13 ms·
California sent residents' personal health data to LinkedIn
- oaththrowaway 1y agoWhy does a state have ad tracking data? Are they really that hard up for cash that they need to have ad campaigns for people selecting insurance?
- 1024core 1y ago[flagged]
- daniel_reetz 1y agoHere's some context for people who are curious about CA DMV data sales: https://www.thedrive.com/news/35457/why-is-the-california-dmv-selling-drivers-data-for-50-million-and-to-whom https://www.thedrive.com/news/35457/why-is-the-california-dm...
- timfsu 1y agoI understood it to be the reverse - they advertise on LinkedIn, and the trackers determine whether the users convert once they click through. Not great, but at least not as ill intentioned
- kva-gad-fly 1y agoNot sure I understand this, but "I" (coveredca) pay linkedin to place my ads, for which "I" have to use their libraries? That then scrape "my" clients/customer data to linkedin? for them to make more money selling that data? Does this also mean that those pious popups about "Do not sell my information" are essentially vacuous?
- cryptonector 1y agoIt could be insiders getting kickbacks.
- 1024core 1y agoHow is this not a HIPAA violation??
- runjake 1y agoWho says it's not? It looks like a HIPAA violation to me.
- SapporoChris 1y agoWhile I wish it was a HIPAA violation, I am not sure it qualifies. "The HIPAA standards apply to covered entities and business associates “where provided” by §160.102. Covered entities are defined as health plans, healthcare clearinghouses, and healthcare providers who electronically transmit PHI in connection with transactions for which HHS has adopted standards" https://www.hipaajournal.com/what-is-a-hipaa-violation/#whatishipaaandwhodoesitapplyto https://www.hipaajournal.com/what-is-a-hipaa-violation/#what... Covered California is a health insurance marketplace. It is not an Insurance Carrier or an Insurance Clearing house. Perhaps they're guilty of something else?
- spacemadness 1y agoSounds like HIPAA needs some adjustments made to cover marketplaces.
- AStonesThrow 1y agoHIPAA is not designed to protect consumer or patient privacy. That is a silly fiction that voters and constituents believe in order to prop up the legislation. HIPAA is designed to protect the privacy of providers, clinics, hospitals, and insurance carriers. HIPAA is designed to make it maximally difficult to move PHI from one provider to the next. HIPAA is designed to make it maximally difficult for plaintiff attorneys to discover incriminating malpractice evidence when suing those providers. HIPAA is a stepping-stone to single-payer insurance. HIPAA also makes it maximally difficult to involve other people, providers, and entities in your health care. No entity under HIPAA can legally divulge the slightest tidbit to your brother, your parents, or anyone who contacts them, unless an ROI is on file. Those ROIs are a thing you have to go pursue on your own -- they are never offered or suggested by the provider -- and those ROIs will expire at the drop of a hat -- and you never know if an ROI is valid until it is tested at the point of that entity requesting information.
- kordlessagain 1y agoCovered California, the state’s health insurance marketplace, leaked deeply sensitive health information and pregnancy status, domestic abuse disclosures, and prescription drug use to LinkedIn via embedded ad trackers. It’s a pattern we’ve seen across government and private sectors: infrastructure designed for care is being exploited for behavioral targeting through advertising motions. The public doesn’t expect their health decisions to be fed into social ad networks, but the platforms already assume ownership of that data trail. And of course, it’s all connected. The same companies monetizing behavioral profiling at scale are now running the most powerful generative AI systems. Microsoft, which owns LinkedIn, is also the key infrastructure partner of OpenAI. Meta's ad tools were present on these health sites too. Google’s trackers are everywhere else. When you strip away the techno-mystique, what’s driving the AI and data arms race isn’t wisdom. It’s ego, power consolidation, and a pathological fear of being second. And Sam Altman? He’s not stupid. But brilliance without wisdom is just charisma in a predator suit. Why do you think all these services tie directly into AI?
- jajko 1y ago[flagged]
- FredPret 1y agoIt's the idea that class warfare will get us anywhere good that's brutally naive at this point.
- yapyap 1y agoI think class warfare will get the working class further than whatever is being done at the moment honestly.
- FredPret 1y ago...why? How? Have you seen any history at all? This has never worked. Cohesive, trusting societies get much further than ones that are at war with themselves. Even so, cohesion and trust are nice-to-haves. Tech progress and GDP growth has meant that the world's poor live better lives, decade after decade, for many centuries now.
- gazarubbleparty 1y ago[flagged]
- deleted 1y ago[deleted]
- knowitnone 1y agoCalifornia will investigate and find no wrong. Also, LinkedIn==Microsoft
- ty6853 1y agoThey published ("leaked" lol no -- it was all available through a polished portal) the name and address of all CCW and DROS registered firearm holders (including judges, DV victims, prosecutors, etc) and nothing happened. They use your information for political warfare.
