5 ms·

"Confidential" 988 conversation records shared with corporations

161 points by throwaway81523 2y ago

o11c 2y ago
For this specifically, shouldn't HIPAA apply and quite strictly at that? Unlike the general Internet where laws are so poor that an opt-out hidden checkbox is sufficient as "consent", HIPAA is quite specific on what is needed and who needs to get it.
- SkyPuncher 2y ago
  HIPAA applies to far fewer entities than people think. Essentially only healthcare companies accepting insurance have to abide by it. There partnered do, but only transitively.
- BCM43 2y ago
  For somewhat complicated reasons that can be simplified to them not billing insurance, I don't think most crisis text lines are going to qualify as covered entities under HIPAA.
  - ted_bunny 2y ago
    I think they're still considered a "business partner" and subject to HIPAA iirc.
- newzisforsukas 2y ago
  > Reierson is especially disturbed by how Vibrant and SAMHSA are characterizing 988Lifeline as not a mental health service—thereby removing public legal protections that exist with health services even as 988Lifeline operates like a health service by providing counseling, keeping records on callers, and instigating police wellness checks and mobile crisis team visits with or without consent. “That makes 988 dangerous,” he said. “If we continue on as we are, these problems of accountability are just going to entrench further.”
  - anigbrowl 2y ago
    I'm super-tired by how much of the US legal system consists of bullshit arguments about definitions. A great deal of legal strategic maneuvering these days is about challenging who gets to make such definitions or demanding courts admit obscure/specious ones, in order to then insist on rigid, mechanistic (and often draconian) interpretations of law incorporating the 'preferred' meaning. The Constitutional requirement for a common-law legal system only works to the degree that there is common agreement on basic premises. Once linguistic definitions come to be viewed as strategic legal territory to be captured, the system is bound to collapse under the weight of its own contradictions.
    - zer00eyz 2y ago
      [flagged]
    - ryandrake 2y ago
      Title II of HIPAA should just be extended to apply to all data about all people, so it doesn't matter whether it's ackshually health data or not. Then, all the lawyers arguing about who's a "covered entity" and who isn't, what's "protected health information" and what isn't, can go get bent. The data protection rules provided by HIPAA are actually pretty good, especially for a privacy-hostile country like the USA. I'd love see something like HIPAA act as the model for a generic (non-healthcare) data privacy protection law, if Congress could get their shit together and propose it.
      - deleted 2y ago
        [deleted]
    - eru 2y ago
      Arguing about definitions isn't new. Have a look at the history of the definition of 'contract' in common law (https://en.wikipedia.org/wiki/Contract#Common_law_contracts https://en.wikipedia.org/wiki/Contract#Common_law_contracts is a good starting point, I guess). It's full of such nitpicking around definitions.
- CuriousCosmic 2y ago
  You'd think but they basically just slapped little "oh we aren't actually healthcare" snippets in their licenses and are hoping that's enough to get them out of actually being required to comply with HIPAA despite them very clearly needing to. So yeah it should apply but they are just claiming they aren't a mental healthcare service to avoid it despite them being a literal mental health crisis hotline. It probably won't hold up but it might be enough to lessen penalties since they can feign ignorance.
  - 9991 2y ago
    “I didn’t know I couldn’t do that.”
  - deleted 2y ago
    [deleted]
  - drdaeman 2y ago
    I don't think HIPAA cares in the slightest about how a company calls themselves. If their normal operations involve working with what law says is a PHI, they gotta be compliant, even if they identify as a construction company (j/k). Or at least I was given this impression from my compliance trainings.
newzisforsukas 2y ago
Might as well scrap the program, this is a bucket of poison in a well
- ChrisMarshallNY 2y ago
  Q: What do you get when you add a drop of wine to a barrel of sewage? A: A barrel of sewage. Q: What do you get when you add a drop of sewage to a barrel of wine? A: A barrel of sewage.
  - salad-tycoon 2y ago
    On your 2nd point, seems like this is merely a failure of marketing and product placement/research. I think you don’t truly believe in your product and here’s why: The people simply do not understand, yet, that they want this sewage-kissed vintage. Slap some AI on it. You want this vintage, what doesn’t kill you makes you stronger. Strengthens the immune system. Helps save water. Reduces CO2. It makes the alcohol stronger and you get drunker and with less headaches (don’t need to mention it’s because you’ll be comatose in the hospital with sepsis). Don’t be an elitist, look your homegrown trad and progressive influencer is drinking it. Publish research on it, no one can tell difference in blind taste testing and the paid subjects actually prefer ours anyways. Did you know we excrete most of our vitamins in our urine and feces? Reclaim that shit (literally) it’s highly bioavailabile too! Bonus! Don’t give up, don’t admit defeat. Believe in your product. Bottoms up.
