Hacker News Reader

Comment by caymanjim | Hacker News Reader

I have a semi-related anecdote about surprises from devices.

I use a CPAP. After a year, I went back to the doctor for a followup, and was asked to bring the SD card so they could review the data it collects. The device records the times and duration of use, various settings, and some metrics on breathing (apnea events, etc). I knew it recorded this stuff on an SD card.

I brought the card to the appointment, but the doctor said "I don't need that, I have your data here." It turns out that the CPAP contains a cellular modem, and it phones home and reports in real-time. I had no idea this thing was recording any data at all. It wasn't verbally disclosed to me by either the doctor or the equipment technicians. I imagine there's something buried in the fine print of the (long lost) documentation, possibly even in the fine print of some form I signed, but I was caught off guard and none too pleased.

I've since done some research on this and discussed it with my new doctor when it came time to get a new CPAP. The doctor acted surprised by me having a problem with it. She immediately jumped to the defense of the manufacturer and insurance company, claiming that they "needed" that data. She said that if I disabled it, insurance would refuse coverage.

This is insanely invasive, even with disclosure, and ought to be illegal without explicit, obvious verbal and written disclosure. The insurance defense is complete bullshit. For one, I paid cash for the CPAP because I had a high-deductible insurance plan and would have had to pay out-of-pocket anyway (and never claimed it even for the deductible offset).

I realize a CPAP isn't a fridge, and there's at least a case to be made for insurance enforcing compliance (at least when insurance claims are involved). I don't agree with the undisclosed enforcement mechanism, nor do I agree that treatment should be contingent on monitoring (it is for some other treatments, but not for most; no one is monitoring diet, exercise, drug use, cigarette consumption, or other risky behaviors, and threatening to withhold treatment for non-compliance).

Anyway, I've ranted enough, but there's a serious problem with the normalization of surveillance technology.

View on HN

I agree that this is both invasive and a huge violation.

My wife had pretty severe sleep apnea in the third trimester of her pregnancy, two experiences that make me think this practice needs to be nuked from orbit.

1. We properly read the manual for the device and adjusted the pressure so that it didn't cause problems with burping/ingesting air during sleep. Tissue gets softer in women as they near birth and the body releases a whole host of different hormones - one that gets softer is the pharynx which keeps air out of the stomach as you breathe.

After three days - They had the gall to call and inform us that they had noted the change and reset our settings. We had been tracking sleep events on the device ourselves and they hadn't changed (still ~1 per hour while using, the same as the original pressure setting) so there was zero reason for them to do this.

2. After she gave birth, her sleep apnea essentially disappeared (at it's worst it was ~40 events an hour, 3 weeks after birth it was essentially just light snoring again). Did not matter at all - They insisted she use the machine still. Called repeatedly and harassed us.

---

It took written revocation of their rights to treat us, and then the threat of a lawsuit before the calls stopped.

This needs to be illegal - NOW.

Wow! Im speechless and a bit afraid of what’s to come from the IoT/medical/surveilance industry

This is really disturbing and it's disgusting how some companies out there act. We desperately need our leaders to address issues like this but they're all too busy pandering to and being lobbied by the very companies who are doing the abusing...

Let's generalize this statement - we desperately need leaders. Our current crew of so-called "leaders" are only interested in lining their pockets.

Careful. That sort of thing is endemic with leaders in general. A simple swap / "revert to mean" isn't going to help. It's like pressing the reset button on a smart TV where it just turns back on all the ads, lag, saturation, and edge detection filters that you spent hours figuring out how to disable when you first bought it.

What are your qualifications for fiddling with medical equipment?

Their device, their business. People don't need to justify what they do with their things.

"We properly read the manual"

Well - In this case my qualifications were following the manufacturers clear instructions on tuning pressure in the manual.

Firstly, the device was apparently made to be adjusted. A single set of settings is not comfortable for all users, and the manufacturer recognized this.

Secondly, that's the wrong question entirely. People have a right to decide their own medical treatment (or refuse it entirely), and that right must not be circumvented with legal or technical means.

That sounds suspicious. By any chance, were they making ongoing revenue from you using the device?

I am not justifying that kind of harassment. It's out of line, whether they're making money from you using it or not. But it's more understandable if they want you to keep using it so that they keep getting paid.

My best understanding is that if patients use insurance to pay for the device/visits, payment to the Drs office is predicated on the patient following the prescribed treatment.

In our case, we actually bought the cpap out of pocket. But because this is unusual (It cost us about 800 dollars) the doctor we went to pays a company that does treatment monitoring.

This company is paid based on the number of patients that are "in compliance" with their treatment plan, because this makes it easier to bill against insurance for the Drs office.

The monitoring company has a financial incentive to make sure patients are in compliance. The Drs office has a financial incentive to make sure patients are in compliance.

---

Ironically - the thing that was actually needed was additional monitoring to tune pressure: it takes several readings over a few nights to manage pressure and keep bloating down and make sure it's not hard to breathe, while still ensuring that apnea events are in the acceptable range.

But additional monitoring is expensive - it requires clinician/doctor time. So there is little incentive to actually do this, in favor of forcing plan compliance.

Basically - My read of the situation is that the whole thing was rotten to the core. It had very little to do with patient comfort or health, and everything to do with maximizing insurance based revenue.

> maximizing insurance based revenue

That seems to be the state of US healthcare unfortunately. What used to be an ethical doctor-pactient relationship has turned into a doctor-insurance-patient monstrosity. Doctors actually have limited autonomy. They can't always do what's best for the patient, only what the insurance company agrees with.

The patient and doctor are free to negotiate a deal that avoids third parties such as the insurance company.

The patient chooses to hire an insurance company (better labeled a "managed care organization") to manage their care, because they do not know what they are buying, or how much it should cost.

>They can't always do what's best for the patient, only what the insurance company agrees with.

Because that is what the patient can afford.

Note that when the previous commenter states this:

> everything to do with maximizing insurance based revenue.

