Hacker News Reader

> Were they sending health data

The recent guidance from the HHS[0] indicates in many cases installing Google Analytics or the Facebook SDK would be considered sending health data to Google or Facebook and therefore be considered a HIPAA violation. From the HHS[0]:

> Tracking technologies on a regulated entity’s user-authenticated webpages generally have access to PHI. Such PHI may include, for example, an individual’s IP address, medical record number, home or email addresses, dates of appointments, or other identifying information that the individual may provide when interacting with the webpage.

[0] https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...

Does the guidance only apply to user-authenticated web pages? the article suggests 'the website' is all PHI, which I personally find to be an insane interpretation of HIPAA.

edit: I found the answer. it's pretty reasonable. basically, no, HIPAA doesn't apply there.

Oh the other hand, maybe it should apply, considering that the website is the entry point for the user to the service and that an attacker owning that can trivially redirect the user flow - the same reason why mixed HTTP & HTTPS is considered insecure.

> Does the guidance only apply to user-authenticated web pages?

It depends on if there's health related information on the page. The HHS includes examples of unauthenticated pages where the guidance applies such as pages about a specific health condition or find a doctor pages[0].

[0] https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...

> Does the guidance only apply to user-authenticated web pages? the article suggests 'the website' is all PHI, which I personally find to be an insane interpretation of HIPAA.

Someone (anonymous) goes to the website and does a bunch of searches on e.g. cancer or AIDS or anything else they don't want marketing to know about. Afterwards they log in (turns out the person was an existing patient who had a login). But it's all in the same session so now you tied all that search info to a specific account and sent it to adspyware third parties. Solid HIPAA violation.

Not my field, but talking to friends in healthcare infosec, this is something that has caused them to be hit with fines in the past. Even in the absence of fines, clearly a privacy violation.

> This really depends on what you consider health data

Nope - because I didn't say "health data". I said "data".

> But I'd argue that the simple fact that you use a health app [...] itself is a major breach

It absolutely is. There is a hypothetical case that's often shown in HIPAA training materials that covers this: a staff member posting a selfie on social media of themselves with a celebrity in a clinical setting (e.g., a waiting room).

As far as HIPAA is concerned health information is pretty much anything associated with a patient and a provider. The definition of a provider is pretty broad, but basically all data points in an EHR or claims system are associated with a provider.

So data from a fitness tracker or what you ate last night is health related but unless it’s being fed into an EHR (and associated with a provider) then it won’t be considered covered by HIPAA.

> As far as HIPAA is concerned health information is pretty much anything associated with a patient and a provider.

Correction:

As far as HIPAA is concerned protected health information is health information associated with a patient and held by covered entities, including providers, insurers, clearing-houses, and business partners acting on behalf of other covered entities.

Particularly, health information “associated with a patient and provider” but held by someone other than a covered entity is not PHI. Particularly, any information you provide about your health and care to anyone who is not your insurer, your health care provider (and online wellness services aren’t health care providers), or a business partner acting on their behalf is not PHI.

> online wellness services aren’t health care providers

That isn't uniformly true - or, to be more precise, the line between "online wellness services" and "online mental healthcare providers" is quite blurry to the average person.

My company today is in this space. Previously I've worked for primary care clinic chains, prescription discount providers, and direct pediatric care providers.

> I have been involved in a EU-based HealthTech that had the Facebook SDK (and maybe others too) in the app that fingerprinted the device and pinged Facebook on each run, without user consent nor adequate disclosure (buried in the privacy policy doesn't apply, nor was the privacy policy granular enough about the fingerprinting because Facebook itself doesn't publish any details on it).

Name and shame?

I'd name and shame if this was a one-off (frankly if it was I'd raise it internally and they'd fix it) but given that all apps are like this my best advice would be to avoid all "healthtech" apps to begin with and use them through a browser (with good ad-blocker) if really necessary.

If nobody makes the first move, the status quo is maintained.

Name and shame.