csours 2y ago
Write and call your congresscritter.
rasengan 2y ago
Well this is likely to cause a chilling effect against the use of this service. That’s a bad thing.
maybelsyrup 2y ago
Nothing specific to add other than that it's great to see Rob Wipond's work here on HN, and that I recommend him as a great journalist and researcher in a pretty niche field (maybe you could call that niche 'the underbelly of mental health'). I met him at a psychology research conference years ago and he's a stand-up guy. He's got a great new book about involuntary detentions in mental health (psychiatric holds, in other words). "Your consent is not required" -- highly recommend. NB I am not Rob Wipond lmao
- pas 2y ago
  On a related note the site spreads sketchy "science", eg. when it comes to genetics and mental health. https://www.psychiatrymargins.com/p/how-mad-in-america-misrepresents https://www.psychiatrymargins.com/p/how-mad-in-america-misre...
bparsons 2y ago
I never cease to be amazed by the privacy abuses that are permitted and encouraged in the United States.
- reboot81 2y ago
  Completely different priorities compared to the EU. Just the fact that it was difficult to find out what the call centers policies were shows that there’s no political desire to put individuals before corporations.
throwaway378185 2y ago
As a person who was staring SAMSHA page feeling desperate about 2 years ago I can attest that personally the notion of the calls being recorded did have a chilling effect. I am a bit particular about privacy and did not want my information living on a disk somewhere to be used in ways outside of my knowledge and control. It may have served me well to have someone to talk me off the metaphorical ledge, but obviously things worked out OK. Two years of EMDR and I self report measurable change for the positive in my mental health.
- dredmorbius 2y ago
  SAMHSA? <https://www.samhsa.gov/ https://www.samhsa.gov/>
Animats 2y ago
FCC: "The 988 Lifeline provides 24/7, confidential support to people in suicidal crisis or mental health-related distress. By calling or texting 988, you’ll connect to mental health professionals with the Lifeline network."[1] This service is Government funded.[2] Vibrant is getting most of that money.[3] The FCC was most concerned about keeping the call data confidential. This thing is set up so that 988 answerers don't get call data, but there's a way they can turn a 988 call into a 911 call and a 911 dispatcher can get full location info. All the confidentiality stuff seems to revolve around call data.[4] Not collecting marketing info from the call content. [1] https://www.fcc.gov/988-suicide-and-crisis-lifeline https://www.fcc.gov/988-suicide-and-crisis-lifeline [2] https://www.samhsa.gov/find-help/988/faqs#roles-and-funding https://www.samhsa.gov/find-help/988/faqs#roles-and-funding [3] https://www.samhsa.gov/find-help/988/faqs#roles-and-funding https://www.samhsa.gov/find-help/988/faqs#roles-and-funding [4] https://coephi.org/resource/privacy-considerations-for-state-988-crisis-response-networks/ https://coephi.org/resource/privacy-considerations-for-state...
cryptonector 2y ago
Reading part 1 also is hair-raising. I wonder if Vibrant gets a fee for every case they refer to police/EMS, or from hospitals that the callers get taken to / seen at.
kerkeslager 2y ago
> Reierson is especially disturbed by how Vibrant and SAMHSA are characterizing 988Lifeline as not a mental health service Yeah that's nice, but everyone else is characterizing it as a mental health service. Put them in prison for HIPAA violation. Yes, actually put people in prison, don't fine the corporations and let the criminals walk away with the profits. They know this is wrong, and they're doing it because they think they can make more money than the slap on the wrist fine they're likely to get. We need to stop letting criminals get away with crimes because they hide behind a corporation.
underlogic 2y ago
what what what! there'll be a body count to this news. people simply won't call can you imagine a more outrageous preposition than data mining conversations between the suicidal their emergency councillors? just couldn't pass up that golden intel opportunity apparently
- Aerroon 2y ago
  Well, it just goes to show that the people that wouldn't trust such a service were right all along. Everyone else just gaslit them over it "while trying to help". The same goes for things like mandatory reporting requirements, especially if those requirements are opaque. As sad as it is to say, I think people that are worried about this are better off not trusting/confiding in 'mental health professionals' (or prolly 'that are there to help'). Their interests just aren't aligned with yours.
koolala 2y ago
sounds sad or scary i should look
- koolala 2y ago
  i see a lot of $

o11c 2y ago

For this specifically, shouldn't HIPAA apply and quite strictly at that? Unlike the general Internet where laws are so poor that an opt-out hidden checkbox is sufficient as "consent", HIPAA is quite specific on what is needed and who needs to get it.

