Comment by throwawayhlthcr | Hacker News Reader

Comment by throwawayhlthcr | Hacker News Reader

Parent Full thread

throwawayhlthcr

While it's not sure what Google is doing here, I can tell what most companies in the healthcare data space do when dealing with data like this - they use an external vendor to essentially encrypt the "personally identifiable data" (mame, exact dob, etc) into some hash tokens before the data hits their servers from the partners. This would mean the data is still tied to a patient but not easily identifiable (at least some orgs would run reidentification risk analyses based on the types of data available within the org). It would also mean that an org like Google can (assuming it chooses to) still work with healthcare data without explicitly tying it to all their other data in a legally compliant manner.

Maybe a HIPAA expert can chime in but I'm reasonably sure it will be a violation to show you ads on your devices based on your personal healthcare data that Google obtained without your explicit consent. It might however be legal if Google uses all the patients healthcare data to train a model that it can use on all users, though.

There would definitely be a BAA in place between between the providers and Google. My business has one with Google for hosting our cloud data. You know those forms you sign about HIPAA when you visit a provider? One of the things they say is the provider will only share data when a BAA is in place - well that the HIPAA rule:

"The Privacy Rule allows covered providers and health plans to disclose protected health information to these “business associates” if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule."

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...

If Google is getting Protected Health Information (names, addresses, dates, etc.) from providers then they have to sign a Business Associate Agreement, which effectively makes them a covered entity under HIPAA. They would be criminally liable for any misuse of the data, which would include using it to inform their advertising.

Using the data to create a model for use at the providers would be a clearly proper use of the data. That's standard practice across the industry.

What about Google employees looking for damaging data on adversaries? Or stalkers, looking for information on particular individuals without consent.

Why does Google get PII?

To take your argument to its conclusion, what if someone at Ascension wanted damaging information on one of its patients?

They'd be legally liable. Same as those they sign BAA with.

Those are both illegal as well, and the employees who did that would be held personally liable.

There would definitely be a BAA in place between between the providers and Google. My business has one with Google for hosting our cloud data. You know those forms you sign about HIPAA when you visit a provider? One of the things they say is the provider will only share data when a BAA is in place - well that the HIPAA rule:

"The Privacy Rule allows covered providers and health plans to disclose protected health information to these “business associates” if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule."

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...

Reply on news.ycombinator.com