Why did Phreesia share my medical data after I opted out?
statnews.com
statnews.com
In my mind, it is hard to imagine a patient opting-in and asking to receive targeted advertisement based on their medical condition. Should advertising based on sensitive medical data even be legally allowed? It's high time that the FTC step up and enforce stricter regulations on the sharing of sensitive medical data. Patients deserve better.
In most other markets, you are not even allowed to advertise medication (that requires perscription) to patients, so that point is moot.
Pharma advertisement is a byproduct of a privatized healthcare and the paradigm of the 'customer' patient.
As to the direct-to-consumer advertising (DTCA) for pharmaceuticals, the US and NZ are the only countries which allow it, it's a terrible idea.
So on US TV you get the inevitable intersection of both of those. US pharma spent $6.88b on DTCA in 2021. Congress isn't going to do diddly because it loves insider-trading on non-public information in pharma. Perverse incentives. If you want to avoid the pharma ads, cut the cord or switch to a news source with younger viewer age.
I see judge2020 had already written the same thing just below.
[0]: https://www.parrotanalytics.com/academy/learn-about-the-valu... [1]: https://www.adweek.com/tvnewser/heres-the-median-age-of-the-... [2]: https://www.statista.com/statistics/717651/most-popular-news...
Now it is healthy to have skepticism when strangers tell me a whopper, or when I'm offered something too good to be true. But if I'm in this habit and I refuse to believe trustworthy sources, someone in authority, or I refuse a gift of goodwill from someone who truly has my best interests in mind, that is advertising being detrimental in its training my mind and will.
This is the version they should broadcast, though: https://www.youtube.com/watch?v=nY6HOdG9sTY
In my experience, and based on the article, it sounds like Phreesia is an outlier.
As someone who works for a large healthcare company, we're scared shitless company-wide about the potential for personal data to get outside our hands. We have an entire department of people just to constantly watch everything that is done — every process, every piece of hardware, every piece of software, everything — to make sure that personal data doesn't go where it doesn't belong. Every employee down to the janitors has training about this at least once a year.
Last year there was a minor data breach. Someone left a small stack of eight forms with people's PII on them on a desk in a conference room unattended for a few hours. It was an all-hands-on-deck five-alarm fire. It wasn't in my department, so I don't know what the result was or if any employees were disciplined. But seemingly every time another healthcare company gets fined for violating HIPAA, we get a company-wide memo about it as a reminder.
I haven't heard of Phreesia before now. It sounds like one of those scummy companies that sells cheap "office solutions" to small companies (in this case doctors offices) that don't have the resources to do things right and in-house.
People should complain to the proper authorities about Phreesia, or any other company that acts this way. HIPAA complaints are taken very seriously in the United States. Your doctor's office may act like it doesn't care, but the feds do, and then the doctor's insurance company sure as hell does. One way or another, the lazy/greedy/cheap doctor will pay. But you have to document, and report, not just moan anonymously online. That does nothing.
Document and report. Don't let the companies get away with it, or they will keep getting away with it.
They can strictly require X, Y, and Z, while Z is not really necessary and X is really important to make sure it's done right. Later they'll add Xv2 and Xv3 signed in triplicate to ensure X is done right, but still won't really ensure that X is done right. That's just not what a bureaucracy is able to do. They can't just fire everyone and then re-hire only people who care enough about doing things right, that's impractical. So they can add more forms, policies, fire-drills ...
Side note, most people don't care about the "EULA" or "privacy policy" on everything, it's just for "compliance", 99.9% of people never read them, no one expects you to read them, you just sign, that's just how everything works. Yeah it's dumb. But you can see why pretty much all practical every-day people ignore the implications.
It doesn't take a large company to not mine data that you're supposed to safe-keep. The problem there is not the lack of internal overseeing, but that they departed from their original administrative business, and went into advertising because "profit".
Phreesia is a subsidiary of United Health (NYSE: UNH) which has almost a half-trillion market cap (USD$478B).
I can tell that you don't work in healthcare, or with janitors, or you'd know that they need to know most of this stuff.
It's the janitors that have the keys to everything. It's the janitors that know which bins go to the sanitation department and which ones go to the secure shredding company. It's the janitors who walk around the building at night and notice if someone's left papers on their desk after they went home (another one of those four-alarm-fire events), or a computer didn't lock itself, or someone dropped an access badge, or something else is amiss that could cause problems.
there’s no doubt a firehose of “anonymized” marketable data going out the door.
Please specify how it is that "there's no doubt." Do you have some evidence, or are you just being a cynic because that's the way anonymous wannabe cool kids act on the internet?
If you have evidence let me know, and I'll hook you up with our department that handles this sort of thing so they can take a look at it.
How did that happen? How did they know?
Well, each doctor’s flow of prescriptions is sent to an aggregator in near real-time, sometimes before the pharmacy gets it. That’s how they know to offer Dr. A a trip to Vegas and Dr. B a sandwich.
