4 ms·

Disappointing behavior to say the least. "On February 11, 2025, Blue Shield discovered that, between April 2021 and January 2024, Google Analytics was configur

by bix6 2y ago

Disappointing behavior to say the least. "On February 11, 2025, Blue Shield discovered that, between April 2021 and January 2024, Google Analytics was configured in a way that allowed certain member data to be shared with Google’s advertising product, Google Ads, that likely included protected health information. Google may have used this data to conduct focused ad campaigns back to those individual members. We want to reassure our members that no bad actor was involved, and, to our knowledge, Google has not used the information for any purpose other than these ads or shared the protected information with anyone."

deleted 2y ago
[deleted]
accrual 2y ago
I wonder what, if any, HIPAA fines will apply to Blue Shield if they're found to have inadvertently exposed PHI. https://www.hipaajournal.com/hipaa-violation-fines/ https://www.hipaajournal.com/hipaa-violation-fines/
- chimeracoder 2y ago
  > I wonder what, if any, HIPAA fines will apply to Blue Shield if they're found to have inadvertently exposed PHI. Well, they have inadvertently exposed PHI - this press release literally admits that they did. In terms of what fines will apply, well, the annual cap for violations is about $2 million per calendar year, but I doubt they'll have to pay even that.
01HNNWZ0MV43FF 2y ago
"No bad actor was involved" I see two but whatever
- anon84873628 2y ago
  I'm sure Google doesn't want customers doing this dumb stuff. So I'd also expect by this point they would be automatically profiling the incoming data to throw up warnings and safe guards. Maybe there is a perverse incentive where doing that only increases their liability in these situations.
wrs 2y ago
Putting a third party analytics tool on a page containing PHI is an incredibly dangerous thing to do. It’s really surprising the developers could get that through a security review.
- donohoe 2y ago
  What security review?
- stackskipton 2y ago
  As someone who has worked in this field, I'm not. Marketing is generally exempt from massive legal review as they hand wave away "We don't deal with HIPPA data" and developers just wanting marketing to go away, dropped the Javascript block into files that were used for a ton of products including HIPAA containing ones. EDIT: Most of these places are just feature factories with offshore developers who are very unlikely to raise concerns.
  - chimeracoder 2y ago
    > As someone who has worked in this field, I'm not. Marketing is generally exempt from massive legal review as they hand wave away "We don't deal with HIPPA data" and developers just wanting marketing to go away, dropped the Javascript block into files that were used for a ton of products including HIPAA containing ones. I don't know why you're being downvoted, because this is unfortunately quite accurate. You'd be shocked how often this happens, even for tools they think are totally secure and "HIPAA-compliant". > EDIT: Most of these places are just feature factories with offshore developers who are very unlikely to raise concerns. I don't think there's any meaningful difference based on where the developers are located. The developers aren't the ones making the decisions. Usually the issue is that the higher-ups want it, which is why practices can continue even after concerns are raised.
    - gausswho 2y ago
      I worked at an org that give Google Tag Manager access to marketing, effectively as means of bypassing engineering to try whatever spyslime of the month they could paste into a box.
nyarlathotep_ 2y ago
> that no bad actor was involved Actually no, Blue Shield is the bad actor here. Why, again, is this necessary at all? What is the rationale for analytics somewhere that deals with private health data?

by bix6 2y ago

deleted 2y ago

[deleted]

accrual 2y ago

I wonder what, if any, HIPAA fines will apply to Blue Shield if they're found to have inadvertently exposed PHI. https://www.hipaajournal.com/hipaa-violation-fines/ https://www.hipaajournal.com/hipaa-violation-fines/

chimeracoder 2y ago
> I wonder what, if any, HIPAA fines will apply to Blue Shield if they're found to have inadvertently exposed PHI. Well, they have inadvertently exposed PHI - this press release literally admits that they did. In terms of what fines will apply, well, the annual cap for violations is about $2 million per calendar year, but I doubt they'll have to pay even that.

01HNNWZ0MV43FF 2y ago

"No bad actor was involved" I see two but whatever

anon84873628 2y ago
I'm sure Google doesn't want customers doing this dumb stuff. So I'd also expect by this point they would be automatically profiling the incoming data to throw up warnings and safe guards. Maybe there is a perverse incentive where doing that only increases their liability in these situations.

wrs 2y ago

Putting a third party analytics tool on a page containing PHI is an incredibly dangerous thing to do. It’s really surprising the developers could get that through a security review.

donohoe 2y ago
What security review?
stackskipton 2y ago
As someone who has worked in this field, I'm not. Marketing is generally exempt from massive legal review as they hand wave away "We don't deal with HIPPA data" and developers just wanting marketing to go away, dropped the Javascript block into files that were used for a ton of products including HIPAA containing ones. EDIT: Most of these places are just feature factories with offshore developers who are very unlikely to raise concerns.
- chimeracoder 2y ago
  > As someone who has worked in this field, I'm not. Marketing is generally exempt from massive legal review as they hand wave away "We don't deal with HIPPA data" and developers just wanting marketing to go away, dropped the Javascript block into files that were used for a ton of products including HIPAA containing ones. I don't know why you're being downvoted, because this is unfortunately quite accurate. You'd be shocked how often this happens, even for tools they think are totally secure and "HIPAA-compliant". > EDIT: Most of these places are just feature factories with offshore developers who are very unlikely to raise concerns. I don't think there's any meaningful difference based on where the developers are located. The developers aren't the ones making the decisions. Usually the issue is that the higher-ups want it, which is why practices can continue even after concerns are raised.
  - gausswho 2y ago
    I worked at an org that give Google Tag Manager access to marketing, effectively as means of bypassing engineering to try whatever spyslime of the month they could paste into a box.

nyarlathotep_ 2y ago

> that no bad actor was involved Actually no, Blue Shield is the bad actor here. Why, again, is this necessary at all? What is the rationale for analytics somewhere that deals with private health data?