Hacker News Reader

Comment by nathan_long | Hacker News Reader

> To ensure Uber Health meets HIPAA standards, we have been working hard to develop, implement, and customize numerous safeguards.

The stories I've seen about employees tracking individual riders lead me to view this skeptically.

View on HN

I would bet they have put access restrictions on these because violating hippa can be a felony whereas in general there are 0 legal requirements to restrict access to internal data to a company generally.

I'd say I'm still skeptical because they have a history of skirting the law. Fool me once...

idk I feel like the days of Uber fucking up are getting past us with changes in last 6 months. YMMV.

I do fully admit that I haven't been keeping up to date on their latest changes, so that may be true. But IMO, 6 months isn't nearly enough time to forgive the major fuckups that they've been doing

They fired basically every executive and the new CEO has been building the c suite from a fresh start. He’s made a bunch of good moves so far and seems like a mensch.

But the new CEO still failed to disclose an enormous breach for months.

It’s not fixed.

What in the world are you talking about? As soon as he found out about the 2016 breach, he ran an investigation, found that the chief of security was responsible, fired him, and then came forward to the press about it.

IMHO, that couldn't have been handled better.

Really? You’re aware that people have had their information compromised, including driver’s licenses, and you do an “internal investigation” for months before notifying them? No, you patch the hole and let them know, not wait until you have a scapegoat for better PR.

And Aug 30 to Nov 21 is very much “months”.

Aug 30 is more like "job start date", not "you're aware that people had their info compromised".

This convo sounds like when folks were jokingly asking Dara the week after he started the job if he had fixed all the problems in the company, made it profitable and ready for IPO yet.

Considering that the timeframe in question would be probationary period for a normal person in a normal job and that the guy was jumping into what was effectively a burning transcontinental train wreck, I'd say getting an investigation completed and disclosed within a few months of his job start date is actually pretty commendable. By comparison, it took like half a year for people to see anything come out of the Holden report, and timeframes for resolution for some historically big scandals in other companies have taken far longer (e.g. the Equifax one is still making news with bigger and bigger impact estimate corrections).

Also, I find it curious that you think Joe Sullivan was made a scapegoat out of convenience, since there isn't a single news article about him complaining of being fired unjustly. You'd think news orgs would be all over such a story.

The point isn't that he was outed as only a scapegoat. The point is why you'd spend time waiting to see who you should fire before letting your victims know.

> why you'd spend time waiting

It's not like Dara walked into a whiteboard in the CEO office that said "list of 2016 suckers lol" and then sat on it twiddling his thumbs for a month. My understanding of the incident is that it had been covered up by Sullivan and TK. In my mind, an investigation is precisely for figuring out what the hell happened, who was affected and to what extent.

I don't know the specific details of this investigation in particular, but for the Holden one, it involved a lot of one-on-one interviews with various employees to try to reconstruct the stories of each harassment claim so that an appropriate punishment/course of action could be determined for each case. If this investigation was conducted in a similar manner, it wouldn't surprise me that finding out the blame would occur in tandem with discovering the extent of the breach.

new CEO joined Sept 2017, breach was disclosed in Nov 2017

it's more than 1 month, but "months" is a stretch here

Mid-November. Two months is still months, but I can see it leaving an impression of being longer than it was.

I feel like there has been evidence to say that for the past three years, yet they keep screwing up.

Al Capone was convicted on tax crimes, could this be the way to get Uber?

Uber has comparative advantage in making itself a difficult target even when there is a strong legal case that they broke the law.

HIPAA violations would have the federal government on the quick.

It’s not a “delay and get people to show up to town hall” sort of issue.

People always repeat this idea that HIPAA is the most serious of all the serious regulations, that you most definitely do not want to violate.

Yet I’ve never heard of a major company fined or punished for HIPAA violations. Have there been any such notable incidents in the past few years?

There are plenty of incidents every year. Just this year, there were 2 already:

https://compliancy-group.com/hipaa-fines-directory-year/

I bet Uber is quaking at the thought of a $3.5 million fine.

They lose like 1000x that per year.

You probably make over 100k/yr if you're a software dev in some major city, but I'm sure you wouldn't want a $350 traffic ticket, right?

