Hospitals Are Mining Patients' Credit Card Data to Predict Who Will Get Sick
businessweek.com
businessweek.com
So here is my question: Do stores REALLY pass on an itemised list to the credit card processor? Because it was always my understanding that all they passed upstream was the amount and the name of the establishment.
This article claims: "Imagine getting a call from your doctor if you [...] make a habit of buying candy bars at the checkout counter"
I don't think that data exists outside of the specific convenience store where you purchased the candy. The CC company would know that you spend an extra $1 at that place, but how do you tie that into bad eating habits? Maybe they purchased an apple or a cup of coffee.
I'd really love some insight on this topic, and I will happily admit that maybe my information is either out of date or just flat out wrong.
I don't recall if a single merchant may/must offer different codes depending on the type of goods sold (i.e., a gym selling a membership vs selling a soda). I believe not, but it might be an option.
The only place that would get such itemised info is the multi-store loyalty cards; those do link a person to itemised purchases.
If you search for the Safeway grocery store at 14444 124th Ave NE Kirkland WA 98034 - the data level cell contains 'Level III Line Item'. I believe this means that at least for Visa, that store is using level 3 credit card processing and line item receipts are reported to Visa.
What I don't buy is that people's habits will generally predict their health situation. I think this is a report on a press release of what some medical business association imagines that the person that they're hoping to recruit from somewhere will be able to do. I think the benefits will end up far lower than the costs.
FWIW, none of the stores I go to have loyalty cards, though I'm pretty sure that they could do matching based on hashed card values or the name they get back from the card. (That's could, not that they do. I'm not sure if PCI would look at them sideways for hashing card values and using that as a key for a data store)
And if your program really catches on, you can get other retailers to sign on, creating a side business, or spin it off as a separate business if someone is willing to pay you for it (it's easy to segment off from your core business).
The norm with grocery stores though seems to be more in the vein of giving instant savings to card holders. Some chains (Safeway out West is one of them I think) have so many and such deep special prices that I have a card even though I only shop there on vacation sometimes.
(Interestingly, Shaws--which is an Eastern US chain now owned by European company I believe--discontinued their card in this vein a few years back.)
The only loyalty card I actually use is the coop feed store, I think the hardware store might have one too, but I've never bothered with that.
Does the California law only require disclosure of leaks of financial information, or do businesses finally start taking proper security measures (and/or airgapping) when there is business intelligence at hand?
Once you have any security in place, it's probably more complicated to NOT include your payment database in it. PCI auditer will actively inspect your payment database attack surface.
One part of level 3 processing is a line item list of what was purchased. So if it is true that there are stores using a payment system that routinely transmits level 3 information for consumer purchases then it would follow that the credit card processor does currently have the information on exactly what you are buying from those particular stores (not just the merchant and the total amount).
I just did a quick minute or two of web searching and didn't see a trustworthy looking link describing the practice of level 3 card processing for consumer purchases. Maybe someone with experience in the card processing industry could comment on this?
If you look through Visa's supplier locator at https://www.visa.com/supplierlocator/ you can search for a business (or category of business) at a particular address or zip code. It will tell you the MCC (category) and appears to also show the data level reported to Visa.
I looked up Safeway grocery stores near Seattle. If you take a look at the one at 14444 124th Ave NE, Kirkland WA 98034 the data level is 'Fleet, Level III Line Item, Level III Summary'. I take this to mean that anyone using a Visa card at that particular Safeway will have their line item receipt sent to Visa. I would be surprised if the other credit card processors don't have setups like this as well.
The exploration into cardholders’ minds hit a breakthrough in 2002, when J. P.
Martin, a math-loving executive at Canadian Tire, decided to analyze almost
every piece of information his company had collected from credit-card
transactions the previous year. Canadian Tire’s stores sold electronics,
sporting equipment, kitchen supplies and automotive goods and issued a credit
card that could be used almost anywhere. Martin could often see precisely what
cardholders were purchasing, and he discovered that the brands we buy are the
windows into our souls — or at least into our willingness to make good on our
debts. His data indicated, for instance, that people who bought cheap, generic
automotive oil were much more likely to miss a credit-card payment than someone
who got the expensive, name-brand stuff. People who bought carbon-monoxide
monitors for their homes or those little felt pads that stop chair legs from
scratching the floor almost never missed payments. Anyone who purchased a
chrome-skull car accessory or a “Mega Thruster Exhaust System” was pretty likely
to miss paying his bill eventually.
Martin’s measurements were so precise that he could tell you the “riskiest”
drinking establishment in Canada — Sharx Pool Bar in Montreal, where 47 percent
of the patrons who used their Canadian Tire card missed four payments over 12
months. He could also tell you the “safest” products — premium birdseed and a
device called a “snow roof rake” that homeowners use to remove high-up
snowdrifts so they don’t fall on pedestrians.
Though they might try hanging on to their customer's credit-card details a bit more successfully.
dont be evil, anyone?
