Hacker News Reader

Comment by ascotan | Hacker News Reader

I don't understand how this isn't a violation of HIPAA. Comparing a DNA upload against the medical records of other people without their express written consent seems to me to be wrong.

I think there is a legal issue here around wether uploading your medical data to a 3rd party service allows that service to take ownership of your medical data and allows them to do what they please with it.

DNA absolutely falls under PII (personally identifiable information). I can't understand how a company to collect and use this information without (it appears) any rules or regulations.

Not only is it a security risk and a privacy violation but it has implications for every aspect of your life and the lives of your children and immediate relatives. I can't understand how this can be run out of someone's house with a part time volunteer staff with no security.

Mind Blown.

View on HN

The people give their consent, but what maybe actually is surprising is how the police went about it according to the GSK LATimes podcast.

Police made a fake profile online with the killer's DNA. At first they got a match for a relative. It turned-out it too was a fake profile created by another LE agency with the GSK's DNA.

This is not illegal.

I wonder if they violated the website's terms and conditions by creating a fake account and uploading somebody else's DNA (not that this would be necessarily be illegal).

I suspect law enforcement agencies don't have to worry too much about violating the terms and conditions of a service they're using for an investigation.

At worst, their fake account gets closed by the site and they have to go through proper channels if they want to proceed further.

By creating a profile and uploading your DNA -- you're giving consent for your DNA to be indexed.

Whether or not you should be requiring the consent of all people with similar DNA is the real question -- but given Americans' obsession with individual rights I don't see it changing. In their eyes, why shouldn't they be permitted to upload and share their own DNA?

I know it was a rhetorical question, but because of negative externalities. Same reason I can’t dump pollution in the river that runs through my property, because that polluted your property downstream.

That seems like a much better legal analogy. If anything, this should probably be considered search and seizure without a warrant. That would make the evidence inadmissible in court. Or we carve out searching DNA databases as outside of that amendment. That actually makes more sense to me as even your dna is no longer yours once it’s in the public domain on a hairbrush at the dumpster. IANAL.

The only externality demonstrated is catching the Golden State Killer.

Most of your DNA is not your own.

So this isn’t about sharing a selfie, this is about sharing a group photo, where other people are partly out of frame, but you can still make out who they are. And if we stitch together enough photos, we can make out a lot of people, people who never even took a photo.

Although, some would be sharp to point out that in the case of a selfie most of your facial features are also not your own. So it’s mostly a question of where we draw the line as to what is personal and what is shared. But in the case of a murder, if we had an actual selfie of the killer at the scene, we would be able to solve the case fairly quickly using standard investigative methods.

It's exactly like not being allowed to share your selfie because you look too much like your mom or sister.

I said that in my second paragraph. I also said it’s a question of where we draw the line as to what is personal and what is shared. Do we consider a selfie personal or shared? In 2019, we consider it personal.

Yeah, that's the tricky thing. Individual ownership of information as a principle doesn't cover the set of all things people care about when information is shared between individuals (or infer-able about another individual based on information of a sharing party).

HIPAA is not a blanket protection applied to medicals records but rather restrictions on some companies and personnel that often work with them.

Simply if they aren't a "medical" institute and you give them your health data it's theirs to do what they want and HIPAA plays no role.

https://www.hipaajournal.com/who-does-hipaa-apply-to/

These organization often sell genetic screening services, and I don't see how that is not providing medical services.

> These organization often sell genetic screening services, and I don't see how that is not providing medical services.

HIPPA only matters if the organization deals in medical insurance. Most people are surprised to learn this fact.

Aside from that claim being trivially proven false[1], I worked in biotech for more than a decade and this is just wrong.

[1]: https://www.healthit.gov/faq/who-must-follow-hipaa

I actually am on the compliance team of a HIPPA covered entity, and your link does not disprove my point.

> Most Health Care Providers—those that conduct certain business electronically, such as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists.[0]

My gym nor personal trainer are covered by HIPPA as just a simple example of health-adjacent businesses for which HIPPA provides no recourse.

> Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards. Generally, these transactions concern billing and payment for services or insurance coverage.[1]

[0]: https://www.hhs.gov/hipaa/for-individuals/guidance-materials... [1]: https://privacyruleandresearch.nih.gov/pr_06.asp

What is your definition of "deals in medical insurance" exactly?

Entities that bill insurance. Here's some pretty plain language about it:

https://personcenteredtech.com/2013/05/16/am-i-a-hipaa-cover...

Like I said, most people are very surprised to learn this fact.

>Entities that bill insurance

But that's not true. Third parties, companies which do not in any way "bill insurance" or may not even provide healthcare services directly may be considered a covered entity.

>Entities that provide data transmission of PHI on behalf of a covered entity (or its business associate) and that require access on a routine basis to that PHI (such as regional Health Information Organizations (HIOs)) are considered to be business associates under HIPAA

The original point was around genetic testing services. [0] As an example, take 23andme. I know that they take pains to use language that would disabuse a reader of the notion that they were providing medical advice. [1] It seems that 23andme did not accept insurance of any time until after May 2019. [2] I don't know if they are seeking to become HIPAA-compliant now that they ostensibly interact with insurance looking for HIPAA anywhere on their page or various policies turns up nil. Contrast that with someone like Smile Direct Club (page title is "Privacy Policy - HIPAA". [3]

Regarding the BAA exception, if you ever signed a BAA it becomes clear that your interactions with the other party to the BAA are HIPAA covered, even if your normal course of business is not. If a covered entity sends you PHI and they didn't have a BAA in place prior, that would constitute a breach.

[0]: https://news.ycombinator.com/item?id=21465420 [1]: https://customercare.23andme.com/hc/en-us/articles/115013843... [2]: https://customercare.23andme.com/hc/en-us/articles/360026466... [3]: https://smiledirectclub.com/privacy/

When you upload to GEDMatch.com, you are agreeing to make your DNA available to be compared against others for identification or research purposes. That's the entire purpose of the service.

"research purposes" sounds pretty benign though. Most people don't mind helping out some scientists for some intangible greater good. On the other hand if it was phrased "so we can pin crimes on you or your loved ones" people might not be so keen.

> I can't understand how this can be run out of someone's house with a part time volunteer staff with no security.

But that's the promise of software and the internet. The ability to compete globally with minimal effort.

Uh...I think HIPAA might be the most misunderstood law in America.

As a general rule: if it's not an insurance company or medical provider (who accepts insurance) HIPAA does not apply. Hint: the "I" in HIPAA stands for insurance.

Just because you emailed your great aunt to tell her you have the flu doesn't mean HIPAA suddenly applies to Gmail.

> I don't understand how this isn't a violation of HIPAA.

HIPAA only applies to "covered entities" - basically if you don't accept insurance, you don't have to be HIPAA compliant.

HIPAA doesn’t extend beyond certain health care boundaries. Disability insurance for example aren’t bound to HIPAA in any way. Once you give them your medical records they can do what they like with it.

Reply on news.ycombinator.com