10 ms·

As someone who currently works in healthcare tech I can tell you that taking on health records is one of the riskiest things any company could ever do. In fact

by lbacaj 6y ago

As someone who currently works in healthcare tech I can tell you that taking on health records is one of the riskiest things any company could ever do. In fact we try to keep health records as isolated as technically, and humanly, possible. For each HIPAA violation a company will be fined $10,000 dollars per customer. If ten million records on a database are part of a breach the company can be out of business. It boggles the mind that anyone would want to take on that liability. https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html https://www.hhs.gov/hipaa/for-individuals/guidance-materials...

roywiggins 6y ago
It takes more than storing medical data to be covered by HIPAA. Usually you have to be a medical provider or have a business agreement with a medical provider. If I upload an MRI scan to imgur, imgur isn't instantly governed by HIPAA. This means data harvesting companies can siphon up this stuff where they can find it. As long as they don't have a particular contractual relationship with an actual hospital, it's just like any other data, and they're not governed by HIPAA. There may be some other ways to get governed by HIPAA, but that's the general rule. It's hard to do by accident.
- londons_explore 6y ago
  Data brokers aren't interested in a couple of records here or there of x-rays from Imgur. They want millions of records with some kind of identifier, and some kind of predictive value. Eg. The number of ice creams I buy might be a good predictor of if I'll be buying diabetes treatment next year. Without all 3, your data won't be used.
zionic 6y ago
We need more laws about this for financial data, surfing history, customer purchase data, location data etc. Hoarding customer data should be a liability!
Nbox9 6y ago
As a software developer I personally refuse to work on HIPAA compliant software, because if there is a HIPAA violation I can be held liable.
- Dahoon 6y ago
  The problem with software and leaks from it is that not all software holds developers liable. It really really need to change.
  - donatj 6y ago
    I'm guessing you don't work in software. There will always be leaks, it's the nature of the beast, building things way more complicated than any single person can fully comprehend. That's why data minimization is so important, only keeping what you absolutely need.
    - qppo 6y ago
      Every single field has figured out - sometimes forcefully - how to minimize harm to consumers. From a properly grounded toaster to a bridge, other industries manage to build complex things that don't hurt people. The nature of the beast is that its nature can change. We need to stop thinking software is somehow special, we're just more careless and face fewer consequences following catastrophic failure.
      - kbenson 6y ago
        > Every single field has figured out - sometimes forcefully - how to minimize harm to consumers. I think it would be more accurate to say every field has figured out how to minimize liability from harm to customers. Data collection makes companies money, and there's little liability involved in most cases if you aren't in the health sector, so they grab all the data whether their core business needs it or not. The health sector needs some data because sharing it is vitally important, and they've shown that it takes a massive amount of time and money and complexity to do it to any acceptable level. If we had some way to accurately value our data and privacy, and laws that made it the property of the individual, we would see a change very quickly.
SkyPuncher 6y ago
As someone else who works in HealthTech, I'd expect someone else in HealthTech talking about HIPAA would mention that HIPAA only applies to Covered Entities. Doom Eternal is not a Covered Entity (unless they're doing something crazy) and would not be subject to HIPAA in any capacity. This is either an overly protective lawyer or in reaction to a different, non-HIPAA data law.

by lbacaj 6y ago

roywiggins 6y ago

It takes more than storing medical data to be covered by HIPAA. Usually you have to be a medical provider or have a business agreement with a medical provider. If I upload an MRI scan to imgur, imgur isn't instantly governed by HIPAA. This means data harvesting companies can siphon up this stuff where they can find it. As long as they don't have a particular contractual relationship with an actual hospital, it's just like any other data, and they're not governed by HIPAA. There may be some other ways to get governed by HIPAA, but that's the general rule. It's hard to do by accident.

londons_explore 6y ago
Data brokers aren't interested in a couple of records here or there of x-rays from Imgur. They want millions of records with some kind of identifier, and some kind of predictive value. Eg. The number of ice creams I buy might be a good predictor of if I'll be buying diabetes treatment next year. Without all 3, your data won't be used.

zionic 6y ago

We need more laws about this for financial data, surfing history, customer purchase data, location data etc. Hoarding customer data should be a liability!

Nbox9 6y ago

As a software developer I personally refuse to work on HIPAA compliant software, because if there is a HIPAA violation I can be held liable.

Dahoon 6y ago
The problem with software and leaks from it is that not all software holds developers liable. It really really need to change.
- donatj 6y ago
  I'm guessing you don't work in software. There will always be leaks, it's the nature of the beast, building things way more complicated than any single person can fully comprehend. That's why data minimization is so important, only keeping what you absolutely need.
  - qppo 6y ago
    Every single field has figured out - sometimes forcefully - how to minimize harm to consumers. From a properly grounded toaster to a bridge, other industries manage to build complex things that don't hurt people. The nature of the beast is that its nature can change. We need to stop thinking software is somehow special, we're just more careless and face fewer consequences following catastrophic failure.
    - kbenson 6y ago
      > Every single field has figured out - sometimes forcefully - how to minimize harm to consumers. I think it would be more accurate to say every field has figured out how to minimize liability from harm to customers. Data collection makes companies money, and there's little liability involved in most cases if you aren't in the health sector, so they grab all the data whether their core business needs it or not. The health sector needs some data because sharing it is vitally important, and they've shown that it takes a massive amount of time and money and complexity to do it to any acceptable level. If we had some way to accurately value our data and privacy, and laws that made it the property of the individual, we would see a change very quickly.

SkyPuncher 6y ago

As someone else who works in HealthTech, I'd expect someone else in HealthTech talking about HIPAA would mention that HIPAA only applies to Covered Entities. Doom Eternal is not a Covered Entity (unless they're doing something crazy) and would not be subject to HIPAA in any capacity. This is either an overly protective lawyer or in reaction to a different, non-HIPAA data law.