Hospital admissions, OB admissions and doctor fees are events that get sent to insurers for payment and subrogation. These vendors are allowed to “anonymize” (aka remove name and SSN, etc) and sell that data.
So you can buy marketing lists that contain, by zip code, addresses with inferences about medical conditions, events, and other metrics. I bought the list and discovered three pregnancies with projected due dates, 6 Type-2 diabetics, 2 people getting married in the next 6 months, etc on my block. And two babies were born, as projected.
There is a difference between compliance, privacy and security. The controls that I’m sure you’re diligent in implementing don’t address many privacy issues. HIPAA was enacted in the 90s and doesn’t address the risks today.
One is a profit center, one is a cost center.
The first time a clinic asked me to do a pre-checking using a web page, I did it, filled out about 75 questions in some mediocre web app and then I was ready when I went to the doctor. The problem came the second time I went, I had to answer the same 75 questions again, so I gave up. When I got the the doctors office they asked me "same insurance? same address?" -- two questions and then I was in! I don't know why the electronic check-in requires 75 questions, but when checking in through a person they ask just 2 questions. I think the staff at my usual clinic might just be slow to enforce our new electronic overlords, because when I went to another clinic run the by same company they just hand me a tablet every time, they wont even ask the two questions. Apparently the receptionists at some locations have one job, and that is to hand people tablets; I wonder how long that job will last?
I have previously checked the box, then ask the receptionist to immediately remove my authorization and print a confirmation. And it's not just unchecking the box, she's adding an exception note on my account. I doubt it'd be respected correctly if I ever had a bill go to collections.
I do raise a stink with the receptionist every time and she's good about it, but should probably escalate it higher in the organization.
This is the part that sucks. It's not the receptionist's problem, he/she just wants to get on with their day. Generally they're powerless to do anything anyway.
Last time I went to urgent care they had one of those screenless digital signature collection pads. "I just need you to sign a couple intake forms" and she motioned at the pad. I asked what I am signing, and she said "just some intake forms." She looked at me like I had six heads when I asked to see the actual forms, as if no one had ever done that before, then took a few minutes to find them.
Felt bad for making her life harder. Makes me wonder if something like that is even contractually valid: how can you collect a signature "on" a form that you don't even show the signer?
I was in one situation where I was required to "sign for my belongings" before they were returned to me--and before I was allowed to see them at all--and the document on the screen described someone else's belongings, such as things I did not have. The chick told me to calm down and I asked her if she read her employment contract before signing it.
Sorry for my ignorance, but why isn't it the receptionist's problem? Isn't it part of their job to address these sorts of concerns from patients?
Back in the day, the employee would expect the complaint, likely agree with it and not take it personally as it’s very obviously not directed at them or within their power to change. However, what they can do it let their employer know customers are unhappy.
It’s the office’s problem, and the receptionist is the public interface for the office. (Of course, if you aren’t willing to do anything but complain to the receptionist, and it doesn’t effect the business of the office, then I’m nots sure what the point of repeatedly raising a stink with the receptionist is.)
Of course, a sane healthcare system would make sure it never comes to this in the first place.
> a box allowing them to contact friends and family in pursuit of collecting money for unpaid bills
Wow, this is pretty shocking. Could you please share more details e.g. company name?
Did you relay your experience with this evil pattern with the doctor? What did they say?
Not prioritized at all is not what the parent poster alleged.
Sorry, but I interpret "entirely run by capital" differently.
> The US is entirely run by capital. If its profitable it'll be allowed even if it harms peiple
None of this wording excludes the following:
"In contrast to the US, Europe is not entirely run by capital. If it's profitable it may not be allowed if it harms people."
(translated from "Get owned, fleshie. Your attempt to exercise agency has proven futile. Now supplicate yourself before the techobureaucratic complex.")
There is a situation in Canada happening with one vendor in particular, and they have the support of doctors (who often hate privacy because it's a limit on their discretion, and it creates expensive bureaucracy to manage because everyone involved also hates limits to their discretion), but all the other small care providers who make up the bulk of health care services are basically principled people in small settings who want to help their patients. I've seen how they get bullied, and I don't really know what the solution is.
Basically if you value privacy, don't get sick.
I want my doctor to have all my medical information available for making decisions about my treatment. I don't want them to share my information beyond what is necessary for that care (and inevitably for billing/insurance too)
There are lots of government departments that want to use health information for everything from identity cards to licensing, to general "social science" research, and they are prevented from looking up whether you've had an abortion or not because these rules are in place. They'd really like to do those things, but they can't.
A doctor can't just share your husbands last STD test date, or your wife's fertility status with you, even if they have the information. They also can't lookup their own partners information without it creating logs and regulatory questions about their conduct. I've heard dozens of stories of nurses saying, "We can't use your previous test results because they are protected by privacy so I have to take the sample again," with an eye roll. Generally, they resent having to get patient or substitute decision maker permission.