This is a poor comparison and I hope you can understand why. If not let me know and I can clarify.

Sure, it is, insofar as a corporation cannot physically quake in its boots. A fine is designed to discourage an entity from doing bad things. TFA says Uber is working with Clearwater, which indicates to me that the incentive of a potential fine is working as intended.

One can try to argue that uber is lying about its hipaa compliance efforts in order to save the few hundred thousands that they would be paying Clearwater and in dev costs, and one can counter argue that that accusation has no reliable sources to back it up and is fueled by a desire for internet karma points.

HHS prefers not to use civil monetary penalties, but they hit when they do: https://www.hhs.gov/hipaa/for-professionals/compliance-enfor...

It's serious. I've worked in biotech and healthcare my entire career. The FDA is also not to be toyed with.

It’s serious stuff. One violation could easily destroy a startup or small-to-mid sizes software company.

But Uber is neither, and has a clear, repeated history of disrespecting any hard or expensive to follow laws.

So if a company stores medical history data it's only required by law to prevent the data from leaking to the public? It's okay if a system administrator employed by the company has read access to people's medical records?

sorry if i was unclear. if a company is storing medical history data that falls under HIPPA which is serious.

If a company just has data about you that is not medical data then there is no legal requirements as to who can have access to it internally. (So Joe's Sprocket's has a list of everyone who has bought sprockets and their phone numbers - anyone in the company could look at that info and there would be no legal implications)

I see. I think I misinterpreted the "0 legal requirements" part of your comment. It gave me the impression employees not involved in the care could access medical data. Thanks for clarifying.

No. Anyone internal to the company viewing medical data without an explicit need is in violation of hipaa.

But I don’t think that’s what the poster was saying.

I see. I don't know the details of HIPAA but that seems reasonable. What kinds of needs justify use of the data?

One example. A friend of mine who works at a hospital told me about a colleague (a nurse) who looked up her own test results since she was anxious and could not wait using her login to the main system (for providers). She got flagged in the system and reprimanded. Every access is logged.

it's worth noting for others that this was almost certainly a hospital policy violation, not a hipaa violation. There's nothing in hipaa that prevents a person from accessing their own record (though I have heard hospital administrators try to claim otherwise).

You need to be part of a patient’s care team, using that data to further their care. Any other access is a violation.

Med students get a little grey area on this because their job is to absorb as much info as possible without necessarily providing care, but even they shouldn’t venture outside the census of their supervising physician.

That's absolutely false. Many other people need to be able to access the data just to keep systems working. I've worked in a HIPAA environment (as well as FDA class 1 / ISO 13485) for nearly 15 years now.

Also, many companies who deal with medical data, but are say startups but not an actual healthcare provider gets audited for compliance - and it is fairly rigorous and so think of it like a SOX audit, but even further. Some companies have dedicated rooms with limited, tracked, badge access to the machines in that area which are the only machines that can access the data.

So if any breach occurs, access can be tracked to individuals.

So programs are allowed access to the data, provided they are audited?

In my country, one programmer who unfortunately lost his newborn daughter to sepsis decided to make a machine learning program to help doctors diagnose the infection early. The software has access to patient data and it recognizes patterns that match the development of sepsis. It decreased the number of severe sepsis cases per month from 1.5 to 0.5 and cut the waiting time before effective treatment was administered by 60%.

People have told me this sort of system would not have been impossible in the USA because of the HIPAA. Is this true?

These types of programs do exist in most insurance companies in the United States. Predictive analytics against claims and clinical data to do early intervention care management is a common thing here.

That said, the company has to make sure that only the people that have a clinical need to access the data have access. So the developers would probably use a de-identified data set to write and test the program. Only the clinicians (care management and disease management nurses) would have access to the identified data so they can contact the patient to offer care.

Yep - de-identified data is the best way to assure compliance when developing/working-on/dealing with large sensitive data-sets.

that said, compliance audits are pretty strict if they are doing it correctly, and not-so-fun. It will be an interesting world when there is a medical-data-firehose pointed at an AI that is looking at all the available med records to do predictive analytics against an entire population....

We are likely a decade from that.

I think there would be significant challenges to do so. I think this is one of the reasons why google's health care initiatives in the US failed so horrifically and one of the reasons why their deepmind NHS initiative is with the NHS and not someone in the US.

