Hacker News Reader

Comment by Pigalowda | Hacker News Reader

From the article:

“No universal standards for storing “emotional data” exist. John Torous of Harvard Medical School, who has reviewed 650 mental-health apps, describes their privacy policies as abysmal. Some share information with advertisers. “When I first joined BetterHelp, I started to see targeted ads with words that I had used on the app to describe my personal experiences,” reports one user”

>I could drum up a dark fantastical setting of HR departments buying this data and screening candidates with it. Hopefully this patient data gets HIPAA treatment and is more protected.

View on HN

> When I first joined BetterHelp, I started to see targeted ads with words that I had used on the app to describe my personal experiences

Selling data from therapy sessions to advertisers is downright abusive!

Personally, after an initial good experience with BetterHelp, and then a hiatus, I had to stop using them because all of their therapists became evangelists for Critical Theory and were literally telling me that I ought to feel guilty for my race and gender, and work to atone for it. To be fair, I think this is a bigger probelm with the APA and not BetterHelp specifically. But a therapist who cannot abstain from judgement should not be a therapist.

Wow unless you were specifically bringing up racial issues as a personal problem I can’t even imagine how that would come up. I went to a therapist for years and had no idea what his politics were.

That is remarkably unprofessional for someone who should be a qualified clinical psychologist, not to mention that it is completely unempathetic and lacks compassion.

>who has reviewed 650 mental-health apps

cough how many? jeebus, that's a lot of these kind of apps. just kind of goes to show there are too many apps.

Most of these apps aren't protected by HIPAA.

Why is that?

You can see here [2] what entities HIPPA applies to. A app would probably fall under the rightmost "clearinghouse" column. But, that is only if the app receives data from another cover entity. If the app uses data provided voluntarily from and by the user to the app, the app is not a covered entity. [1]

[1] https://blog.focal-point.com/when-does-hipaa-apply-to-health... [2] https://www.hhs.gov/hipaa/for-professionals/covered-entities...

This is a big help! Thanks.

Aren’t the apps just matching providers and hosting communication? In which case the providers fall under the first column? At some point, there must be a provider, right?

Why is HIPPA not applicable in their work?

Because the data is given by the user, to the app. For example, MyFitnessPal can share the weights you give in check-ins to advertisers or whomever. But if you had a app from a health provider or health insurance company that you logged exercises with, then HIPPA would be applicable because both of those two are covered entities.

An app could be considered a health info clearinghouse if it receives data from a covered entity, in which case HIPPA would be applicable. But as far as I have seen, these mental health apps are paywalled audio snippets about different mental issues.

This is not correct, FYI.

You have it correct in your other reply. Simply put, most of these apps aren't Covered Entities, so they don't need to be HIPAA compliant.

I've been working on something that could improve privacy for websites like this. It's basically end-to-end encryption for websites, so you could have a chat with a therapist without the middle-man being able to decrypt the data. Of course the challenge is that these companies are selling or otherwise profiting off the data, so it's hard to see why they would use it unless you can convince them that the privacy is, itself, a big enough differentiator.

Reply on news.ycombinator.com