They are referring to requirements frequently set forth by the government or their employer. Some of them are called "star ratings", and the government goes to managed care organizations (who also sell health insurance), and task them with implementing standards of care and star ratings and a very complex system that determines who gets paid how much and who is incentivized to do what.

It is very naive and counterproductive to label insurers as the bad guy because "insurers maximizing revenue", because it lets go of the real issue, which is that

A) healthcare is hard, and measuring results even harder B) supply of healthcare is low relative to demand C) the limited supply of healthcare has to be allocated in some manner

It is a very complicated subject, that involves many players, incentives, opportunities for corruption, people with good intentions, and no easy answers.

>> They can't always do what's best for the patient, only what the insurance company agrees with.

> Because that is what the patient can afford.

What is the point of paying for insurance, then? Nothing legitimizes for-profit insurance companies having any role or prerogative in health care, other than the status quo.

The point of insurance is to protect against unaffordable losses.

An insurance business only works if the losses are, by and large, randomly distributed and unexpected.

The more predictable the losses, the more an insurance offering resembles a payment plan where you are simply setting aside money with a third party to save for the eventual loss. This is because as losses become more probable, the insurance company has to increase premiums eventually to the point where the sum of the premiums is equal to the losses if the probability of loss is 100%.

This is the current state of health insurance in the US. It is not what would normally be called an insurance product. In fact, quite a few of the stipulations of ACA make health insurance premiums explicitly a tax from the young/healthy to the old/sick. Therefore, the industry term is to refer to health insurance companies as "managed care organizations" (MCOs), some of whom sell health "insurance".

In the US, when you pay health insurance premiums, if you are young/healthy, you are mostly paying for the treatment of the old/sick, and only minority paying to protect against the risk of you breaking your arm.

The profit that MCOs earn is actually more like an administration fee. The US could have implement an NHS style taxpayer funded healthcare system, but the politically viable option in 2010 was to outsource the administration of healthcare (pricing negotiations, healthcare rationing, auditing, etc) duties to MCOs, hence we have a system where the government (or employer) sets the rules, that abide by ACA rules, and then the MCOs execute them.

For example, nearly half of Americans' healthcare is paid by the government, but it is administered by MCOs. The MCOs are not setting the rules, just carrying out the stipulations of their contracts with the government:

https://crsreports.congress.gov/product/pdf/IF/IF10830

Finally, to answer this question:

>What is the point of paying for insurance, then?

If you have future earning potential, or a little bit of wealth saved up, then health insurance in the US is valuable because your out of pocket maximum is capped.

https://www.healthcare.gov/glossary/out-of-pocket-maximum-li...

This is one of the policies that also helps make health insurance premiums more akin to a tax, along with, but not limited to, the following policies:

Age Rating Factors (adds cost to young people's premiums and lowers old people's premiums)

https://www.cms.gov/CCIIO/Programs-and-Initiatives/Health-In...

And insurance cannot be denied to someone for any reason, and has to only be based on age/location/tobacco use:

https://www.healthcare.gov/how-plans-set-your-premiums/

Apologies, I really didn't mean to make you rehearse for me how things work today. But I am curious about what your point of view is on whether the role for-profit health insurance providers play today is legitimate and salutory.

We have our current system largely as a result of regulatory capture, so no amount of pointing to the status quo and shrugging at its complexity legitimizes it. Again, I fail to see the legitimacy of a regime in which I must either pay a for-profit corporation for the privilege of preventing my doctor from doing what is in my own best interest or be wealthy enough to pay everything out of pocket.

>Again, I fail to see the legitimacy of a regime in which I must either pay a for-profit corporation for the privilege of preventing my doctor from doing what is in my own best interest or be wealthy enough to pay everything out of pocket.

The "legitimacy" lies in the fact that that is what was politically possible to accomplish. I put legitimacy in quotes because I assume you mean legitimate in the context of some type of moral or ideological sense, which I do not find terribly interesting in this case, where there are many real world constraints at play.

At the very root of it all is the fact that demand for healthcare greatly dwarfs supply of healthcare, starting from the simple fact that changing bedpans is a highly undesirable task and going all the way to the fact that medicinal knowledge is very difficult and costly to acquire. And so politics will be involved in how healthcare is distributed.

You can even go back to your statement of

>from doing what is in my own best interest

99% of people have no idea how to evaluate what is in their own best interest when it comes to medicine. Even doctors outside of their specialty probably do not know, and the tiny minority that do would acknowledge that at some point they are also guessing at the machinations of something complex like the body.

The for profit (and not for profit) labeling is mostly a distraction. Doctors do not treat people without a profit, programmers do not program without a profit, and a managed care organization does not sell its services without a profit.

These 2 big constraints shape how much and what kind of healthcare system we can afford:

-low supply of healthcare relative to demand - requiring a system of allocation of resources

-medicine being extremely difficult and possibility of doctor making mistake or being corrupted requiring second opinion - i.e. doctors and pharmacists employed by managed care organizations

Obviously, everyone would love if everyone could get all the healthcare they could ever want at anytime they want. But our parameters do not allow for that. Back to the original question of why a for profit managed care organization needs to be involved at all? It does not, except politically, that was the solution the leaders agreed upon. I suspect politicians also like MCOs in the middle because it keeps the heat on the MCOs and deflects from them.

We could have gone the NHS way with taxpayer funded healthcare, and the NHS handling all the administrative functions that managed care organizations do. But there was significant political opposition to that, probably because a lot of politically influential classes stood to lose in that proposition. So we have what we have.

Note that to counteract excessive profit incentives, the ACA implemented minimum medical loss ratios and a healthcare exchange so that companies could compete for customers and hence have an incentive to keep premiums lower (presuming the existence of sufficient competing MCOs). Why not just cut all that out and let government deal with it? Because that is what was possible.

https://www.healthcare.gov/health-care-law-protections/rate-...