[1]: https://developer.paypal.com/webapps/developer/docs/api/#ite...
The problem is that unhealthy lifestyles (drinking, smoking, fast food, &c) are disproportionately found among the lower socioeconomic strata, creating yet another penalty for being poor.
A single-payer system would have similar incentives (in the form of cost reduction) to do the same.
Vanderbilt University economist Kip Viscusi claims a net cost savings of 32 cents per pack sold [1]. It seems we're all going to die, and Alzheimer's isn't part of the quick and easy way out of healthcare cost. And at the ripe age of 125 or so, 100% suffer cancer.
1. http://usatoday30.usatoday.com/news/health/2009-04-08-fda-to...
See, for example, http://aje.oxfordjournals.org/content/155/8/732.full
for the negative correlation between smoking and Parkinson's disease, and
http://ajcn.nutrition.org/content/87/4/801.full
for some insights into the negative correlation between smoking and obesity.
Not to say that smoking is a good idea, it's not (actuarial data are clear on that), but your view of its consequences is inaccurate.
That said, I'm not opposed to smokers paying higher premiums — but that practice already exists, based on policyholder disclosure, or rescission in the event of fraud. (I say that as a former smoker, who did disclose my habit, and paid a substantially higher premium because of it.) We don't need carriers trolling through peoples' transaction history to dredge up every possible excuse for hiking premiums, because that's exactly what they'll do.
Yes, it's true that sometimes you can find healthy stuff for relatively cheap. It's also true that you cannot do it consistently, in order to "eat cheap" in a consistent manner, it means constantly hunting for those deals, which implies trading your time for money. This is something the poor do a lot of, sitting at a laundromat instead of just throwing clothes in a washer, for example.
And I don't want to hear about eating some form of beans 5 days/week, eating healthy implies variety.
It can occassionally be done as cheaply as eating unhealthily, but not consistently over time. Your food bill will go up.
> And I don't want to hear about eating some form of beans 5 days/week, eating healthy implies variety.
Vegetables can be pretty cheap, if you stick to what's in season. Beans are a good start, add lentils, potatoes, carrots, etc. Offal makes for cheap protein (but is not to everyone's taste).
As cheap as eating unhealthily? no.
Stress is usually self-inflicted. There are good reasons to subject yourself to stress, and there are bad reasons.
If they perfectly assess risk, your annual premium will just be your annual cost plus all of the administrative costs of insurance, so just self-insure. We're getting closer and closer to that, further eliminating any value that anyone gets from insurance.
I think what you're trying to say is that the aggregate risk remains the same under mandatory coverage, put that's going to be true no matter what and the effects of this risk can be optimally spread through insurance.
As an example, say $180 billion dollars worth of damage is done to 1 million homes in the US through natural disasters every year. With 300 million people in the US, mandated insurance would have everyone pay $600 a year to cover these damages. No insurance would mean you paid nothing unless your house was affected, at which point you lost on average $180,000. Insurance exists to pool the risks of these life-destroying events.
Insurance definitely isn't going away, in fact our capability to insure against a wide variety of events is in its infancy. The insurance market will only get more and more sophisticated. Hank Greenberg has some interesting thoughts on the direction of the industry.
Let's talk outcomes and efficiency, and not pretend charging doctors $39 to file "insurance" paperwork is anywhere close to optimal.
And, yes, aggregate risk for people will not change, as we, unlike our tools (e.g. a house), are only at equilibrium when we are dead.
Insurance companies that can better predict customer risk outcompete those that don't. They can charge less for lower-risk customers and still make a profit, thus drawing them away from their competitors and leaving their competitors with higher risk people who pay too little.
Yet, the end game is that everyone can predict risk so thoroughly that insurance is pointless.
It's ultimately a weird, backwards Tragedy of the Commons, and various non-discrimination laws are sort of the regulatory response to it.
Only, those don't help, if people know how high their own risks are and if they can still decide whether to sign on.
Not true. Suppose you have a 0.01% chance of needing a $10M treatment in your lifetime. First of all you can't say, "Oh I'll just self insure" because few people have $10M. Second, you may decide that paying $10,000 over the course of your lifetime is preferable to risking a payment of $10M.
Removing uncertainty doesn't eliminate the need for insurance, it just reduces the opportunity for risky subscribers to socialize their risk, and for insurance companies to reap gross profit.
In the first, the insurance company would know, with certainty, who falls into that 0.01% category, and charge them $10m for insurance in their lifetime.
In the second, the insurance company, with certainty, would know what year the treatment is needed, and charge a $10m premium for that year only.
Insurance companies are identifying things like "Driving at night increases risk of accident". They are nowhere close to, "A blue corvette driven by a 43 year old male will rear-end a ford pinto today"
Those with above average current and past health status should enrol into the very least amount of insurance they can get away with.
