Hacker News Reader

Comment by bilbo0s | Hacker News Reader

There is a loophole in HIPAA.

Basically, a hospital can give data to a partner if it has to in order to deliver care. But it was meant for, just as a for instance, your doctor gives a few DICOM studies to GE because they are going to concert on modifying the settings on a CT scanner to do some wiz-bang thing everyone thinks will help the patient. (Maybe even other patients down the line?)

Giving it to Google so they can serve you ads, er, um, I mean, "recommend different treatments" to you, kind of stretches the letter of the law. And definitely breaks the spirit of the law in my opinion.

View on HN

It's not even really a loophole.

The letters in HIPAA stand for "portability" and "accountability." Privacy doesn't show up anywhere in the acronym. While privacy's importance in healthcare is important and is codified in other laws, HIPAA's whole deal is to try and standardize a system by which those other laws can be followed, not "guarantee consumer privacy" as an end of HIPAA law itself.

It's not really a loophole, it's kind of the whole point of the law. It's purpose was to establish standard, regulated methods for sharing health data between organizations.

And using it to serve you ads would be a clear violation of the law.

> Giving it to Google so they can serve you ads

Nobody is serving ads with this data. Sheesh.

> your doctor gives a few DICOM studies to GE because they are going to concert on modifying the settings on a CT scanner

Is that actually allowed without patient consent?

No. Patient consent is part of the whole "everyone thinks [it] will help" part.

Not really sure how Google finagled their access? It's odd when neither the doctor, nor the patient knows. I wonder if even the hospital administrators knew? Or is this a decision that was made at the system level and the average hospital CEO at Ascension was none the wiser?

I hate how patient consent is typically implemented. I've seen two ER's firsthand who have someone come in with a computer, ask some questions about insurance and all, then say "please sign for the HIPPA privacy form, and again to release the information to your insurance provider".

For all you know, you're signing away for an assisted suicide and authorizing your organs to be transplanted. I refuse to sign on the pad, I'm the patient who asks for it to be printed out on paper, signs it, and gets a copy too.

That's a bit different that the consent referred to above - this is the hospital covering themselves.

If you are consenting data for a trial or otherwise sharing with a company for development, someone (often paid for separately) will typically come and walk you through the consent form.

> It's odd when neither the doctor, nor the patient knows.

This is unusual.

Reply on news.ycombinator.com