> The "legitimacy" lies in the fact that that is what was politically possible to accomplish.

Regulatory capture[0] narrowed the possible to only solutions involving for-profit health insurance corporations. If you don't find a form of corruption to be of interest here, I'd be especially interested to know why.

[0] https://en.wikipedia.org/wiki/Regulatory_capture

I can see it being possible to have had some effect, but I do not see having been a major force. As far as I remember, Republicans did not want to expand access to healthcare at all if you did not already have it due to being very poor or old. Many Democrats wanted to expand taxpayer funded healthcare, but they did not have the numbers to get it passed.

Hence a compromise had to be reached. Getting taxpayer funded healthcare administered by the federal government simply was not an option, and I have not seen evidence that it was because the health insurance business was lobbying every Republican.

What I find more likely is that the more complex you make a system, the more you can engage in price discrimination via price obfuscation. A straight taxpayer funded healthcare option would have immediately impacted the bottom line, since government expenditures visibly go up, and would not allow a way to discriminate to those who receive the healthcare.

The compromise, however, allows for all sorts of games to be played. Such as allocating more and better healthcare to older people in comparison to poorer people. This is accomplished simply by having different reimbursement polices in Medicare (old people, strong voting power) and Medicaid (poor people, weak voting power). Medicaid is also further broken down into being administer 50 different ways by 50 different states.

Then you have employer self insured plans doing things the way they like, and employer subsidize plans doing things the way they like, and church plans that do not even provide healthcare. Basically, a way to expand healthcare in a way that still disproportionally allocates healthcare to richer and/or more politically influential people, but helping the others a little bit.

At least we got the metal levels and healthcare.gov out of ACA so there is some ability to compare insurance products.

And at the end of the day, even if you took away the cut that MCOs take for administering all this healthcare, it would mostly save around 5% to 10% (the profit margin plus savings from redundancies). MCOs currently pay out 75% to 80% of all premiums, and profit 5% or less, which leaves 15% to 20%, but the government would have to duplicate many of the functions of the MCO.

https://www.kff.org/private-insurance/issue-brief/data-note-...

Even in a taxpayer funded scenario, I would bet the doctor is going to have to get approval from the system to provide a treatment above a certain cost.

> Even in a taxpayer funded scenario, I would bet the doctor is going to have to get approval from the system to provide a treatment above a certain cost.

That happens due to scarce resources. Most often in developing countries. Where I live, there are places doctors work at that barely have water for them to wash their hands. Ordering an MRI is a big deal.

I refuse to believe this would ever be a problem for the US.

I do not know what to tell you other than "the US" expects many of its school teachers to procure classroom supplies themselves and it is a debate on whether or not to provide nutritious meals to kids in school without payment.

We have a special visa for doctors willing to live in undesirable areas of the US for many years. There is even a website for it:

https://data.hrsa.gov/tools/shortage-area

https://www.hhs.gov/guidance/document/hpsa-and-muap-shortage...

And now to meet demand for doctors without having to pay for more doctors, most states have allowed a Nurse Practitioner or Physician Assistant to basically practice as a doctor where a doctor just oversees their clerical work. So if you have lesser insurance coverage or live in an area with insufficient doctors, then you may see an NP or PA who is far less qualified than a doctor.

> In fact, quite a few of the stipulations of ACA make health insurance premiums explicitly a tax from the young/healthy to the old/sick.

Why not make it official then? Why not end this "insurance" thing and start funding hospitals with taxpayer money? The US is absolutely rich enough to do it.

Because sufficient number of legislators in the US congress would not vote for it back in 2010, hence this compromised situation.

> Because that is what the patient can afford.

The whole point of these things is to get them to pay for the costs of whatever the patient needs. These needs are determined by their doctor. If they're not paying, they have no reason to exist.

Not being able to help people because of lack of resources is one thing. These companies hire experts and pay them bonuses every time they find some loophole they can use to get out of their obligation.

>The whole point of these things is to get them to pay for the costs of whatever the patient needs. These needs are determined by their doctor. If they're not paying, they have no reason to exist.

Per the payer's terms, whether it be government or employer or insurance company, their needs are not necessarily solely determined by a single doctor. There are teams of doctors and pharmacists at CMS, state Medicaid organizations, and insurance companies that create protocol for various courses of treatment in order to prevent mistakes, waste, and fraud.

>These companies hire experts and pay them bonuses every time they find some loophole they can use to get out of their obligation.

Source? It seems odd that a company that earns more money if it spends more on healthcare would have an incentive to look for loopholes. Of course, they have an incentive to not spend frivolously to maintain competitive prices.

https://www.healthcare.gov/glossary/medical-loss-ratio-MLR/

But they are all using the same protocols that the government uses anyway (via CMS), since the government contracts with the same MCOs to administer taxpayer funded healthcare for 40%+ of Americans via Medicare/Medicaid/Tricare.

Im sorry, but this is not true

>>>>>The patient and doctor are free to negotiate a deal that avoids third parties such as the insurance company.

Just like im free to negotiate a deal for some stock of TLSA directly from Musk, and not buy it via 401k.

On top of the transaction cost of getting elon musk in the same room with me, there's a huge difference: 401k purchases are pretax. Buying from Musk is not pretax.

Same is true for a "negotiated" transaction with a doctor, vs buying insurance from employer.

>>>>>Patient chooses insurance to manage their care, because they do not know what they are buying, or how much it should cost.

Wow. Those are some claims. Lets test them. I dont even know how to change the oil from my car. I barely know how it operates, and i couldn't repair one without years of training. Yet anyone with cash can and does buy these $30,000+ machines.

How can something worth $50 - $300 be hard to understand? Also, I have an extremely powerful heuristic to know if its worth it, or not. ( feeling better = return to doctor. Feeling worse = change doctor ). No one needs insurance to buy medicine. Medical insurance is just simply a membership racket, legalized by the govt.

