Hacker News Reader

> and TONS of platforms wanted to warehouse this data. My coworker and I were there looking for exactly those sorts of things, and it was great to see so much.

As I read your comment, I had a growing expectation that you were about to express horror at the mass gathering and warehousing of individuals' health data. I was very surprised when you expressed such excitement at the prospect.

Your doctor already captures this data.

In real time and willing and able to sell it to whomever bids more?

Well yes in some cases it is in "real time", but do you know of doctors offices caught selling health data? That seems wildly unethical, and also very illegal. I'd imagine anybody caught doing that would be in jail.

My point was that your data is safer with a doctor's office then with a "platform":

> And while you might assume that this information is legally protected the same way your hospital and medical records are, that’s not necessarily the case.

https://www.consumerreports.org/health-privacy/are-health-ap...

Can you be specific about what you're trying to get at here?

I don't understand why you think there is a difference between taking a health reading at your doctors office and having it included in your patient chart, or taking a reading at your house and having that included in your patient chart. I'm wondering if I'm missing something that is just being unsaid.

I think they are just saying the data is more likely to be secure if it is recorded at your doctor's office, which seems reasonable to me.

Let's say it is a blood pressure reading taken by your Fitbit and uploaded to Google's servers. That data is not subject to HIPAA regulations. When your doctor takes your blood pressure and records it in your chart, it is subject to those regulations (as you say, it would be wildly unethical for them to sell it).

Separately, even if the two scenarios were subject to the same regulations, I would still expect the doctor's office scenario to be more secure. I think that any given patient's home network/device/security practices are more lax than those of most healthcare organizations.

>That data is not subject to HIPAA regulations.

You can be HIPAA compliant and on Google servers.

https://cloud.google.com/security/compliance/hipaa/

The point wasn't that they couldn't be HIPAA compliant but that they don't have to be.

There are downsides to this too though. I wanted a second opinion on an EEG, and after some hassle getting the original office to mail a disk (the only way they can transfer it), the new doctor said they can't view it because they use different software at their hospital for EEGs. These are two well ranked US hospitals, and EEG is a fairly common procedure.

Perhaps this is not an inherent downside to the data security, but it's a reality with the current medical system and regulation does play a part in how we got here. And there is no financial incentive for hospitals to fix these sort of issues, in fact there is a disincentive (I'm doing another EEG now...). So I just don't see how it gets fixed without some outside disruption.

It may not be a popular opinion on HN but I'm much more concerned with having access to my own medical information than how secure it is.

"Separately, even if the two scenarios were subject to the same regulations, I would still expect the doctor's office scenario to be more secure. I think that any given patient's home network/device/security practices are more lax than those of most healthcare organizations."

For the most part security for healthcare systems is like security for government systems. A lot of checkbox marking and little real security. Just look at the large number of successful ransomware attacks against healthcare organizations. Having at one time worked in health informatics and from observing the practices at my healthcare providers I am not confident my data is anymore protected at a doctor's office.

Yeah that’s fair, I do think organizational ineptitude is a concern. I guess it’s just different threat models. A medical office has locking file cabinets, password-protected devices/networks, more robust building security, the standards of hipaa, etc. (granted all of those are subject to proper implementation)

If I needed to get one person’s medical information, I think I’d I have a higher likelihood of getting it from their medicine cabinet or snooping on their devices or search history.

If I needed the information of many people, I’d target the doctor. But even then, the goal typically isn’t to leak anyone’s information, it’s to get money from the healthcare provider and the information stays secret, theoretically.

Not really disagreeing with you just rambling.

Maybe I misunderstood you. I thought your point is that it doesn't matter if a third-party platform has patient's data because their doctor's office already has it.

A device that measures your blood pressure and sends the results directly via an encrypted connection to your health care provider can be very useful, certainly beats lying in a hospital bed with a printout that the doctor checks every few hours.

They key thing is, as always, ensuring that your data remains your property. Europe is bigger on that than the US.

Not only do they sell it, your Insurance company aggregates and sells it, as does your pharmacy, and anybody else that can get their grubby little hands on it.

Many health systems sell “anonymized” health data that fits the HIPAA description and is completely legal.

So if your doctor is part of a larger health system or uses an EMR system odds are that all your data is bundled up and sold. It’s not identifiable easily, but is still sold and used.

If you acknowledge the threats, you should acknowledge the opportunities as well. Expressing "horror" every time data is mentioned in connection with health data is a very one-sided reflex. Surely, there are challenges, but why not solve them?

Completely agree. A lot of suspicion out there; a balance with optimism is important

> Expressing "horror" every time data is mentioned in connection with health data is a very one-sided reflex.

Good call. It was a mistake for me to post such a once-sided comment.

> It was actually a bit depressing to see how much stuff is available, just not available in the US

One reason for this is strict regulations. U.S. FDA Title 21 CFR Part 11 is very strict as to what a medical device company needs to do, and it's not easy to meet those requirements. Most people do not realize that even in the early startup stage, if you build something that is a medical device, there are rules to follow (mostly about traceability: you have to know what you've built, using what parts, and where those came from).

Shameless plug: I am the solo founder of PartsBox (https://partsbox.com/), which helps a lot with managing traceability when building electronics.

I would be interested in knowing more about the tradeoffs between their system and ours, if you could expand a bit?

What do you mean by "their system"?

Similar restrictions exist in the EU, Canada and Japan — I'm not familiar with the rest of the world. I suspect developing new products in China is much easier, and you can showcase them anywhere.

Yep. This was my major takeaway. There is so much incredible opportunity there, but the regulators are in the way.

Any idea how this BP device actually works? Is it optical? How is it possible to measure without a cuff?

Read the article? You pinch it I think. Put it on your forehead for temperature

I guess this is the underlying tech: https://www.leman-micro.com/wp-content/uploads/2020/11/LMD-W...

So the pressure is just measured with a MEMS (microelectromechanical) device, the temperature with a different one, and there's also a pulse oximeter (optical).

There have been IoT connected blood pressure monitors, scales, and smart watches with SpO2 monitoring available in the US for years. Check out the products from Withings, Garmin, Apple, etc. What exactly are we missing?

That most of them aren't FDA certified, and can't be used for diagnostic purposes. These things are mostly marketed for "fitness".

(This at least was one of the major hurdles we faced. Maybe the regulations have changed in the last 4 years or so. I'm not in that space anymore. The recommendation to go check out medica is still valid though. It's really cool!)

Sounds amazing. Wondering if you could shed some more light on what's possible these days with IoT health devices? I've been a bit out of the loop on these developments

Unfortunately I haven't been in that space for a while. The parent company to the project we were working on got acquired, and they didn't pursue our project.

We were trying to bring connected health/predictive analytics to a larger, existing healthcare company.

It's just like the condition monitoring and predictive maintenance market, but for humans.