SkyPuncher 2y ago
HIPAA applies to far fewer entities than people think. Essentially only healthcare companies accepting insurance have to abide by it. There partnered do, but only transitively.
BCM43 2y ago
For somewhat complicated reasons that can be simplified to them not billing insurance, I don't think most crisis text lines are going to qualify as covered entities under HIPAA.
- ted_bunny 2y ago
  I think they're still considered a "business partner" and subject to HIPAA iirc.
newzisforsukas 2y ago
> Reierson is especially disturbed by how Vibrant and SAMHSA are characterizing 988Lifeline as not a mental health service—thereby removing public legal protections that exist with health services even as 988Lifeline operates like a health service by providing counseling, keeping records on callers, and instigating police wellness checks and mobile crisis team visits with or without consent. “That makes 988 dangerous,” he said. “If we continue on as we are, these problems of accountability are just going to entrench further.”
- anigbrowl 2y ago
  I'm super-tired by how much of the US legal system consists of bullshit arguments about definitions. A great deal of legal strategic maneuvering these days is about challenging who gets to make such definitions or demanding courts admit obscure/specious ones, in order to then insist on rigid, mechanistic (and often draconian) interpretations of law incorporating the 'preferred' meaning. The Constitutional requirement for a common-law legal system only works to the degree that there is common agreement on basic premises. Once linguistic definitions come to be viewed as strategic legal territory to be captured, the system is bound to collapse under the weight of its own contradictions.
  - zer00eyz 2y ago
    [flagged]
  - ryandrake 2y ago
    Title II of HIPAA should just be extended to apply to all data about all people, so it doesn't matter whether it's ackshually health data or not. Then, all the lawyers arguing about who's a "covered entity" and who isn't, what's "protected health information" and what isn't, can go get bent. The data protection rules provided by HIPAA are actually pretty good, especially for a privacy-hostile country like the USA. I'd love see something like HIPAA act as the model for a generic (non-healthcare) data privacy protection law, if Congress could get their shit together and propose it.
    - deleted 2y ago
      [deleted]
  - eru 2y ago
    Arguing about definitions isn't new. Have a look at the history of the definition of 'contract' in common law (https://en.wikipedia.org/wiki/Contract#Common_law_contracts https://en.wikipedia.org/wiki/Contract#Common_law_contracts is a good starting point, I guess). It's full of such nitpicking around definitions.
CuriousCosmic 2y ago
You'd think but they basically just slapped little "oh we aren't actually healthcare" snippets in their licenses and are hoping that's enough to get them out of actually being required to comply with HIPAA despite them very clearly needing to. So yeah it should apply but they are just claiming they aren't a mental healthcare service to avoid it despite them being a literal mental health crisis hotline. It probably won't hold up but it might be enough to lessen penalties since they can feign ignorance.
- 9991 2y ago
  “I didn’t know I couldn’t do that.”
- deleted 2y ago
  [deleted]
- drdaeman 2y ago
  I don't think HIPAA cares in the slightest about how a company calls themselves. If their normal operations involve working with what law says is a PHI, they gotta be compliant, even if they identify as a construction company (j/k). Or at least I was given this impression from my compliance trainings.

newzisforsukas 2y ago

Might as well scrap the program, this is a bucket of poison in a well

ChrisMarshallNY 2y ago
Q: What do you get when you add a drop of wine to a barrel of sewage? A: A barrel of sewage. Q: What do you get when you add a drop of sewage to a barrel of wine? A: A barrel of sewage.
- salad-tycoon 2y ago
  On your 2nd point, seems like this is merely a failure of marketing and product placement/research. I think you don’t truly believe in your product and here’s why: The people simply do not understand, yet, that they want this sewage-kissed vintage. Slap some AI on it. You want this vintage, what doesn’t kill you makes you stronger. Strengthens the immune system. Helps save water. Reduces CO2. It makes the alcohol stronger and you get drunker and with less headaches (don’t need to mention it’s because you’ll be comatose in the hospital with sepsis). Don’t be an elitist, look your homegrown trad and progressive influencer is drinking it. Publish research on it, no one can tell difference in blind taste testing and the paid subjects actually prefer ours anyways. Did you know we excrete most of our vitamins in our urine and feces? Reclaim that shit (literally) it’s highly bioavailabile too! Bonus! Don’t give up, don’t admit defeat. Believe in your product. Bottoms up.