History is not on your side. Medical insurance was an irrelevant, minuscule market until well after ww2. Why its sudden emergence? Government mandates (Medicare + federal insurance mandates to employers, for returning vets)

>>>>>It is very naive and counterproductive to label insurers as the bad guy because "insurers maximizing revenue"

Insurers are not the only bad guy. I'll give you that. But to say they are not a bad guy, is fraudulent or really naive on your part.

So, Who are all the bad guys? Follow the money. Which players are going in acquisition sprees? Hospitals, Insurers, large Pharma, and PBMs.

1) Hospital "nonprofits", such as childrens hopsitals that have the gall to do community fundraising from bake sales while paying CEOs 5M+, while the CEO of the red cross is in hot water for making 500k. [1].

2) Insurers that buy a medical practice in NJ, and then suddently cut off the competing practice from the insurance network, thus grating the newly acquired practice a local monopoly.[2]

Or for a more recent example, take the lobbying to scare Biden's admin & CMS to permanently suspend the Trump administration mandate to force hospitals and insurers to disclose real medical pricing in 2021. [3] It begs the question on why Covid19 bigcos were giving Biden real time updates on covid19 drug development, while trump -the actual president- was kept in the dark. I know the bad guys were sweating bullets on that one!

3) PBMs? Creating formularies to favor sweetheart rebates to them, obscuring real cost from patients and regulators, while making patients and employers foot the bill? or

4) Pharma, racking in cash from drug $20 copays without disclosing to customers that they offer the same pills for pennies if you "cash pay" (not use insurance).

Bad guys galore in healthcare. Insurers are most certainly in the podium.

[1] Marty Makary : Unnacountable book

[2] https://www.nj.com/healthfit/2020/02/an-insurance-titan-is-d...

[3]https://www.natlawreview.com/article/cms-backs-price-transpa...

Looks a lot like an octo telematics device spying your activity when you drive your own car.

Continued monitoring via device(s) is a medical CPT code (or modifier) and that 100% billable.

This is exactly what was going on

That's horrible. Was that the doctors calling or some sort of CPAP monitoring company?

Who is "they" in this case? The manufacturer? Your insurance? The doctor? Startlingly bullshit behaviour from them regardless, but I'm curious.

Interesting, this was made super clear to me, and even included instructions to leave it plugged in for at least 40 minutes after waking up in the morning so it can communicate. Generally the insurance companies don't like paying for supplies for people who aren't actually using them, and need to see that you use it for an average of 4 hours per night or whatever.

> need to see that you use it for an average of 4 hours per night or whatever

That could just as easily be achieved by the method of locally recording on the SD card GP mentioned above without uploading who-knows-what about the device, your body, maybe even the surrounding area and other people to who-the-fuck-knows-where.

This doesn't really solve anything.

It can equally easily be recording exactly all of that data into some encrypted format on the SD card, which then gets uploaded to the manufacturer when opened with the proprietary application necessary to view the data.

The only difference is the choice over exactly when the data is uploaded, which in the US with its insurance system, results in no choice at all.

> need to see that you use it

You mean "want". I'm sure if we let them, they'd try to convince us they also "need" to monitor our diet and exercise (and whatever else would incidentally be recorded) to make sure we're following doctor's recommendations on that.

> no one is monitoring diet, exercise, drug use, cigarette consumption, or other risky behaviors, and threatening to withhold treatment for non-compliance

... yet.

But try to withhold payment if you get no treatment - deary me, no no no, that sends you to jail (really, in some places).

yeah yet https://www.youtube.com/watch?v=RNJl9EEcsoE

Still on track after a decade

That you know of. All of this data is collected and made available if you are paying for things with a card. Hypothetically, insurance carriers could be seeing exactly what you buy, from where, and how often. If you have a gym membership (as shady as gyms are, it would not surprise me to learn they not only provide membership but attendance records as well), they can glean if you are active. blah blah, metadata is innocent.

Most people will gladly hand over this information to insurance companies in exchange for lower premiums.

Most people would ultimately be charged higher premiums if they did hand this data over.

Ins: In the last week, you've purchased 3 packages of Oreos, 2 cans of Crisco, 3lbs of 73% ground beef, no vegetables, lots of stuff with high sugar content, high salt content, and very little actual nutritional value. Therefore, we rank you in a high risk category (since you are clearly over 21 years old) based on the fact you also bought 1 carton of cigarettes and 2 cases of beer. Please enjoy your new higher insurance premium.

But the people for whom it would lower premiums would hand over the data, which results in the same thing. A health insurance company could offer me a $50 discount for a monthly blood test showing my sugar/cholesterol, and I would do it. Why should I pay for someone else’s cheese/alcohol/butter/sugar/bacon consumption.

I assume the reason it is not currently implemented yet is because the cost of monthly blood tests is too high relative to the cost reduction. I do get $200 if I do it annually though, so it seems like it is at least worth it on a yearly basis.

> A health insurance company could offer me a $50 discount for a monthly blood test showing my sugar/cholesterol, and I would do it. Why should I pay for someone else’s cheese/alcohol/butter/sugar/bacon consumption.

Because... You would be saving peanuts while someone else would have to pay much more (and sometimes drop their insurance completely) and that's a much worse result for society than you paying some 50 bucks extra, even more if you have a good salary and this practice would make someone poorer be forced to be uninsured.

This ultra-individualistic thinking really doesn't help a society. Might help you as an individual but good luck living without a society.

Insurance is just about the worst avenue to pursue your socialistic goals. Insurance is a numbers game, you will never be pursuasive with arguments about the greater good.

How do you know that I would save peanuts while someone else has to pay disproportionately more?

I already get a decent chunk of change ($700) just for annual preventative physical, flu shot, dental exam, blood test, and eye exam, which are all free.

There is a spectrum. ACA excluded tobacco users' risk from using tobacco, but left alcohol and sugar and saturated fats in? Why subsidize the latter 3 and not tobacco?

