Slashdot Mirror
Facebook Was in Talks With Top Hospitals Until Last Month To Share Data of Most Vulnerable Patients (cnbc.com)
Facebook was in talks with top hospitals and other medical groups as recently as last month about a proposal to share data about the social networks of their most vulnerable patients, CNBC reported on Thursday. From the story: Facebook was intending to match it up with user data it had collected, and help the hospitals figure out which patients might need special care or treatment. The proposal never went past the planning phases and has been put on pause after the Cambridge Analytica data leak scandal raised public concerns over how Facebook and others collect and use detailed information about Facebook users. "This work has not progressed past the planning phase, and we have not received, shared, or analyzed anyone's data," a Facebook spokesperson told CNBC. But as recently as last month, the company was talking to several health organizations, including Stanford Medical School and American College of Cardiology, about signing the data-sharing agreement.
Indeed, HIPAA will do nothing to protect your privacy in these situations.
HIPAA prevents your Medical Provider, Insurance company, or other covered entity from RELEASING or DISTRIBUTING your medical records/Protected Health Information. It does NOTHING to restrain them from GATHERING or IMPORTING records/data about you from other sources such as Facebook.
Facebook is not a covered entity under HIPAA, because they aren't any kind of medical provider ---- so they aren't regulated in any way by HIPAA; therefore if you post something related to your own health there on your own Facebook page: they can share it however they want according to the Terms of Use that users agree to when using Facebook's website. There's nothing that would prevent Facebook from distributing your information to a
Hospital.
Except the article summary implies that the anonymized medical records would be released to Facebook, which would then attempt to match them with profile information. If they can be matched, they're not anonymized enough -- thus, HIPAA violation.