Alcohol recovery startups shared patients’ private data with advertisers | Hacker News Reader

Alcohol recovery startups shared patients’ private data with advertisers

techcrunch.com

71 pointsnobody999916 comments

The people running companies doing this kind of thing need prison sentences. Nothing short of that will stop them, and we need people to feel comfortable getting this kind of healthcare.

Should we really have to caution people against calling a suicide/rape/crisis hotline, or seeking help for their addictions because it's possible for their wireless carrier to sell their call data, or because the service providers themselves can sell that data leaving a permanent record of a person's hardest struggles which will be used against them over and over for the rest of their lives, be seen by potential employers, or leaked to the world?

The buying and selling of our personal details has become a multi-billion dollar a year industry and it's making some people very very wealthy at our expense, but the harm we risk by allowing it continue unrestricted is too great.

Recovery programs and addiction services can be court ordered as well, so it's not like everyone will even have a choice here.

> Monument, which acquired Tempest in 2022, confirmed the extensive years-long leak of patients’ information in a data breach notification filed with California’s attorney general last week, blaming their use of third-party tracking systems developed by ad giants including Facebook, Google, Microsoft and Pinterest.

You can't claim to be surprised when you're using a bunch of services from companies whose entire business model is spying on people and then exploiting that data for profit. That sounds more like an admission of guilt than a deflection of blame to me.

I'm sure advertisers will be shoving ads for alcohol into the faces of the victims of Monument and Tempest for the rest of their lives because of this.

> The people running companies doing this kind of thing need prison sentences.

HIPAA and, if any federally-involved (even indirectly) treatment was involved, even more stringent [0] (as to disclosure conditions, the penalties are the same) special rules for the protection of federal substance use disorder patients, provide both civil penalties for unauthorized disclosures and criminal penalties for knowingly disclosing or obtaining information without authorization.

[0] More stringent, as in, for example, its still a crime to disclose information to someone with a completely valid subpoena for it, unless you have also been issued a special disclosure-authorizing court order in addition to the subpoena.

>More stringent, as in, for example, its still a crime to disclose information to someone with a completely valid subpoena for it, unless you have also been issued a special disclosure-authorizing court order in addition to the subpoena.

Can you elaborate? Does this mean that a subpoena that purports to allow seizure of HIPAA-protected data is only valid for seizure of that data if it's accompanied by a court order saying "Yes, this subpoena includes HIPAA-protected information"? Sort of a safeguard against HIPAA data being included unknowingly in subpoenaed materials?

This is for federally-involved substance use disorder patient info, which is protected beyond HIPAA, but, yes, it means information related to them that is subpoenaed or subject to similar otherwise-compulsory disclosure cannot be disclosed (or even responded to in a way which would confirm that a person is a patient, if the form of the compulsory demand is, e. g., fot records of a particular person) without a separate court order specifically authorizing disclosure of federal substance use disorder patient records.

(Note that a judge has to issue the order here, whereas the lawyer for a party — the biggest concern here being the government — can issue a subpoena, and there are also legislative and administrative subpoenas.)

> Sort of a safeguard against HIPAA data being included unknowingly in subpoenaed materials?

It’s more a prevention against otherwise-valid subpoenas being used to end-run the protection of SUD patient data, especially for the ultimate use of law enforcement.

you are completely right AND.. the chances of this being real are less every day. Some people yelled to the rooftops about phone-ID-ads triangulation but no, the money is so important.

People-as-cogs flies in the face of the Western sensibility, but WEIRD is only less than five percent of humanity. Plenty of people in plenty of places are very well accustomed to this kind of "sell the weak people for silver" mentality.

Ironically, on the same page of HN:

Business 30 under 30-year sentences: why so many of Forbes’ young heroes face jail

https://www.theguardian.com/business/2023/apr/06/forbes-30-u...

Of course they did.

It’s Silicon Valley, where the baseline expectation is that company founders don’t even know what ethics and integrity mean.

SV Cyberpunk dystopia edition will be fascinating to watch from the outside.

something seems wrong about "alcohol recovery startups" like in a 'what stage of capitalism is this' way

I get that sense from most healthcare startups. The problem with healthcare is all the grifting. Let's add another grifter!

You have just defined the essence of capitalism, where everyone strives to be a middleman

that rent ain't gonna seek itself

you jovially shout that, but I heard a wealthy US physician describe in a well-practiced tone "now we have an en-tre-pre-neur in the loop" .. like it was a cockroach. This is not new, and that US AMA Physician had more money in his 401k than most people make in their lives.

Imagine being ordered by a court to be their customer if you want leniency in your sentencing.

not unrelated:

BetterHelp, Teladoc’s online therapy business, will be barred from sharing data, including about mental health, for advertising purposes, the Federal Trade Commission said Thursday in a statement...

FTC press release[0] (2 March 2023) on the case you mention...

[0]https://www.ftc.gov/news-events/news/press-releases/2023/03/...

Reply on news.ycombinator.com