Should others in society subsidize drunk driving? Reckless driving? Should we keep bailing out people who continue to build and buy homes built in flood plains? It makes sense to spread costs around on unknown risks, but once a risk factor is known, I can see merit in discussing whether or not it should be subsidized.

Of course, there is a spectrum of "knowing" risk factors, and everyone is different, but some factors have a very high likelihood and some are not high enough to merit discriminating. However, that is for the actuaries to decide, because if they are wrong that will show up in the bottom line and then it will be corrected.

But things like alcohol and added sugar are basically proven to only cause harm. 1 alcoholic drink and 1 cupcake a month is not going to cause an insurance company to say let's raise this person's premium, but I do not see why an alcoholic and a person that eats donuts, starbucks, and ice cream everyday should be subsidized.

>This ultra-individualistic thinking really doesn't help a society.

On the contrary, subsidizing behavior that is known to causes problems to people's health and hence increases healthcare costs and decreases productivity does not help society. If anything, I would characterize unhealthy habits (which I am also guilty of) to be ultra-individualistic thinking.

>How do you know that I would save peanuts while someone else has to pay disproportionately more?

The point is, no insurance is just going to say you pay next to nothing because of... Instead, they will say you are in the lowest risk category, and here's your rate.

>Why subsidize the latter 3 and not tobacco?

Big Tobacco was sued and lost in court, so they are easy to "pick on". Nobody has sued Big Sugar. We've already seen what strict rules on alcohol does to the country, and doubtful anyone is ready to do that again.

>The point is, no insurance is just going to say you pay next to nothing because of... Instead, they will say you are in the lowest risk category, and here's your rate.

It was never claimed that the insurance would cost nothing. There are, of course, uncountable health risks that are still in play.

>Big Tobacco was sued and lost in court, so they are easy to "pick on". Nobody has sued Big Sugar.

I do not know what this has to do with anything, nor what "sued in court" means as specific lawsuits have specific claims. It is correct that tobacco was separated probably because, politically, it is difficult to argue that people should pay for other people's smoking. And that is my point, that the risks we choose to subsidize and not subsidize are based on politics.

Hence, alcohol and sugar get a pass because lots of voters like those and want the smaller portion of people who do not consume as much alcohol and sugar to pick up the tab for those who cannot. Smokers do not have the numbers to result in sufficient political power to force others to pick up that tab.

>We've already seen what strict rules on alcohol does to the country, and doubtful anyone is ready to do that again.

I never claimed society should stop anyone from consuming alcohol or sugar.

>But the people for whom it would lower premiums would hand over the data,

Progressive Auto has their Snapshot devices which provides them your driving habits. People signed up for it not realizing that their premiums could actually go up because they're a shitty driver even though they are "really good drivers". Once the word gets out that insurance premiums are going up because of this, there will be lots of screaming into the void on the internet.

I am not sure what the point is. If some people's premiums go up, then others' premiums would go down. Those people would choose to stick with the Snapshot device (assuming they felt the discount in premium was sufficient).

There's no guarantee that anyone's premiums would actually go down. Instead, you might find people that thought their premiums would go down actually go up because of this. After all, we're talking about insurance companies who are the poster child for fucking over their customers. Giving someone this much visibility surely means they could find something to justify a premium increase.

I would never voluntarily submit data to insurance like this. It's a suckers bet.

Total premiums would only go up if total losses go up. Simply disclosing more data would not cause total losses to go up.

Insurance pricing is very competitive and if one company raised premiums without experience by more losses, another would come in and offer insurance at a lower price.

If your CPAP is like mine it has a 2G modem. Mine stopped working when those networks were shut down, so it's SD card only now. Forces the solution nicely.

"I brought the card to the appointment, but the doctor said "I don't need that, I have your data here." It turns out that the CPAP contains a cellular modem, and it phones home and reports in real-time. I had no idea this thing was recording any data at all. It wasn't verbally disclosed to me by either the doctor or the equipment technicians. I imagine there's something buried in the fine print of the (long lost) documentation, possibly even in the fine print of some form I signed, but I was caught off guard and none too pleased."

Really? My doctor and the dude who configured and walked me through the CPAP use both emphasized that it collected data on the SD card but that its cell modem would also report the data to the doctor and the supplier.

And keep in mind, a CPAP is kind of invasive by nature.

I was told about the cellular connection by my respiratory therapist. Mine even has an app that has achievements for proper and continuous usage. It also goes into pretty good detail about what you're screwing up if you aren't getting good mask seal. Even got a call from my therapist after two weeks following up with me about the data he received.

AFAIK this is what home medical equipment seems to be moving too. My dad's external pacemaker had a base station that phoned home over cellular as well.

If I wasn't wholly depended on the device I'd be very interested in poking around inside of it. I'd be very interested in learning what it's collecting, and maybe someone living in a area with laws allowing users to request their data should follow up with them.

I like data. I would like to review all the metrics my medical device collects. I'd welcome an app to make it even easier to view. That's all pro-consumer. That can be done by storing data on SD cards; via a USB connection; via built-in Bluetooth or WiFi. It's an easily-solved problem, and with modern wireless networking, something that the average consumer can navigate without much trouble. Even for the most tech-unsavvy patient, a removable SD card that you can bring to your doctor is a fine solution.

The problem starts when third parties are involved. Now I've got a CPAP with a cellular modem in it. Where is that data going? Who's processing it? Who are they sharing it with? What are the security precautions? Can they change settings without me knowing? At least the thing doesn't have a microphone on it too...

Even beyond medical privacy, I've now got a device that reports where I am and when I'm asleep, to who-knows-who. That's a wealth of data and I have no idea who it's being shared with. I realize that my cellphone is an even better surveillance device, but I trust my cellphone provider a lot more than I trust all the companies involved in CPAP manufacture and monitoring. Google and Apple are a whole lot better at security than some medical company that outsources data management.

>At least the thing doesn't have a microphone on it too...