- actionfromafar 1y agoThat's nothing. The Federal governemnt sent residents' personal health data to xAI.
- barbazoo 1y agoSource?
- deleted 1y ago[deleted]
- blindriver 1y agoIf you routinely clear your cookies, does that protect you from long term tracking?
- wat10000 1y agoFingerprinting is an active area of research (both attack and defense), so the answer is, maybe, depending on just how unique your setup is. EFF has a nice demo that will try to fingerprint you and tell you how trackable you are based on non-cookie data: https://coveryourtracks.eff.org https://coveryourtracks.eff.org Of course, new techniques are invented all the time, so that may not cover everything.
- blindriver 1y agoUnless they are targeting a specific individual for spying purposes, is there any benefit to doing such deep fingerprinting at the individual level, given that multiple people might use the same computer? It seems like knowing every single thing done at that computer may be too much information that might not have value but having more broad-based tracking patterns would be cheaper and more profitable, no?
- wat10000 1y agoAdvertisers say that the better they can target advertisements, the more valuable they are. If so, then every bit of fingerprinting helps. Maybe multiple people use a computer which degrades it for those particular people, but then many other computers are used by only one person, so it's helpful in aggregate. I'm skeptical this actually works, given the atrocious quality of ads that I see when they sneak past my ad blocker, but that's what they say.
- cookiengineer 1y agoNot if you use Chrome 135 or later, which is every browser now except Firefox/LibreWolf. Federated Learning of Cohorts (FLOC) proved that cookies aren't actually necessary to track you with 98%+ precision, which, given how the internet works, is just 2 clicks. The only way to stay anonymous is to stay on the radar. Sandbox your browser, have multiple physical-on-the-filesystem profiles and never mix business with pleasure or banking with youtube. If you use Linux, create a Windows 11 VM to browse anonymously. Because Linux makes you already stick out as a sore thumb due to its TCP fingerprint.
- barbazoo 1y agoMy understanding is that people would have to intentionally click on the ad on LI to get access to the cookie that contains the sensitive info from the insurance signup flow (which was triggered by clicking the ad). Is that correct?
- treebeard901 1y agoThe reality is that anyone in the medical field can put any kind of information in your medical records for any reason. Many motivations exist to compel this kind of behavior. Sometimes this can be in a part of your permanent record that they do not have to provide to you, even if you follow the rules and laws to request the information. Many exceptions exist under the disclosure laws. Your information then can be freely shared with others but not given to you or give you any way to correct the false information in your record. For what it's worth, in the United States at least, you have several permanent records that follow you everywhere you go. Your medical records work in a similar way to your former employers. In fact, employer confidentiality to other employers allows them to say almost anything about you and neither has to share it with you and you have no chance to have any kind of fair process to correct it. Now add all the data brokers and the other bribery kind of situations and the whole system is basically broken and corrupt.
- nradov 1y agoThat is misinformation. HIPAA covered healthcare providers are legally required to give you copies of your health information upon request, and can only charge a nominal fee for this service (in practice it's usually free). Any patient who is blocked from accessing their own medical records should file a formal complaint with HHS; they have fined multiple provider organizations for violations. https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html https://www.hhs.gov/hipaa/for-individuals/guidance-materials... https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html https://www.hhs.gov/hipaa/for-professionals/compliance-enfor...
- treebeard901 1y ago" Two categories of information are expressly excluded from the right of access: Psychotherapy notes, which are the personal notes of a mental health care provider documenting or analyzing the contents of a counseling session, that are maintained separate from the rest of the patient's medical record. See 45 CFR 164.524(a)(1)(i) and 164.501. Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. See 45 CFR 164.524(a)(1)(ii). " The devil is in the details. It is not misinformation. Thank you. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/guidance... Several others listed here: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524 https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-...
- dzdt 1y agoAmazing to me that an article like this doesn't have a big section discussing how a provider sharing personal health data without permission is blatantly illegal under the HIPAA act. It only mentions as an aside that there are various related lawsuits. Covered California's privacy policy explicitly says they follow HIPAA and that "Covered California will only share your personal information with government agencies, qualified health plans or contractors which help to fulfill a required Exchange function" and "your personal information is only used by or disclosed to those authorized to receive or view it" and "We will not knowingly disclose your personal information to a third party, except as provided in this Privacy Policy". Those privacy policy assertions have been in place since at least October 2020, per the Internet Archive wayback machine record. [2] [1] https://www.coveredca.com/pdfs/privacy/CC_Privacy_Policy.pdf https://www.coveredca.com/pdfs/privacy/CC_Privacy_Policy.pdf [2] https://web.archive.org/web/20201024150356/https://www.coveredca.com/pdfs/privacy/CC_Privacy_Policy.pdf https://web.archive.org/web/20201024150356/https://www.cover...
