Hacker News Reader

Comment by jollofricepeas | Hacker News Reader

So…

Is it surprising that Engineers in healthcare dont read the actual HIPAA documentation?

Use of health data is permitted so long as it’s for payment, treatment or operations. Disclosures and patient consent are not required.

There are helpful summaries on the US Department of Health and Humans Services website of the various rules (Security, Privacy & Notification)

Source: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...

This allowance is permitted to covered entities and by extension their vendors (business associates) by HIPAA.

If it wasn’t then, theoretically the US healthcare industry would grind to a halt considering the number of intermediaries for a single transaction.

Example:

Doctor writes script -> EHR -> Pharmacy -> Switch -> Clearinghouse —> PA Processing -> PBM/Plan makes determination

Along this flow there are other possible branches and vendors.

It’s beyond complex.

View on HN

> If it wasn’t then, theoretically the US healthcare industry would grind to a halt considering the number of intermediaries for a single transaction.

It just occurred to me that cleaning up our country's data privacy / data ownership mess might have extraordinarily positive second-order effects on our Kafkaesque and criminally expensive healthcare "system".

Maybe making it functionally impossible for there to be hundreds of middlemen between me and my doctor would be a... good thing?

I think it would have the opposite effect. We could end up with a few all-in-one systems that would dominate the market and have little incentive to improve or compete on usability and price.

Only if your mortgage isn’t paid by such a middleman.

Correct. Would also mostly stop a lot of scams like identity theft.

A national identity service, like a normal mature economy, would be a massive public policy and public health win.

But it'd slightly decrease profits. So of course is quite impossible to implement.

This is why I advocate all PII data be encrypted at rest at the field level.

Worked on EMRs (during the aughts). Had yearly HIPAA and other security theater training. Not optional for any one in the field.

Of course we had root access. I forget the precise language, but HIPAA exempts "intermediaries" such as ourselves. How else could we build and verify the system(s). And that's why HIPAA is a joke.

Yes, our systems had consent and permissions and audit logs cooked in. So theoretically peeking at PII could be caught. Alas, it was just CYA. None of our customers reviewed their access logs.

I worked very hard to figure out how to protect patient (and voter) privacy. Eventually conceded that deanon always beats anon, because of Big Data.

I eventually found the book Translucent Databases. Shows how to design schemas to protect PII for common use cases. Its One Weird Trick is applying proper protection of passwords (salt + hash) to all other PII. Super clever. And obvious once you're clued in.

That's just 1/2 of the solution.

The other 1/2 is policy (non technical). All data about a person is owned by that person. Applying property law to PII transmutes 3rd party retention of PII from an asset to a liability. And once legal, finance, and accounting people get involved, orgs won't hoard PII unless it's absolutely necessary.

(The legal term "privacy" means something like "sovereignty over oneself", not just the folk understanding of "keeping my secrets private.)

> Use of health data is permitted so long as it’s for payment, treatment or operations

please, do tell me, where "estimating better pricing models to extract more profit" fit into those?

> Doctor writes script -> EHR -> Pharmacy -> Switch -> Clearinghouse —> PA Processing -> PBM/Plan makes determination

All the OP mentions happens way after the fact of those paths you described. People have already been charged. Treatment was already decided.

Define operations, because that sounds like a loophole that basically allows you to use it for anything

Basically the only thing you can't do with the data is disclose it to someone who doesn't also fall under HIPAA

HIPPA protects you against gossipy staff. Beyond that, it’s mostly smoke - entire industries are built on loopholes.

Pre-HIPPA, the hospital would tell a news reporter about your status. Now, drug marketing companies know about your prescriptions before your pharmacy does.

Mid aughts, we devs sat in the meetings discussing how to enable this. With teams from Google Health, Microsoft Health Vault, some pharmas.

In attendance were marketing, biz dev, execs. Ours and theres. But no legal. Hmmm.

And it would have worked if it weren't for those meddling teenagers.

From your comment, I'm inferring they're now allowed to use health records for marketing.

My wife about 9 years ago was admitted to the hospital for a ruptured ectopic pregnancy. The baby would have been about two months along.

On the would-be due date, a box arrived via FedEx of Enfamil samples and a chirpy “welcome baby” message. Of course there was no baby.

It turns out that using prescription data, admission data and other information that is aggregated as part of subrogation and other processes, you can partially de-anonymize/rebuild / health record and make an inference. Enfamil told me what list they used and I bought it, it contained a bunch of information including my wife’s. I also know everyone in my zip code who had diabetes in 2015.

There’s even more intrusive stuff around opioid surveillance.

I'm sorry for your loss. Shit.

> Emfamil samples...

Insult to injury. They're all just ghouls. Profitting from other people's pain.

> what list they used

Who watches the watchers? Nobody.

We had an instance of Lexis/Nexus' (formerly Seisent) demographic database to play with. Most people just can't wrap their heads around how bad things were in the mid-aughts. I was called a "sweaty paranoid kook" by our local paper for simply describing how things worked (no opinion or predictions).