How do you know? If they're doing tracking where tracking isn't necessary and don't disclose the full extent of tracking under some penalty for lying, then maybe the machine does have a microphone in it? How would you know without taking it apart? It's not like the doctor or device manufacturer are trustworthy on the privacy front.

In my case I actually did take it apart. The LCD screen smashed to the point of unusability and I attempted to repair it (alternative was to send it away for weeks for expensive repairs). While inside, I tried to disconnect the cellular modem, but it wouldn't function like that. I didn't actually look for a microphone (I'm not that paranoid), but I'm reasonably confident there isn't one.

> It's not like the doctor [...] are trustworthy on the privacy front.

That perception worries me. Medical information is confidential, it's the only reason doctors are trusted with such data. If this fundamental principle is corrupted, then nobody in healthcare can be trusted.

This entire subthread is predicated on not trusting the physician/clinician/device manufacturer. If those people really can't be trusted, then I'd suggest that the posters simply never go to the doctor.

I've been involved in medical device development for close to two decades. It's like pulling teeth to get data collected and sent off remotely because it raises the device manufacturing cost, increases device development cost to add those features (and yeah, security is being taken a lot more seriously these days), raises operational cost because you either need your own server farm or to pay for a HIPAA-compliant online database, there's more work to be done in developing a frontend for the clinicians to view and use the data, etc.

In short, no one is adding cell data upload to a device on a whim. I remember a device I worked on a year ago that decided to avoid this although it was expected that many of the users would be in remote areasor had mobility problems. Instead the customer decided to store data on an SD card (need to record results from the patient so their therapy could be adjusted as needed) and have the clinician download it from the device (they made weekly visits) using a tablet that would then email it directly to the physican who prescribed the device.

I understand that we're all losing trust, but this is getting ridiculous.

> I'd be very interested in learning what it's collecting, and maybe someone living in a area with laws allowing users to request their data should follow up with them.

Depending on the model, OSCAR might support your machine: https://www.sleepfiles.com/OSCAR/ — it's been on HN before I believe.

> it's been on HN before

https://news.ycombinator.com/item?id=22685537

You should be worried, PrivateButts, about the inevitability of smart toilets.

She said that if I disabled it, insurance would refuse coverage.

This is true.

That's how i found out that one of my medical devices has s cellular modem: I got a letter from the DME company saying that if i didn't use it more hours, my insurance would refuse to cover it and I'd have to pay the balance.

Where i lived, i had terrible cellular service, so i had to get an exemption from the insurance company and make sure to bring the SD card to my doctor quarterly to ensure the insurance company would continue to pay for it.

Have you looked at the data on the SD card? Can it be manipulated in any way as to show that it is being used even if not?

I've looked at it. It's not human-friendly, but it's not secured in any way. It would be trivial for anyone with basic programming chops to modify it.

Yes. There are programs that will open the files and display the data. Some even make charts. But it was all pretty boring stuff.

It's a shame how much great technology will go to waste because businesses work against our best interests and pull shit like this.

Yeah. It's infuriating. It's like we can't trust them not to fuck us over. The technology is good for us but at some point someone somewhere came along and corrupted it with all these "features" that exist solely to serve their business interests.

> It turns out that the CPAP contains a cellular modem, and it phones home and reports in real-time. I had no idea this thing was recording any data at all. It wasn't verbally disclosed to me by either the doctor or the equipment technicians. I imagine there's something buried in the fine print of the (long lost) documentation, possibly even in the fine print of some form I signed, but I was caught off guard and none too pleased.

I should think that perhaps the legal requirements should be:

1. Its capability of wireless communcation, and a brief description of what it does, and the power and frequency it uses, should be clearly marked on the package.

2. The included documentation should need to describe the details of the wireless communication, including whatever is mentioned on the package.

3. There should be required it can be disabled without disabling its other functions, and this feature must be documented.

The other things that you mention too, should be applicable. I agree with you that "I don't agree with the undisclosed enforcement mechanism, nor do I agree that treatment should be contingent on monitoring" and that "This is insanely invasive, even with disclosure, and ought to be illegal without explicit, obvious verbal and written disclosure".

The medical devices should not be doing such surveillance (and medical devices should ideally not require a computer, either).

> medical devices should ideally not require a computer,

I can accept that you may have no knowledge of the ridiculous complexity of modern medical devices, but if you're a software developer I would expect that you realize there are computers in everything

The device isn't "surveilling" you. It's reporting therapy-relevant, and probably device performance, information that is actually important both to the clinic and the device manufacturer. The "low-tech" alternative would be you going into the physician's office once a week for a checkup. I'm pretty sure most people would prefer that it upload the data.

> I can accept that you may have no knowledge of the ridiculous complexity of modern medical devices

That is correct, I don't know. However, they are made more complicated and then might fail (e.g. if the power runs out).

> if you're a software developer I would expect that you realize there are computers in everything

Many things do these days, but I think that computers should not be needed in everything, even some that do.

> The "low-tech" alternative would be you going into the physician's office once a week for a checkup. I'm pretty sure most people would prefer that it upload the data.

Yes, although it shouldn't be required, in case a few people do prefer an alternative (that isn't the only one, although it is a possibility).

I’m able to turn off the cell connection on my CPAP with airplane mode. I have a ResMed AirSense 10 that I got 4+ years ago and in the “MyOptions” section it has an “Airplane Mode” menu item which can be set to “On” to turn off the cellular connection.

I agree with all that you said about it reporting home and compliance.

I also found it surprising how strict it was to be compliant. I needed a 2 or 3 month uninterrupted streak of 4 hour+ usage per night.

I had to email the data to my insurance since I had it on airplane mode.