Uber executives have specifically stolen health records from a patient in order to attempt to create a media frenzy about how an Uber passenger who was raped by a driver was actually liar and a cheater. Uber executives went on a long-haul journey to insanely attempt to ruin the life of one of their customers, who had already been raped by one of their drivers, by stealing her medical documents and ridiculing her in public. No thanks Uber.

There is absolutely no way I would use this service.

Edit: It should also be remembered that Uber hired this driver, the rapist, as a known rapist (a recorded criminal history of being convicted for rape). Uber hired him without caring about his background or past criminal behaviour. Uber hired him with the knowledge that he could well be a rapist, since they declined to do a simple background check, presumably because it would "take too long" and they consider the occasional rape just a part of doing business. The evil behaviour and willful disregard for the safety of their normal Uber passengers - before trying to ruin their lives with deception, theft and lies - makes it 100% impossible to trust them about anything ever again, especially personal health.

#DeleteUber.

I'd like to agree with your position but in the current environment I can't. Uber is a shitty company, I can get on that bandwagon and ride it to the other end of the continent. But in my country, America, this sort of service is immensely valuable to the elderly community and yet there is a dire shortage of acceptably priced choices to provide for those peoples' needs. If Uber's service is priced better than the entrenched players then I'll sign that pact with blood.

Allowing bad behaviour in order to get something cheaper is IMHO the wrong way to do things. If you want to look at why everything is so expensive, look at capitalism and all of the for-profit layers people add to cost structures - extracting value from society and adding a constant negative pressure to the quality of everyone's lives; whether the amount of extracted is reasonable or not is what needs to be looked at in each case. A certain minimum of transportation should likely be a right.

> A certain minimum of transportation should likely be a right.

What sort of transportation? Are you talking about based on income level? Age? Could you clarify?

I agree with your point about minimum transportation as a right. I'd support that ballot. But I don't think it's fair to blame capitalism in an environment where there's only a handful of entrenched players. When I was helping care for my grandfather there were only four services in our area that could take him to doctor appointments if we couldn't and they were all generally expensive unless we used the volunteer service which was free but extremely unreliable because of the sheer number of people they were trying to service.

Obviously my experience is anecdotal, so I'd be interested to see if similar patterns are true elsewhere. But when there are so few companies competing with each other it seems a lot more likely that there's some sort of regulatory burden or capture in play rather than simple greed. Capitalism might explain why a service with few competitors is expensive but it doesn't explain why there are so few competitors to begin with.

>But I don't think it's fair to blame capitalism in an environment where there's only a handful of entrenched players.

This is literally the endpoint of Capitalism without regulation to prevent monopolies and a floor of public goods. You absolutely should blame it and those who fail to either check or dismantle its power.

Throughout American history, corporations have explicitly undermined and destroyed public transportation so they can profit from it. That’s why things are so bad. First they did it to sell individual cars and now to sell taxi services. Uber’s express ambition is to become the transportation monopoly you decry.

>First they did it to sell individual cars

No, they've been doing this since at least railroads, the OG monopolies

Good point!

I think you're right that I was too general but I still disagree in this context. I agree with your premise that free market capitalism is vulnerable to monopolies. But healthcare services in the U.S. are so heavily regulated that it's difficult to see how capitalism could be the factor limiting competition in this context and not the regulatory environment. That doesn't mean that the environment needs to be removed, but I do think it could be better optimized.

We're quickly derailing from my initial point though, that however things got here I think Ubera new service has the potential to relieve a lot of people in a market which I believe is inadequately served at the moment.

HIPAA violations can cost a lot of money (up to $50,000 per record, depending on the severity level). A single incident can cost a few million dollars in fines, so there's a _very_ strong incentive to do things the right way.

Uber has strong internal data access controls at this point, and any user data access need a ticket and a justification before accessing.

I would never trust Uber with something like this.

After nearly a decade of lying, cheating, intentionally breaking the laws of various countries, spying on paying cusomters, spying on other people, aggressively attacking and spying on journalists, of attempting to discredit victims of rape by Uber drivers, harassing their competition using illegal tactics and lying about it, etc,

I don't care if they have "strong internal data access controls". They should have had that Day 1, they should never have lied or cheated and they certainly should not ever expect anyone to trust them about anything ever again.

