Hacker News Reader

Comment by alistairSH | Hacker News Reader

Why are the hospitals installing a FB/Meta tracker in patient portals? HIPAA is generally taken seriously in industry - this is a weird oversight.

View on HN

"but we want to know how long they stay on each page of the app and it's free!"

Was the response I got when I explained the issue with Google Analytics in patient portals.

This is a common refrain, and the implementers are baffled by any security or privacy concern about it.

Unless it is made into a regulatory compliance concern, they don't want to hear about it.

I'm guess I'm just surprised that the product owner (or whoever tends to fill that role in this space) isn't intimately aware of the privacy concerns. There's an entire market of HIPAA-compliant data storage/processing/etc. If there isn't a HIPAA-compliant web metrics solution, I guess that's my million-dollar idea (free for the taking, I have zero interest in building it myself).

I've had so many clients insist that Google Analytics is absolutely necessary for their site or app since they need the to know as much as possible about who is visiting.

In most cases these same clients never even look at the analytics as the dashboard is too confusing and generating reports too cumbersome.

I can confirm that they did not use any of the data collected.

Can you elaborate on this? It's a patient portal. The patient is logged in, so you know who's visiting. They're visiting pages on your site tied to their own accounts, so you know as much as you can about what they're doing. Why do they need Google involved on this? I don't even understand the concept the clients are trying to convey. It's like someone saying, "I need to go to the store to get milk," but you open their refrigerator and it's full of gallon jugs of milk. What am I not understanding?

IP/location, device used to access, browser used, time spent on the site, other demographics and interests data that may not be part of their user profile but is available thanks to Google tracking cookies, etc.

Most (all?) of which could be developed on their own of course, but that costs more than a one liner to set up Google Analytics.

And again, none of this info was ever actually used. They just felt very strongly that they needed it to better understand their users and improve the experience at some far off future date.

Isn’t matomo open source?

Because they are for-profit businesses and as such have a strong incentive to spend in ads and for these ads to be as effective as possible. FB and Google are just giving them the means to do so; we should be asking why it is that hospitals are allowed to have these strong economic incentives to begin with.

I complained to kaiser permanente that that they had googletagmanager/doubleclick links all over their site.

This includes the pages to contact my doctor, view test results or even the feedback link for my complaint.

They played dumb for a while, but finally said "the website is a convenience". They also would not delete my account.

It's not uncommon for shit like that to be in a template that gets used across an organization.

Hospitals advertise, just like any other business. I’ve ran campaigns (not Facebook) for maternity wards, cancer centers, rehab, etc. You need to track conversions and exclude current customers, so you need to place trackers in a lot of different places. And you give clear instruction to the marketing guy to not grab any pii, but they might do it anyway.

It's probably an element of the Electronic Health Records system they use. EHR systems are massive and complex, and the health care facilities are barely aware of all the functions and features. I'd say this is a failure of oversight on the EHR providers.

I work at Epic. This is not true. Hospitals have the ability to customize the portal we offer and add in what they want. We're not shipping with Meta Pixel enabled. They added this and didn't understand the full consequences (I hope). When we learned and understood the consequences, we called every customer to share what we know and investigate if they're impacted.

I can't speak to why the consequences weren't more obvious. I don't know. I do know that Epic cares deeply about this and I know that it pisses me off that this happens. But the tech people at hospitals are people and make mistakes. They're likely driven by the business needs and don't have time to fully vet everything.

I think this is a consequence of the American health system and want to implement these products to increase profitability.

I had no idea which EHR vendor was involved.

Edit: I didn't read far enough into the story. I see that Epic was mentioned by name.

I stand by my assertion that it's on the EHR vendor. Did those hospitals specifically enable the private health data be sent?

Yes. They specifically added Meta Pixel or added something else that added Meta Pixel.

Reply on news.ycombinator.com