Yeah, I later learned about the airplane mode option. I would have used that, but at some point the screen on my CPAP (also a ResMed AirSense 10) smashed, so I was unable to engage airplane mode. I was able to get a copy of the ResScan software (intended for clinicians), which allowed me to adjust the pressure and other clinical settings, so I continued to use it (although it was incredibly inconvenient as it involved removing the SD card and using my PC). That's when I tried taking the machine apart and physically disconnecting the modem, but it wouldn't operate that way (and with no screen, I couldn't see if there was some simple dialog I had to dismiss to get it to work with no modem).

Really, though, I don't think any of this should apply, as I paid cash out of pocket for both the doctor visits and the CPAP machine itself. No one had any legitimate claim to the data.

> no one is monitoring diet, exercise, drug use, cigarette consumption, or other risky behaviors, and threatening to withhold treatment for non-compliance).

While an employer-sponsored health plan does not “withhold treatment” per se, they definitely draw a line around what they’ll pay for. Part of the physician’s (or more typically the hospital’s or physician group’s) reimbursement is contingent on whether the patient adheres to the treatment regimen [1] which incentivizes things like automated tracking.

Even though you have a high-deductible plan, you’re still involving your health insurance provider in the transaction. It’s not quite the same as a “cash for service” relationship.

[1] https://www.medscape.com/features/content/6006314

> Even though you have a high-deductible plan, you’re still involving your health insurance provider in the transaction

Depends. If you are planning to use that amount as part of your deductible, then insurance has a stake in it. If you don't ping your insurance at all, then insurance should have zero say over it at all.

Welcome to realizing Insurance companies are soft control mechanisms and one of the worst in terms of justifying rampant data aggregation to keep the actuaries busy.

Also welcome to privacy violation via undisclosed industry collaboration. You'll find the same pattern pops up just about everywhere.

Do people have the right to lower their own insurance premiums in exchange for voluntarily giving up their data?

Do people have the right through collective indirection to implement blatantly discriminatory control mechanisms that obfuscate the actual costs of things? (I'd argue not.)

Do people have the right to sell themselves into slavery? (Not in the United States)

There's just some transactions that aren't bueno, because of the higher order effects they cause.

I see normalizing surveillance as a case of that. I'm not even sure that most on aggregate even end up realizing premium savings since the data collected just filters into the new base truth for everyone. The more info an insurer has, the more lopsided the state of affairs for everyone else.

I'm all for freedom when you aren't just effectively creating soft, coercive, control mechanisms.

>Do people have the right through collective indirection to implement blatantly discriminatory control mechanisms that obfuscate the actual costs of things? (I'd argue not.)

More accurately distributing cost of risks to those engaging in the risky behavior seems like it would be the opposite of obfuscating costs. Tobacco users pay more, why shouldn’t alcohol users? Or sugar users?

I discovered the cellular modem in my cpap shortly after I got it and promptly took it out. If you're interested in monitoring your own sleep data check out sleepyhead https://sleepyhead.jedimark.net/. It's a great app, but unfortunately it looks like the developer is no longer working on the project.

I was made aware of this feature on my CPAP machine, though it was only mentioned in passing. I'm not super crazy about sending the data to the manufacturer, but I do very much like having it available to my sleep therapist.

As an example: recently, I started snoring more and more, though I didn't realize the extent of it until my wife told me that she couldn't sleep at all the night before. Concerned, I called my sleep therapist, and they brought up my file, looked at the data, and made an adjustment to the settings (I presume the pressure) right there while I was on the phone. The next night, my wife and I both slept great.

That said, I wasn't given the explicit choice to opt in or to opt out, and while I would have chosen to opt in, I'd wager there are a ton of people out there just like you who would be very upset to know that their sleep patterns are being sent to another company (or anywhere, really) without their consent.

Insurance is a racket everywhere apparently.

It's supposed to be a capital allocation optimizer and risk mitigator. Unfortunately, without hard limits on things, it degenerates to financial control mechanism formost people.

I don't see why most common types of insurance aren't offered by governments. The government has the largest pool of cash and it's not like insurance has much room for innovation. Most types of innovation in insurance is about figuring out ways to not pay out insurance claims. Ie 'innovation' by an insurance company means a worse product for the customers.

I was very fortunate to be warned about these CPAP woes and hassles by a friend who went through it before I did. His advice? If you think you might have sleep apnea, do NOT get diagnosed, just buy a CPAP machine second hand and see if it helps you feel better.

I did, and the CPAP helped a lot. Eventually I figured out that simply sleeping reclined (on a triagle pillow) actually gave me 90% of the benefits with 0% of the hassle of the mask though.

It's valuable to have a doctor who can help you diagnose the problem and get the machine set correctly; technicians who can help with mask fitting and explain proper usage and maintenance; and followups to monitor effects. Some people might be able to manage those things on their own, and I certainly feel that people who already saw a doctor and own a CPAP should be able to manage their care if nothing changes.

I don't think it's good advice to self-diagnose, buy used equipment, and hope you get it right. CPAP quality degrades over time, for one. Some people might benefit from a CPAP, but really need a more complex and expensive machine like a BiPAP. Some people have central sleep apnea rather than obstructive sleep apnea. Some people would be better off with surgery or implanted devices. These are not things one should be figuring out on one's own.

If none of that is convincing, in the US it's illegal to sell a CPAP to someone without a prescription. I honestly don't care about that part, and if I knew how to order a new CPAP directly (perhaps from Canada or something), I would personally do it and skip the doctors entirely, but I don't think it's good advice, especially before you're properly diagnosed.

> If none of that is convincing, in the US it's illegal to sell a CPAP to someone without a prescription.

Like that means anything. I've bought a DSX900 ASV machine from the US, no problem. I've been self-treating UARS for 4 years now. None of the "sleep doctors" I've talked to even understand the thing, I had to do everything myself.

I don't know anything about the laws here - but isn't this medical data? Doesn't HIPAA make this sort of stuff illegal?

HIPAA doesn't prohibit the collection and sharing of health data. It provides a framework for how such activities must be performed, describes standards and practices for data security, limits whom the data can be shared with, and, yes, requires certain disclosures. But there's no HIPAA violation if your doctor, medical equipment provider/manufacturer, and insurance company share data within those parameters.