First, I doubt that it's true that they have strong controls. I don't trust organizations that have such a long, clear and bragging history of lying.

Second, that sounds like the Titanic being unsinkable. As if I'm going to trust Uber with personal health data - they are the first group I'd suspect to try to sell that data under the table, the first group I'd expect to abuse the power, and also the first group I'd expect to suffer internal leaks or external hacks.

No way I would trust this given the very recent and abhorrent behaviour of the executives at the company.

Edit: Also this,

> and any user data access need a ticket and a justification before accessing

is not secure. Sounds to me like any user can make a ticket and create any justification they like. This is like the NSA saying "any user of our PRISM system is logged and watched" - but what happens when millions of tickets are going through? Is each one actually being carefully inspected for abuse? If Uber executives are in charge of this decision then no way do I trust it.

What you probably don't know is that this is a problem with almost ALL tech companies in general. Early Facebook engineers can look up ANYONE's personal information. Same with Google. There was an article a couple weeks back about accusing Lyft employees of doing the same thing. This is the problem much bigger than one pre-ipo transportation company.

It will definitely take time for Uber to earn trust back, and it is fair that you feel the way you do. Hopefully Uber will earn your and other people’s trust through us showing over time that we continue doing the right thing.

My intention here is not to go into details, which would not be appropriate for me as an engineer that doesn’t work on those aspects. I am only saying we care a lot about this.

I'm not sure Uber ever had any trust to begin with. As far as I remember, they started off doing shady and illegal things while being rude, demeaning, unsafe, aggressive, etc. They'll never 'earn' any trust either, not from me, as they've done way too much damage without any semblance of humanity, even today.

There are so many alternatives to Uber that are better, safer, and even cheaper that there will never be a need to use Uber and they will never get any trust. The people up-top there have been so thoroughly evil for so long and the damage they have done so great that I have no interest trusting them ever again.

Edit: You downvoters have downvoted me so much I'm no longer allowed to reply or otherwise talk on HN. Goodbye.

You clearly have some very visceral opinions about Uber and I'm sure nobody would be able to change your mind, but when the parent is saying that it'll take time for Uber to earn back trust, I think it is in the same sense as what happened to Microsoft.

There was a time when there was a lot of animosity towards Microsoft, but over the years, younger people that had not been exposed to the drama grew up with a more neutral stance, and many many years of not-really-dramatic developments means that nowadays, people only really think of Microsoft as the company behind MS Office, XBox, etc and not so much about what its ethics framework looks like. Obviously you can still see people referring to it as M$ and similar and making fun on windows users, but it certainly isn't _common_ for average people to outright _hate_ Microsoft on ethical grounds.

Wait, people trust Microsoft now?? I don't see their pushing of Windows 10 and it's phone-home features as being entirely ethical...

Oh come on. A five minute googling session will give you various articles talking about what telemetry was designed for and that the backlash was largely a storm in a cup of water based on ignorance and misunderstanding of the technology. Curiously, I've never heard anyone hate on Apple over telemetry.

Yes, it really is common to hate companies that make your life needlessly hard, or act in poor faith as general practice.

Uber, Microsoft, Enron, Blackwater, Comcast, Oracle, all get plenty of hate, even from non techies.

Any links to these stories, I’d like to read some.

I’m sure there are people at Uber who are fascinated by seeing where celebs take ubers... and can’t blame them.

Really? You can't blame them? For wanting to and then actually executing illegal methods of spying on someone's private life? I absolutely blame them. That's abhorrent behavior.

Here are some juicy stories for you to read if you want to know the details of all the kinds of stupidity and evil it takes to invade someone's privacy like that.

https://www.revealnews.org/article/uber-said-it-protects-you...

I didnt say it was OK - im saying "i cant blame them"=="I understand humans, and this is not a surprising outcome from having access to that data in a company known for sexual mis-conduct, crazy ceo egoist stories and illegally accessing an employees medical records, etc etc etc"

So blame was the wrong word...

now their creepily stalking methods will allow them to know when someone famous or a loveint is sick

Reply on news.ycombinator.com