the data is disclose it to someone who doesn't also fall under HIPAA
- Spooky23 2y ago
  HIPPA protects you against gossipy staff. Beyond that, it’s mostly smoke - entire industries are built on loopholes. Pre-HIPPA, the hospital would tell a news reporter about your status. Now, drug marketing companies know about your prescriptions before your pharmacy does.
  - specialist 2y ago
    Mid aughts, we devs sat in the meetings discussing how to enable this. With teams from Google Health, Microsoft Health Vault, some pharmas. In attendance were marketing, biz dev, execs. Ours and theres. But no legal. Hmmm. And it would have worked if it weren't for those meddling teenagers. From your comment, I'm inferring they're now allowed to use health records for marketing.
    - Spooky23 2y ago
      My wife about 9 years ago was admitted to the hospital for a ruptured ectopic pregnancy. The baby would have been about two months along. On the would-be due date, a box arrived via FedEx of Enfamil samples and a chirpy “welcome baby” message. Of course there was no baby. It turns out that using prescription data, admission data and other information that is aggregated as part of subrogation and other processes, you can partially de-anonymize/rebuild / health record and make an inference. Enfamil told me what list they used and I bought it, it contained a bunch of information including my wife’s. I also know everyone in my zip code who had diabetes in 2015. There’s even more intrusive stuff around opioid surveillance.
specialist 2y ago
This is why I advocate all PII data be encrypted at rest at the field level. Worked on EMRs (during the aughts). Had yearly HIPAA and other security theater training. Not optional for any one in the field. Of course we had root access. I forget the precise language, but HIPAA exempts "intermediaries" such as ourselves. How else could we build and verify the system(s). And that's why HIPAA is a joke. Yes, our systems had consent and permissions and audit logs cooked in. So theoretically peeking at PII could be caught. Alas, it was just CYA. None of our customers reviewed their access logs. -- I worked very hard to figure out how to protect patient (and voter) privacy. Eventually conceded that deanon always beats anon, because of Big Data. I eventually found the book Translucent Databases. Shows how to design schemas to protect PII for common use cases. Its One Weird Trick is applying proper protection of passwords (salt + hash) to all other PII. Super clever. And obvious once you're clued in. That's just 1/2 of the solution. The other 1/2 is policy (non technical). All data about a person is owned by that person. Applying property law to PII transmutes 3rd party retention of PII from an asset to a liability. And once legal, finance, and accounting people get involved, orgs won't hoard PII unless it's absolutely necessary. (The legal term "privacy" means something like "sovereignty over oneself", not just the folk understanding of "keeping my secrets private.)
1oooqooq 2y ago
> Use of health data is permitted so long as it’s for payment, treatment or operations please, do tell me, where "estimating better pricing models to extract more profit" fit into those? > Doctor writes script -> EHR -> Pharmacy -> Switch -> Clearinghouse —> PA Processing -> PBM/Plan makes determination All the OP mentions happens way after the fact of those paths you described. People have already been charged. Treatment was already decided.

aiforecastthway 2y ago

> If it wasn’t then, theoretically the US healthcare industry would grind to a halt considering the number of intermediaries for a single transaction. It just occurred to me that cleaning up our country's data privacy / data ownership mess might have extraordinarily positive second-order effects on our Kafkaesque and criminally expensive healthcare "system". Maybe making it functionally impossible for there to be hundreds of middlemen between me and my doctor would be a... good thing?

throwaway936r8 2y ago
I think it would have the opposite effect. We could end up with a few all-in-one systems that would dominate the market and have little incentive to improve or compete on usability and price.
Spooky23 2y ago
Only if your mortgage isn’t paid by such a middleman.
specialist 2y ago
Correct. Would also mostly stop a lot of scams like identity theft. A national identity service, like a normal mature economy, would be a massive public policy and public health win. But it'd slightly decrease profits. So of course is quite impossible to implement.

outside1234 2y ago

Define operations, because that sounds like a loophole that basically allows you to use it for anything

connicpu 2y ago
Basically the only thing you can't do with the data is disclose it to someone who doesn't also fall under HIPAA
Spooky23 2y ago
HIPPA protects you against gossipy staff. Beyond that, it’s mostly smoke - entire industries are built on loopholes. Pre-HIPPA, the hospital would tell a news reporter about your status. Now, drug marketing companies know about your prescriptions before your pharmacy does.
- specialist 2y ago
  Mid aughts, we devs sat in the meetings discussing how to enable this. With teams from Google Health, Microsoft Health Vault, some pharmas. In attendance were marketing, biz dev, execs. Ours and theres. But no legal. Hmmm. And it would have worked if it weren't for those meddling teenagers. From your comment, I'm inferring they're now allowed to use health records for marketing.
  - Spooky23 2y ago
    My wife about 9 years ago was admitted to the hospital for a ruptured ectopic pregnancy. The baby would have been about two months along. On the would-be due date, a box arrived via FedEx of Enfamil samples and a chirpy “welcome baby” message. Of course there was no baby. It turns out that using prescription data, admission data and other information that is aggregated as part of subrogation and other processes, you can partially de-anonymize/rebuild / health record and make an inference. Enfamil told me what list they used and I bought it, it contained a bunch of information including my wife’s. I also know everyone in my zip code who had diabetes in 2015. There’s even more intrusive stuff around opioid surveillance.

specialist 2y ago

This is why I advocate all PII data be encrypted at rest at the field level. Worked on EMRs (during the aughts). Had yearly HIPAA and other security theater training. Not optional for any one in the field. Of course we had root access. I forget the precise language, but HIPAA exempts "intermediaries" such as ourselves. How else could we build and verify the system(s). And that's why HIPAA is a joke. Yes, our systems had consent and permissions and audit logs cooked in. So theoretically peeking at PII could be caught. Alas, it was just CYA. None of our customers reviewed their access logs. -- I worked very hard to figure out how to protect patient (and voter) privacy. Eventually conceded that deanon always beats anon, because of Big Data. I eventually found the book Translucent Databases. Shows how to design schemas to protect PII for common use cases. Its One Weird Trick is applying proper protection of passwords (salt + hash) to all other PII. Super clever. And obvious once you're clued in. That's just 1/2 of the solution. The other 1/2 is policy (non technical). All data about a person is owned by that person. Applying property law to PII transmutes 3rd party retention of PII from an asset to a liability. And once legal, finance, and accounting people get involved, orgs won't hoard PII unless it's absolutely necessary. (The legal term "privacy" means something like "sovereignty over oneself", not just the folk understanding of "keeping my secrets private.)

1oooqooq 2y ago

> Use of health data is permitted so long as it’s for payment, treatment or operations please, do tell me, where "estimating better pricing models to extract more profit" fit into those? > Doctor writes script -> EHR -> Pharmacy -> Switch -> Clearinghouse —> PA Processing -> PBM/Plan makes determination All the OP mentions happens way after the fact of those paths you described. People have already been charged. Treatment was already decided.