csours 2y ago

Write and call your congresscritter.

rasengan 2y ago

Well this is likely to cause a chilling effect against the use of this service. That’s a bad thing.

maybelsyrup 2y ago

Nothing specific to add other than that it's great to see Rob Wipond's work here on HN, and that I recommend him as a great journalist and researcher in a pretty niche field (maybe you could call that niche 'the underbelly of mental health'). I met him at a psychology research conference years ago and he's a stand-up guy. He's got a great new book about involuntary detentions in mental health (psychiatric holds, in other words). "Your consent is not required" -- highly recommend. NB I am not Rob Wipond lmao

pas 2y ago
On a related note the site spreads sketchy "science", eg. when it comes to genetics and mental health. https://www.psychiatrymargins.com/p/how-mad-in-america-misrepresents https://www.psychiatrymargins.com/p/how-mad-in-america-misre...

bparsons 2y ago

I never cease to be amazed by the privacy abuses that are permitted and encouraged in the United States.

reboot81 2y ago
Completely different priorities compared to the EU. Just the fact that it was difficult to find out what the call centers policies were shows that there’s no political desire to put individuals before corporations.

throwaway378185 2y ago

As a person who was staring SAMSHA page feeling desperate about 2 years ago I can attest that personally the notion of the calls being recorded did have a chilling effect. I am a bit particular about privacy and did not want my information living on a disk somewhere to be used in ways outside of my knowledge and control. It may have served me well to have someone to talk me off the metaphorical ledge, but obviously things worked out OK. Two years of EMDR and I self report measurable change for the positive in my mental health.

dredmorbius 2y ago
SAMHSA? <https://www.samhsa.gov/ https://www.samhsa.gov/>

Animats 2y ago

FCC: "The 988 Lifeline provides 24/7, confidential support to people in suicidal crisis or mental health-related distress. By calling or texting 988, you’ll connect to mental health professionals with the Lifeline network."[1] This service is Government funded.[2] Vibrant is getting most of that money.[3] The FCC was most concerned about keeping the call data confidential. This thing is set up so that 988 answerers don't get call data, but there's a way they can turn a 988 call into a 911 call and a 911 dispatcher can get full location info. All the confidentiality stuff seems to revolve around call data.[4] Not collecting marketing info from the call content. [1] https://www.fcc.gov/988-suicide-and-crisis-lifeline https://www.fcc.gov/988-suicide-and-crisis-lifeline [2] https://www.samhsa.gov/find-help/988/faqs#roles-and-funding https://www.samhsa.gov/find-help/988/faqs#roles-and-funding [3] https://www.samhsa.gov/find-help/988/faqs#roles-and-funding https://www.samhsa.gov/find-help/988/faqs#roles-and-funding [4] https://coephi.org/resource/privacy-considerations-for-state-988-crisis-response-networks/ https://coephi.org/resource/privacy-considerations-for-state...

cryptonector 2y ago

Reading part 1 also is hair-raising. I wonder if Vibrant gets a fee for every case they refer to police/EMS, or from hospitals that the callers get taken to / seen at.

kerkeslager 2y ago

> Reierson is especially disturbed by how Vibrant and SAMHSA are characterizing 988Lifeline as not a mental health service Yeah that's nice, but everyone else is characterizing it as a mental health service. Put them in prison for HIPAA violation. Yes, actually put people in prison, don't fine the corporations and let the criminals walk away with the profits. They know this is wrong, and they're doing it because they think they can make more money than the slap on the wrist fine they're likely to get. We need to stop letting criminals get away with crimes because they hide behind a corporation.

underlogic 2y ago

what what what! there'll be a body count to this news. people simply won't call can you imagine a more outrageous preposition than data mining conversations between the suicidal their emergency councillors? just couldn't pass up that golden intel opportunity apparently

Aerroon 2y ago
Well, it just goes to show that the people that wouldn't trust such a service were right all along. Everyone else just gaslit them over it "while trying to help". The same goes for things like mandatory reporting requirements, especially if those requirements are opaque. As sad as it is to say, I think people that are worried about this are better off not trusting/confiding in 'mental health professionals' (or prolly 'that are there to help'). Their interests just aren't aligned with yours.

koolala 2y ago

sounds sad or scary i should look

koolala 2y ago
i see a lot of $