- autoexec 1y agoCompanies outright lie in their privacy polices all the time. The legal risk in doing so is basically zero because nobody bothers to sue and it's impossible to show damages.
- FireBeyond 1y ago> Amazing to me that an article like this doesn't have a big section discussing how a provider sharing personal health data without permission is blatantly illegal under the HIPAA act. Being really clear, I despise this whole situation. But there's a lot of contortion to get to a government healthcare marketplace being consider a healthcare provider, which has a definition in the law.
- vharuck 1y agoWhen I first read the headline, I thought it was a boneheaded mistake of forgetting to disable tracking on certain web pages. But no: >The Markup found that Covered California had more than 60 trackers on its site. Out of more than 200 of the government sites, the average number of trackers on the sites was three. Covered California had dozens more than any other website we examined. Why is Covered California such an outlier? Why do they need 60 trackers? It's an independent agency that only deals in health insurance, so they obviously (and horribly) thought it was a good idea to send data about residents' health insurance to a third party.
- autoexec 1y agoI'm sure they did it for money. Those trackers weren't put there for nothing. At least government websites funneling citizen's data to Google by using Google Analytics on their sites can argue that they're just selling out taxpayers to get easy site metrics. When you've got 60 trackers on a single page though, somebody is stuffing their pockets with cash in exchange for user data.
- threetonesun 1y agoI assume some of it was to show targeted ads on social media platforms. I'm sure an internal KPI is new customers, just like any e-commerce site.
- s1artibartfast 1y agoQuick reminder that state of California takes a DNA sample from every newborn and sells it to third parties
- neilv 1y agoFor the last week, LinkedIn kept showing me ads for some specific dental procedure, near the top of my feed. It's an optional follow-on procedure for the dental surgery procedure I had scheduled for this week. I'm much more careful than most people about keeping Web search and browsing history private. But there's a chance that last week I browsed some question about the scheduled procedure, from my less-private Web browser, rather than from the Tor Browser that I usually use for anything sensitive that doesn't require identifying myself. If I didn't make a Web OPSEC oops, it looks like maybe someone effectively gave private medical information to LinkedIn, of all places (an employment-matchmaking service, where employers are supposed to be conscientious of EEOC and similar concerns).
- cm2012 1y agoEven with the absolute incompetence shown in this article (Meta or Google would never make a mistake like this), no one has been actually harmed.
- biker142541 1y agoIf you have a value sliding scale of "actually harmed", then almost no privacy breach harms anyone, right? Is the threshold for harm actually being scammed, physically hurt, reputation damaged? Thankfully, those the law is not based on such thresholds.
- cm2012 1y agoRelative to the actual harms caused, HN freaks about this kind of stuff too much.
- Xplan 1y ago[dead]
- goldchainposse 1y agoPeople like to say "big tech sells their data." This is actually rare. Almost every other company you deal with willing gives it to big tech, and they just hoard it and run ads with it.
- rob_c 1y agoBright to you by the state reinventing gdpr for the American audience another 80IQ moment which will be lauded by some as a brave new world... Get your act together and either resign or stop handling public data let alone the sensitive stuff. I'm serious, draft that letter now.
- bensonn 1y agoIs Covered California a government entity, for profit, non profit, other...? Not that it matters. "Leak" is not the right term. By default a "website" is a 404. Throw some HTML on there and users can see something. Adding LinkedIn tracking is a deliberate choice. Calling the data "leaked" is like saying a raft sprung a "leak" when the person in the raft punctured it 60 times (number of trackers). The data was shared and pushed to LI, on purpose. They (Covered CA) installed LinkedIn's code on their site. The code did exactly what it was intended to do, send data to LinkedIn. A leak is accidental, this was a choice by Covered CA.
- melissabaeez50 1y agoI was diagnosed 4 years ago at age 60. Symptoms were tremor in the right leg, loss of handwriting ability (my normally beautiful cursive writing was now small, cramped printing and a soft voice. I also had difficulty rising from a seated position and have balance issues. I started out taking only Azilect, then Mirapex, and then Sinemet. Several months ago I started falling frequently, hence the reason for Sinemet. During the summer of 2021, I was introduced to Uinehealth Centre and their effective PD-5 protocol. The treatment significantly alleviated my symptoms, outperforming the prescribed medications. My husband says it has done me a lot of good in terms of balance and ability to walk and get up from chairs. I can now write without my hands shaking; I can feel my strength again. I was fortunate to have the loving support of my husband and family. I make it a point to appreciate every day! Visit uinehealthcentre. net