Hacker News Reader

HIPAA has no private cause of action (you can't sue providers who violate your rights under HIPAA). The government can fine them, so from a provider POV they are liable for the breach you propose, but you are not eligible for recovering the $50k.

You may or may not have a private civil tort against the medical provider, separately from HIPAA.

Good point, the fines are by HHS and not dollar amounts to victims. I gave the amounts to signify the importance and IANAL would be part of a basis for establishing harm done.

I specifically linked to an injury lawyer to show the types of current HIPAA violation civil suits that have succeeded. My reasoning is that it’s lucrative enough for lawyers to solicit business.

People talk about the US being lawsuit-happy, but here's an example where the tort system could work to encourage the enforcement of a law if the government doesn't want to enforce it.

As a non-American I am always fascinated by the hacks and kludges that people propose to mitigate the inherent dysfunction that is the US medical system.

I consider intentional breaches of medical privacy to be in the same league as physical assault and as such would expect a society to respond to these kinds of crimes with swift and severe punishments including jail time and fines.

Why not just arrest these people and take the profits from their crime instead of adding civil lawyers and bureaucracy to the mix?

>and as such would expect a society to respond to these kinds of crimes with swift and severe punishments including jail time and fines.

Can you point to any country with a law on the books like this?

The USA. HIPAA states that willful or malicious disclosures of identifiable health information with intent to sell for personal gain have penalties of up to 10 years in prison [0].

But of course that's not what TFA was about.

[0] https://inspiredelearning.com/blog/hipaa-101-guide-violation...

> But of course that's not what TFA was about.

Right, there are criminal penalties possible under HIPAA (I don't know if anyone has actually gone to jail under them) but they explicitly don't apply to the situation I was replying to (or I misunderstood it).

Would a hosital employee be able to make a whistle blower case and recoup a portion of the fines?

As far as data privacy goes, I will say that the sale of health data has some pretty significant upsides--specifically medical research. There's probably a better way to get the best of both worlds, but I would hate for us to just pull the rug out from under medical research without a satisfactory backfill.

Disclaimer: I work for a company that uses this data to match terminally ill patients with niche treatments and clinical trials, and the work literally saves and prolongs lives.

The article mentions the dispute over wether or not anonymized medical record data really has enough of a signal for meaningful research use cases. That has to be weighed against the privacy concern.

Agreed. To be even more explicit, I'm not saying "do not weigh the research concern against the privacy concern".

> I work for a company that uses this data to match terminally ill patients with niche treatments and clinical trials, and the work literally saves and prolongs lives.

Talked with a company that made similar claims about what they are doing, but it turns out they were really ensuring that their users where choosing the medication from the highest bidder rather than the one that was really in the the patient's best interests.

The mental gymnastics they did to justify they were doing what was in the patient's best interests was fun to observe, but in the end they were just a tool of a large pharmaceutical company, exploiting sick people for profit.

Quick cynicism sanity check: who pays your company, your users or the "niche" treatment provider?

If it's the former, that sounds like it's good work.

If it's the latter I would recommend being a bit more skeptical of the business motives of your employer and their customers.

> Quick cynicism sanity check: who pays your company, your users or the "niche" treatment provider?

Insurers. They don’t want to pay for the expensive product.

huh, would that be part of the jewel encrusted platinum insurance plan? Because I've always just assumed that once you started getting into the experimental drug desperation phase - insurance carriers were totally off the hook for the what would otherwise be an infinite increase in their risk exposure. It sure would be nice if there wasn't such a massive asymmetry in pricing data.

Why are you coming at me like I invented cancer?

Why are you so sensitive? Unless you are an insurance provider incarnate - nothing I said was critical of you. Now... if I were to being going after you, I'd imagine it would be because of the hamfisted "Making the world a better place, through <insert profit motivated activity here>." You can just want money, it is perfectly natural in a world full priced things, and I don't imagine the self deception is good for you.

This is just baseless, predictable cynicism, devoid of any understanding of basic economics. Someone is doing good work for society and making money? Insert boilerplate remark about how greedy they must be.

Of course, not only is it distinctly possible to contribute to society and make a profit—it’s basically the only way. In the real world loads of researchers and engineers and other employees aren’t going to work for free to appease random Internet cynics (who rarely if ever make positive contributions to society of their own, mind you), so capital is required which entails investors and returns on investment. Yeah, that means insurers or someone else paying money.

Looks like I was right, you're clearly so emotional invested that you've failed to notice how you just repeated what I wrote... but with greater verbosity and the kind of angry tone that makes an opinion so easy to dismiss.

How about the person being asked if they will provide their data. It’s not hard.

> It’s not hard.

It's surprisingly hard, which is why there is a cottage industry built up around it for clinical trials.

Regardless, getting informed consent for data acquisition is great if you are doing a clinical trial or really looking forward, but for a lot of things you want a ton of retrospective data that can be difficult or impossible to consent.

It's a hard problem. I hope in the future it will be an easy problem, but we aren't there.

> and the work literally saves and prolongs lives

I have literally yet to see a medical-adjacent company not default to assuming they’re on the moral high ground.

When I see companies say “we save lives” my initial reaction is no different from companies that say “we hire the best” or laws that “are for the children”.

Yeah, I mean it sucks. Investors want returns. Employees want competitive salaries. There’s lots of greed in the world. I don’t have any answers for you, I’m just trying to help really smart people move the needle on this cancer thing and yeah, I like that I get paid competitively.

Totally. And I didn’t mean to call you or your company out specifically. Actually sounds interesting.

Maps Street View of 1428 Bush St, San Francisco is more of what I have in mind. But maybe I’ve just passed that building one too many times.

Sale of ad data has upsides too, greater products and targeted advertising. The greatness is kind of asymmetrical, similar to the scenario you describe.

Marketing drugs better isn’t exactly saving lives. Researching drugs should be done through IRB and include patient consent. Of course, there’s great benefit to bypassing ethical controls, but they are still worthwhile.

Upside or not, these folks may soon learn they lose more money in fines than they make from their revenues

I like your idea of a class action lawsuit but wouldn't the $50k per person penalty shift your idea of what an organization would consider an acceptable risk? 1 million * $50,000 is probably not acceptable.

I hope for all our sakes you are in the business of buying de-identified medical data :)

I think this has the potential for the next asbestos or tobacco or opioid payouts. I definitely wouldn’t want to work in this area (both for ethical and business model at risk for sued out of existence).

"Since these data are deemed de-identified by expert determination [0] and that’s hazy, if I could reidentify myself after de-id, and I didn’t authorize it, then I could be eligible for breach damages for HIPAA violations up to $50k per person"

The Expert Determination data would likely be released to you with an agreement that you would not attempt to re-identify the data. So if you then attempted to re-identify the data, even yourself, you would be breaking the terms of the license and I would think liable to civil action from the entity that gave you the data (and their upstreams). I don't think you would win here.

I don't think provisions like HIPAA alone cannot prevent abuse of medical data, Say a free medical-consultation app along with health tracker from a health insurance provider can provide data to the health insurer which can further be used in a flawed algorithm to increase premium or worse cancel the policy when it's most needed.

Conflict of interest regulations should be applied for data, If my data can be used to cause harm to me then you shouldn't have it that's all.

Ta-da

https://www.nytimes.com/2019/07/23/health/data-privacy-prote...