If they perfectly assess risk, your annual premium will just be your annual cost plus all of the administrative costs of insurance
The idea of insurance is pooling risk. So if you're perfectly healthy you are in essence paying for other people's treatment.
However, if you happen to run into very expensive health issues it's you that profits from the premiums of other people.
If insurance works as you describe it it wouldn't make sense at all and everybody would individually be responsible for her entire medical cost. With partially ruinous consequences for the individual.
I think that's his point.
We are never going to reach a point where we can accurately predict whether someone will be hit by a bus or shot.
And better at real-time charging and paying for insurance in micro-increments. Predicting over the course of a year is hard, over the next microsecond, not so much.
Going to the gun range? Your insurance premium just went up by $6/hour. Speed in your car? Slam on your brakes suddenly? Driving quickly in heavy traffic? Drive at 3AM on Saturdays?
If you're suggesting that an annual physical exam is the risk mitigation equivalent of a car alarm, then GEICO should have eaten the extra cost for purchasing a car with one installed instead of charging a lower premium because you have one.
I mean, insurance doesn’t cover everything, obviously, but that mostly applies to nice to have things or aesthetic things that aren’t really necessary (e.g. root canal treatment for wisdom teeth is not covered – pulling wisdom teeth if the caries is causing problems that can’t be solved with fillings anymore is, glasses are not covered, etc.).
This is coming from somebody who was raised in a very poor family so it's got nothing to do with not caring about poverty. It's just these sort of liberal ideas you could hear at an occupy protest show zero understanding of economics and are basically just bitching about companies.
Nobody ever said it was their fault.
The story behind how Kaiser healthcare was founded (providing health services for workers on the Hoover Dam) is pretty interesting.
How long before someone sues a hospital for 'negligence' for knowing the future and not letting the patient know?
[0] https://en.wikipedia.org/wiki/Health_insurance_cooperative
My credit card statement just shows a store name, timestamp and amount. They'd presumably have to be colluding with the grocery chains to get the sort of information mentioned in the article.
Store loyalty programs do track SKU-level purchases. There was a case years ago where a patron tripped and fell at a store, and filed a personal injury suit. The store pulled up that person's loyalty program records, noted that they'd been purchasing a larger than average amount of alcoholic beverages, and insinuated at trial that the patron might have been drunk.
Guess who won that case.
The data might not be perfectly accurate but it can leak a lot of probable information.
If you ran a machine learning algorithm on the data, without knowing how much anything cost and just wanted to correlate certain purchase amounts with whether people tended to get sick or not, you would probably find correlations with certain amounts that happen to correspond to things like cigarette purchases.
This is especially likely because people often tend to buy only cigarettes, or maybe a couple of other things, rather than only buying them along with a larger group of items that would tend to disguise the purchase.
It should be pretty easy to spot the difference in average prices between someone buying a packet of cigarettes, vs a bar of chocolate, vs a weeks' worth of shopping. It might not be super accurate for each data point, but given enough data it's likely some fairly consistent patterns will emerge.
In fact, one of the things about ML is that it's good at spotting all sorts of correlations. Those don't prove the existence of a causal link, but often that doesn't matter: the fact a correlation exists is enough. So simple things like buying patterns might be correlated with certain tendencies or risk factors, regardless of what the contents of the purchases actually are (of course this is purely hypothetical).
Maybe you wouldn't be able to tell precisely what someone bought, but I imagine you could get a reasonable idea.
Not that I don't imagine - the article and rosser say as much - that they have other sources of info.
[1]: https://developer.paypal.com/webapps/developer/docs/api/#ite...
Obviously, some purchases are more obvious than others - but it's safe to assume that if there's a profit to be made regarding selling more-specific information about each purchase, then businesses looking to increase their bottom-line will seek to opt-in to selling that information.
What I expect to see is for it to star as an opt-in choice by consumers. Want a lower health-insurance rate? Opt-in to this program where we see where you're eating and if you're going to the gym. You're starting to see it in the auto-insurance industry where insurers will give you a safe-driver discount provided the device you attach to your car confirms you're a "safe-driver". But eventually I'd bet it will be a requirement for auto insurance. They're pushing to mandate auto "black-boxes" in every car. Right now, that data requires a court order to obtain in an accident, but how does that change when every car is connected? Does that data live with the vehicle, or is it sent to a remote location "for the safety of the data in case of a crash" or whatever spin they put on it?
Here's the car-dongle I mentioned: http://www.progressive.com/auto/snapshot/
http://blogs.wsj.com/digits/2014/05/14/data-broker-acxiom-mo...
"The data-gathering has stirred privacy concerns. The Wall Street Journal reported in 2010 that Rapleaf, the former parent company of LiveRamp, had amassed databases tying people’s real names to privately shared information in their Facebook profiles, as well as data in their voter-registration files, real-estate titles, shopping histories, and other records. The company was censured by Facebook for the practice, which involved pulling data from apps against the social network’s rules."