Hacker News Reader

Hacker News

Comment by tuwtuwtuwtuw | Hacker News Reader

Parent Full thread

tuwtuwtuwtuw

Who are the "many" that consider file name PII?

View on HN

sisters_graduation_2019.jpg

Rebecca_Range_will_and_final_testament.pdf

NadyaNayme - Resume - [Company Name].pdf

divorce_process.pdf

steps-to-take-after-a-car-accident.pdf

personal_injury_michael_perez_west_coast_trial_lawyers.pdf

embarassing_porno_filename.mp4

And this is a smalls subset of filenames that could not only provide PII but also potentially embarrassing or private information that isn't identifying but would be accompanied with files that are personally identifying.

Well said, nadya

Just from looking at my own documents folder, "Stephen Tordoff - ESA Appeal SSCS1.pdf". That would reveal that I have a disability, and that I am (or have) claiming benefits for it. Not everyone would be happy with that being public knowledge, and I'd be less that thrilled if things like it were shared with Facebook for no reason.

URLs, of which file names could be considered a subset, are definitely considered PII.[0]

[0] https://cphs.berkeley.edu/hipaa/hipaa18.html

I’ve worked for multiple FAANGs and can assure you that all have considered file names to be PII. Pretty much anything that contains user input should be treated as PII.

Lawfirms often utilize automatic content-derived filenames, up to the maximum OS-supported limit. As a result you'll find all sorts of private information in the filenames within their backups.

I should also mention, those automagic naming schemes use the beginning text in the document. So it's basically the personal details of plaintiff vs. defendant.

I've also seen similar schemes used by doctor offices/hospitals, where you'll see the patient name and ailment. I once had to troubleshoot a backup problem for what turned out to obviously be an OB-GYN. Imagine my horror as I saw long filenames containing patient names and common STDs scroll by in the thousands.

I would generally consider a filename to be the kind of field that could easily contain PII.

Names or identifiers are the kinds of things that very often end up in file names.

    Sexual Harassment Complaints/Persons Name.doc

...

Read the law strictly enough and you can put health information in the file name and now you’ve forced Facebook to deal with HIPAA.

That’s taking it to the extreme, but it’s technically correct.

No, that’s neither true nor “technically correct”. Services that the user provides health information to for their own purposes aren’t considered covered entities or their business associates, and thus HIPAA rules don’t apply. This is why Dropbox, and GMail don’t have to be HIPAA compliant.

If you say “Read the law strictly enough” please do...

You might be right, I believed I saw some definition that simply stated that "system receiving or storing PHI" would be required to be HIPAA complaint, regardless of how the data got there.

I'm still wondering, because Backblaze will sign a BAA (their website says so), making them a business associate. I'm not talking about some private person uploading their own documents. My concern is that given that Backblaze will sign a BAA, then some companies must be using Backblaze and potentially storing PHI data there. Yes?

Backblaze then need to follow: "§ 164.312 Technical safeguards. (e)(1) Standard: Transmission security. Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network."

Facebook isn't authorized to access this data, but that might be more of a problem for Backblaze, even if Facebook could be required to delete the data.

Yeah, that seems like it would be on Backblaze, but this might not apply here, as 164.312 only applies to PHI, and it's quite likely that Backblaze will only sign a BAA for their B2 service, and not their standard backup service.

HIPAA only applies to healthcare providers and a couple related industries. Facebook is not there (yet).

John_smith_college_graduation.jpg

John_smith_doctored_college_graduation.jpg

Reply on news.ycombinator.com