It means they can't just txt a photo of your file with their android phone because it's convenient, and they need your permission and informed consent to use it. I get the "I save babies, do you want dead babies or do you want your so-called privacy you selfish prick?" argument, but they were doing that before the internet, and a society where a class of people can abuse your health information and use it to harm you is a bigger problem than charitably a tiny 4th derivative change in the trajectory of infant mortality.
General health research purposes have not been allowed previously, though there were some recent post-pandemic changes that enabled sharing of all health records with unspecified researchers, but privacy laws have typically got in the way of aggregating patient data or sharing it with peers and specialists without getting a patient signature etc. I've sat on calls with academics who were openly derisive of individual privacy because they thought that using peoples health records to train machine learning systems was their annointed right.
I don't have a lot of short answers. I've spent almost two decades on the specific issues related to health information privacy, and healthcare provision in many ways is social governance by other means, so there aren't a lot of short answers.
Er, no, its not. HIPAA. absolutely covers this scenario—any PHI they get under a BAA from a covered entity remains PHI and they are restricted in their use just aa if they were a regular covered entity for as long as they have it, and any unauthorized use or disclosure is unlawful and, if wilfull, criminal under HIPAA.
Why would I be surprised? The default operating assumption should be that they're absolute scum. I don't understand this game where we all play make-believe that companies are virtuous until proven otherwise.
Forgot to mention -- often in real time, streaming hot off the EMR over nice friendly XML or HL7! For all you know, the ADT messages already hit the company before you ever even saw a privacy disclosure to sign.
I hate they way healthcare has become so corporate. In the past, the doctor you saw owned the office themselves or with a few fellow doctors. Now, they are just a cog in a larger corporate machine with a CEO.
> Phreesia attributes a source of their confusion to a blank authorization form they received on one occasion where the staff checked me in manually
The focus of this article should be on the wild fact that someone else signed a consent form on their behalf to have their medical data shared...
Dark patterns are certainly an important issue, but should anyone other than the patient themselves even be able to fill out a form like this in the first place?
And every data collection should be turned from opt-out to opt-in - by law.
As someone who works in the space, I find it kind of annoying that we use the word "privacy" to mean: asking and following up with tech companies to ensure their opt-out behaviors work as intended. It's like... isn't privacy really about whether you are sharing what you do with people? If you care deeply about privacy, should you be online at all?
I get that we might want to encourage online businesses to do a better job implementing the web of privacy laws... but self-labeling as passionate about it just kind of annoys me.
Unfortunately, the more onerous you make the requirements for handling a type of data, the more the people who need to handle it will tend to outsource that handling to compliance-in-a-box providers whose bona fides they won’t be willing or perhaps even qualified to check, the fewer such providers there will be, and the more incentive the remaining ones will have to pull malicious stunts like this.
Less regulation, a free-for-all. More regulation, regulatory capture. I don’t see how you can win here.
Simple regulation, stringent enforcement with licence to punish loophole-seekers? A nice thought, but this too tends to evolve towards the BIG BALL OF MUD equilibrium as lawmakers try to improve the situation for one or another constituency, and there’s no counterbalancing force towards simplicity. Or rather there is—things gradually clog up and become less and less effective—but it works on scales far beyond the planning horizon of a legislator or the attention span of a voter. (See: the tax code just about anywhere.)
ref: Slave trade, narcotics, gambling, harvesting of body parts etc.
> At both providers, upon my arrival the staff would hand me a tablet made by Phreesia, a company with a roughly $1.7 billion market cap, to check in.
and:
> A patient seeking a long-awaited appointment with a specialist isn’t going to cancel, even if they are uncomfortable, because getting care is the priority.
When you say you are "someone who works in the space" what exactly do you mean? Healthcare, or the tech companies that buy healthcare data, or some kind of patient privacy advocacy role? or even someone who makes the dark patterns?
When you say "sharing what you do with people" are you talking about the patient sharing information with their doctor, or are you talking about the hospital sharing patient information with tech companies?
This is also unclear "self-labeling as passionate about [privacy] just kind of annoys me". Are you annoyed by patients who are concerned about their privacy? Or are you annoyed by someone whose job is to make the dark patterns and when they say they are 'passionate about privacy' they really mean 'they are passionate about opportunities in the privacy space' and really 'passionate about dark patterns to subvert privacy'?
Er I’m not following this logic at all. If you care passionately about something that is at odds with current society, then you are no longer supposed to be part of this society? For example if I fundamentally disagree with capitalism that doesn’t mean I’m somehow absolved of getting a job and paying bills, we are all still human beings with basic needs that need to be met.
You don't have to work in privacy and know how to label data to have a genuine care about companies not mining you. I care deeply about my health but I'm not a doctor and I sometimes eat chips.