Health industry responds to data privacy crackdown | Hacker News Reader

Health industry responds to data privacy crackdown

politico.com

74 pointsluu20 comments

"A series of federal data privacy crackdowns is complicating how health care companies market their services online."

Surprised this is the lede. Seems the biggest news is "problematic and widespread" "telehealth companies...violating their customers’ privacy"

Anyone who isn't in health doesn't need to be HIPAA compliant, and thus isn't likely to do so.

That means that pretty much every possible service that is commonly used is off-limits. JIRA is an especially frustrating, but not entirely uncommon, example: to get them to sign a BAA, you need a massive contact.

That means no bug reports can go into JIRA with anything resembling the actual bug other than very vague info, so your internal customers (i.e. clinicians and customer service) have to jump through extra hoops just to file an issue.

I would love a world where HIPAA level compliance was standard for all PII across all industries. Until then, people will keep making mistakes.

Imagine this: you have two websites, a marketing site and a separate subdomain for your actual "app". There's a login button on the marketing site that redirects the user to the subdomain login page. Marketing adds GA to the marketing site to track conversations.

Congratulations! You've just violated HIPAA, because the rules apply to "past, current and future users" meaning that Google could theoretically identify people who were interested in either creating an account or wanted to log into your website. "But our company has a BAA with Google! We use all sorts of their products, right?" Wrong! Analytics is the one essential business software that Google refuses to cover with a BAA, which alone should tell you why you ought never browse the internet without uorigin and co.

I'm not making excuses for anyone. This is really important stuff to understand. It's also not always entirely obvious just exactly how leaky the entire SAAS world is to business people making what, in any other job, are obvious decisions.

In my experience working on healthcare products, tools like Jira where you can't store PHI don't present serious obstacles. Usually you can document the steps to reproduce a defect using fake data. You're going to need it anyway for the automated test script to close the defect. And if you do need PHI at some stage of the process you can link to it from the Jira issue instead of storing it in Jira directly.

Alas, the mere possibility of accidentally adding too much info into a help ticket by support staff alone is enough to have the company insist we use something else.

Its simple.

You put your PHI in one place and you encrypt it. Add all of the obvious controls like authentication, access control and monitoring.

Each record gets a UUID. Everywhere else you reference that record by UUID.

- Patient ABC123 called and requested modifications to their record

- Meds delivered to ABC123

- Insurance confirmed for patient ABC123

That’s how you ensure MINIMUM NECESSARY.

And if you want to go crazy there’s literally a crosswalk document published by HHS OCR and NIST:

https://www.hhs.gov/hipaa/for-professionals/security/nist-se...

For systems you control, yes even if what you've described takes a fair amount of work to get to. The main issue is that for software that wasn't built healthcare first, the strict privacy wasn't a requirement. Retrofitting your software and workflows can be a hell of a lot of work. Add in that you now need to verify that all the vendors you use are also compliant with the terms of your BAA.

For most non healthcare first SAAS providers you either do a major rebuild or you end up with a healthcare specific cluster which is missing some of your tools (although it's worth pointing out that many more vendors particularly in the observability space are now HIPAA compliant.)

Good point.

HIPAA controls are pretty simple. I think any mature company (not startups) will have them or is working towards them.

Mature vendors just don’t want to abide by breach notification guidelines which is why they use it as leverage to ask for more $$$.

Exactly.

The other issue is people forget that PHI can be used for treatment, payment and operations. You can totally put PHI in your systems literally any system but you NEED to adhere to the mandated controls specified in your BAA unless you’re a CE.

https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg...

Vendors don’t want to adhere to breach notification requirements or actually (gasp) do security which is why they charge you extra just to sign a BAA.

'BAA' = Business Associate Agreement [under HIPAA]

'CE' = Covered Entity

see https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg...

It would be easiest to just ban ads targeted by anything OTHER than the non-customized on page content. It's fine for ads to be targeted based on what's seen. It's _possibly_ OK to target ads by __large__ regional geographic area. (E.G. traceroute seems to say your IP is near Major Big City, so that huge region or a TTL circle around it is an OK ad pool.)

Anything more specific is ripe for abuse and should just not be allowed. Comparatively that specificity would be roughly equivalent to traditional TV, Cable and 'Print' media.

This is specificity as consumer privacy protection. I'm against most types of ads generally from a mental health stance.

Indeed, the main problem is that we've decided to legalize spyware and are now trying to contain the damage of that decision by playing whack-a-mole and trying to plug all the holes downstream.

Making spyware illegal (whether it's for ad targeting, or analytics, or "improving your experience") and enforcing CFAA-like penalties on company executives that knowingly violate the law would fix this problem overnight and for good.

since when has turning something illegal for which there already exists demand has ever solved a problem of this sort?

just one examples that I can't take out of my mind as the consequences are everywhere around me: war on drugs (and the original alcohol prohibition)

We're not talking banning something with demand from consumers like alcohol or other recreational drugs, we're talking about banning a harmful practice that companies engage in. Banning spyware is more akin to labor laws or environmental protections. Specifically it'd be a form of consumer protection.

It’s impossible to run marketing operations without GA and even session recording.

I entered a business where I pushed back for years, but at one point, you need to do it.

That's only because everyone else is using it. Banning it outright levels the playing field, and nobody needs it anymore.

Marketing, in the limit, is a zero-sum game (negative-sum, if you put a non-zero price on all the resources and labor wasted).

CFC-gasses, leaded gasoline, and DDT are the first I can think of. There are lots of cases where a ban of something harmful done by companies have successfully been banned

I don't disagree with personalized advertising, but this would be the way to do it. You have to attack the incentive, otherwise people will just come up with more nuanced and complicated ways to collect profitable data. Chipping away at collection routes for a trillion dollar industry simply won't work

I'm waiting for the first HIPAA violations due to ChatGPT etc. to be punished. The amount of FOMO coming out of C-suites around "AI" is sadly predictable.

Interesting grey zone and I am glad to see this tightening of US regulations on identifiable health related data. Could imagine doing this though just from a good set of labeled photos.

I think the reality is that the public & media have decided they hate 'tech' and every industry is trying to distance themselves from the label to avoid regulatory scrutiny.

Reply on news.ycombinator.com