Hacker News Reader

Comment by josefritzishere | Hacker News Reader

How is this not a HIPAA violation?

HIPAA applies to healthcare professionals and providers, not ad tech companies. And race and citizenship are not personal health-related data.

That's not actually true. It applies to health care data. If you're a software engineer making a system that includes HIPAA-protected data, you can face individual criminal liabilities for mishandling the data.

No, not really. If you are not a covered healthcare entity, or a business association of a covered healthcare entity, the law simply does not apply to you at all.

Also, I believe (but am not certain) that if there was any criminal case, it would be leadership (C*O) not individual software engineers who would be charged. This is speculation on my part, if anybody has clear facts I'm happy to hear them.

It might be a HIPAA violation, depending on the details of the data being shared. Several other healthcare websites have gotten in trouble over the same thing: https://techcrunch.com/2023/04/17/pixel-tracking-hipaa-start...

It is if it connects an individual to an explicit health outcome or category.

HIPAA as a law is intended to ease transfer of medical information, not restrict it.

That's not true. It's intended to define a regulated and standard means of transferring medical information while ensuring confidentiality and patient privacy.

https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg...

You have to explicitly grant permission for your data to be sold. What's very likely is that either the healthcare provider or insurance company included a request for authorization to sell that data, and the authorization was signed without paying much attention to it.

You're referring to the privacy rule, which is only part of the law (and not its primary prupose). The original intent of the law was to ensure easy transfer of information to keep health coverage when changing jobs. The privacy rule was not even part of the original law, it was added by HHS 3 years later. See more details here: https://www.ncbi.nlm.nih.gov/books/NBK9576/

The article you cited states congress was aware of privacy concerns at the time and covered them as part of the third stated provision.

You wouldn't need such a modern privacy rule if it weren't for the need for information portability in the digital age. The distinction between whether or not portability or privacy is primary in the law kind of doesn't matter. The real purpose of HIPAA was to help make the newly emerging market forms of health care sustainable. Protocol standardization and modernization of the Hippocratic Oath were both necessities, technical and ideological respectively.

"The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a US federal law designed to protect sensitive patient health information from disclosure without consent."

That's not really correct. It was designed for portability- the ability to move data between health care providers.

(I work in healthcare-adjacent and have met with many lawyers and had to explain them all about "HIPAA compliance"; my comment was not made from ignorance, but practical experience based on learning about how the law is used. There is a privacy rule in it, but that was not the real intent of the law. The intent was to make it easy to keep your health care when you moved between jobs.)

Could you please cite the source for that quote? I looked for it, but couldn't find a source; it seems like an AI hallucination.

Why would you call it an hallucination because you cant find immediately locate the source? You didnt say what in the single sentence would make you jump to that conclusion.

I highlighted SirFatty's text, looked up on google and first result show it near verbatim on cdc.gov.

https://www.cdc.gov/phlp/php/resources/health-insurance-port...

Here's the original text of the bill's purpose; very little of the bill talks about privacy, and most of the rules around that are part of the HHS Privacy Rule.

To amend the Internal Revenue Code of 1986 to improve portability and continuity of health insurance coverage in the group and individual markets, to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, to simplify the administration of health insurance, and for other purposes.

Narrator: "But it did neither."

Honestly, we're better off with it than without it, speaking as someone with exposure to that industry's internals. That act drives a lot of good security practice within the organizations (mostly liability shifting, but still good). Specifically, the fear it instills of ruinous penalties from regulators drives good practice adoption, IME.

Further, multiple crappy patient portals across providers is a crummy experience, but it's an improvement over the world where providers held the data hostage and had zero interest in accommodating your requests for it, or even the idea that you owned it.

The second “P” in HIPAA stands for “Privacy”

I wonder if that's why so many people write it as HIPPA.

That's because it's very similar to the name of an animal which is not called a hipoo.

Reply on news.ycombinator.com