> Neither patients nor doctors have been notified
I guess this isn't a HIPAA violation?
I guess this isn't a HIPAA violation?
... privacy experts said it appeared to be permissible under federal law. That law, the Health Insurance Portability and Accountability Act of 1996, generally allows hospitals to share data with business partners without telling patients, as long as the information is used “only to help the covered entity carry out its health-care functions.”
That is a very broad statement within HIPAA and subject to interpretation, which leaves a huge door open for marketers to "help covered entities carry out their health-care functions"
Something is seriously broken with a system that lets them give away your health data without your consent, and the lack of anonymization only compounds the injury.
Basically, a hospital can give data to a partner if it has to in order to deliver care. But it was meant for, just as a for instance, your doctor gives a few DICOM studies to GE because they are going to concert on modifying the settings on a CT scanner to do some wiz-bang thing everyone thinks will help the patient. (Maybe even other patients down the line?)
Giving it to Google so they can serve you ads, er, um, I mean, "recommend different treatments" to you, kind of stretches the letter of the law. And definitely breaks the spirit of the law in my opinion.
The letters in HIPAA stand for "portability" and "accountability." Privacy doesn't show up anywhere in the acronym. While privacy's importance in healthcare is important and is codified in other laws, HIPAA's whole deal is to try and standardize a system by which those other laws can be followed, not "guarantee consumer privacy" as an end of HIPAA law itself.
Is that actually allowed without patient consent?
Not really sure how Google finagled their access? It's odd when neither the doctor, nor the patient knows. I wonder if even the hospital administrators knew? Or is this a decision that was made at the system level and the average hospital CEO at Ascension was none the wiser?
For all you know, you're signing away for an assisted suicide and authorizing your organs to be transplanted. I refuse to sign on the pad, I'm the patient who asks for it to be printed out on paper, signs it, and gets a copy too.
If you are consenting data for a trial or otherwise sharing with a company for development, someone (often paid for separately) will typically come and walk you through the consent form.
This is unusual.
And using it to serve you ads would be a clear violation of the law.
Nobody is serving ads with this data. Sheesh.