I'm sure I signed something authorizing it, in the giant stack of paperwork I filled out along the way, but who reads every word of that nonsense? It's practically designed to overwhelm the patient. I read a lot more of those forms than anyone else I know, but I still have to skim a lot and they're always presented in a high-anxiety environment. No one can or should be expected to pay that much attention to legalese in a doctor's office.

HIPAA enables and restricts data collection, storage, and sharing but in general you consented to it.

A current problem with HIPAA is that the consent forms do not clearly enough describe what is being agreed to such that someone can’t make an informed decision and there really isn’t an option to say “no” to things and still receive care without going somewhere else.

HIPAA also does not require consent to sharing “deidentified” data which has been shown many times to be relatively easy to unmask to discover who the records belong to.

Basically it needs updates from technical and privacy focused people but that’s a hard sell when people don’t really know how things work.

Consent in a medical context honestly means nothing to me anymore. Do you know how many times I've been asked to sign an electronic pad without seeing what I'm signing, asked for the form beforehand, and be told they can't give it to me until I sign it? It's absurd. They just collect an image of your signature and apply it to whatever they want. They will eventually cave if you make a big enough fuss, but unless you're Richard Stallman, no one is going to keep doing that every time.

edit: My hack in this case is now to legibly write "Can't see form" as my signature. No one has called me on it yet but I'm dying for the next disputed bill.

Conversely, I have a new F&P CPAP machine and it was clear this machine has a built sim card and an app can be used to download the data via bluetoothfrom is explained in the instructions. My Sleep Doctor even told me. I don't have to worry about insurance compliance (mine is through the NHS, UK).

Makes me wonder what would happen if you just put it in a faraday cage and blamed poor cell coverage at your home.

Aren't CPAP usage patterns supposed to be medical information? That's frightening.

Imagine a future employer bringing up how many times you snored last night.

Imagine your car refusing to start because you didn't get your required CPAP sleep last night.

That is unacceptable response from your doctor. I feel like I'd be looking for a new doctor after that.

I have a CPAP machine. Your doctor is telling the truth. If insurance is involved (even if it's a high-deductible plan and you haven't hit the deductible), they typically require the data verifying usage.

You're directing blame at the doctor, but it's the insurance company making the rules, not the doctor.

Doesn't matter. It's not OK for the doctor to do this, and it's not OK for the insurance company either.

I didn't direct any blame at anyone, although I do think the equipment provider was negligent in not explicitly making me aware of the modem. And there was no insurance involvement. I paid cash for the doctor and I paid cash for the CPAP. I could have reported it to my insurer so that it would have come off my deductible, but I didn't (mostly because I'm lazy, but also in large part because I only have insurance for something like cancer that would bankrupt me). I told my new doctor I didn't want a modem in the replacement CPAP and told her why, and was surprised that she really didn't seem to get it.

In that case, depending on your hardware, you might be able to simply disable wireless transmission (on my CPAP machine, this is called "Airplane Mode").

In this case I'm on the fence.

Say you are not breathing, and the machine is working, but not up to manufacture's specs. They have the data. They should inform you of a malfunctioning machine? Since they have the data, it's incumbent on them to inform you of the state of the malfunctioning cpac machine?

If they don't get back informing you of a faulty machine, a lawyer could subpoena those cell phone records/data? And maybe have a case?

They don't do any of those things (at least not for me; there's a sibling reply where someone was harassed for non-compliance). If I don't use the device, no one contacts me. I lost power a few times and couldn't use it; I pulled a couple all-nighters over the years; I left it behind on a weekend trip once; I had a stretch of sleeping problems where I didn't sleep more than a couple hours a night for a week; I adjusted the device outside the doctor's parameters; I had innumerable problems with poor mask fit/leaks. All these metrics were broadcast by the CPAP, and all would have been a concern of my doctor, but it's got nothing to do with patient health. This is all about gathering evidence to deny future care, whether it be new equipment or coverage for more extreme situations related to non-compliance.

You can make this argument about literally anything. Should your tires contain GPS trackers and share that info with their manufacturer on the off chance that you sped, drove on the wrong surface, or there was a manufacturing defect that could possibly lead to an accident?

This shit needs to stop. It's getting out of hand fast. In just a few years, literally every powered device we own will be logging video, sound, location, and network traffic in real time continuously. What's to stop equifax from leveraging all this new info for credit reports? Insurance companies for premiums? Lawyers for civil defense? Class action lawsuits? Police? Divorce proceedings?

We are not heading in a good direction here. A police state is bad in and of itself, but swapping the police with a "free and unregulated market" is infinitely worse.

I mostly agree with you, but at the same time, we are far from a "free and unregulated market." There are mountains of regulations to comply with, and more than one startup idea I've had to disrupt this type of shit never got off the ground because I would have had to spend months of my time just reading rules or hiring extremely expensive consultants.

I think the problem is not necessarily lack of regulation (although there are consumer protection/privacy rules that we badly need), it's that the big companies are the ones writing the regulation and conveniently it makes it really hard for anyone to disrupt or challenge them.

Are we still talking about tracking and sharing of user data? Because from I can tell, outside of very specific pii situations, it is largely unregulated today.

Ah fair point, I seem to have broadened the scope in my mind. Just tracking and sharing of user data in general, so long as you aren't trying to do business with entities that are regulated, is pretty wide open in most states in the US.

That would depend on your agreement with the device manufacturer, assuming you had one.

The products I worked on that had remote monitoring built-in were purchased directly by hospitals or medical labs and in those cases we did have contracts that specified what we would do with the data. IIRC, one of the agreements was that if we (the manufacturer) noted that the device was malfunctioning, we would alert them.

Without an agreement to do something with the data, you'd have a hard time making a case. Especially since without an agreement, they wouldn't be able to access your identifying information.

Reply on news.ycombinator.com