Facebook Was in Talks With Top Hospitals Until Last Month To Share Data of Most Vulnerable Patients (cnbc.com)

Facebook was in talks with top hospitals and other medical groups as recently as last month about a proposal to share data about the social networks of their most vulnerable patients, CNBC reported on Thursday. From the story: Facebook was intending to match it up with user data it had collected, and help the hospitals figure out which patients might need special care or treatment. The proposal never went past the planning phases and has been put on pause after the Cambridge Analytica data leak scandal raised public concerns over how Facebook and others collect and use detailed information about Facebook users. "This work has not progressed past the planning phase, and we have not received, shared, or analyzed anyone's data," a Facebook spokesperson told CNBC. But as recently as last month, the company was talking to several health organizations, including Stanford Medical School and American College of Cardiology, about signing the data-sharing agreement.

Comments

Hashing and anonymity

[b0s0z0ku]

If it can be matched up with real-world profiles, it's no longer anonymous. If the hashing DOESN'T work correctly, the wrong people could be labeled with health conditions, and God forbid this data is re-sold to insurance corepirations.

This seems like a HIPAA nightmare, and if this goes forward, this needs to be slapped with a restraining order by HHS. This is a borderline criminal idea and should be treated as such.

Re: Hashing and anonymity

[Anonymous Coward]

HIPAA like most laws is around to be wield like whip towards the peons. Monied interests like Feciesbook have little to worry about.

Re: Hashing and anonymity

[b0s0z0ku]

Depends who's in charge. I dislike Trump's authoritarianism, but think his hatred for the tech industry is useful. If he can destroy or slow down the growth of the ad-supported, privacy-sucking tech firms like Facebook, Google, Microsoft, Apple, Amazon, etc, then that will be one of the few good things his administration has done.

Re:Hashing and anonymity

[schklerg]

Indeed, HIPAA will do nothing to protect your privacy in these situations. If a hospital decides it wants to share everything about you with North Korea, it's all cool as long as they sign the right contract and can self justify it. If an insurance company wants to get all of your data from the local casino, even easier. In theory, I guess this should make people think before they throw your personal data around, but all it really does is create a paper trail.

Re:Hashing and anonymity

[mysidia]

Indeed, HIPAA will do nothing to protect your privacy in these situations.

HIPAA prevents your Medical Provider, Insurance company, or other covered entity from RELEASING or DISTRIBUTING your medical records/Protected Health Information. It does NOTHING to restrain them from GATHERING or IMPORTING records/data about you from other sources such as Facebook.

Facebook is not a covered entity under HIPAA, because they aren't any kind of medical provider ---- so they aren't regulated in any way by HIPAA; therefore if you post something related to your own health there on your own Facebook page: they can share it however they want according to the Terms of Use that users agree to when using Facebook's website. There's nothing that would prevent Facebook from distributing your information to a
  Hospital.

Re: Hashing and anonymity

[PopeRatzo]

I dislike Trump's authoritarianism, but think his hatred for the tech industry is useful. If he can destroy or slow down the growth of the ad-supported, privacy-sucking tech firms like Facebook, Google, Microsoft, Apple, Amazon, etc, then that will be one of the few good things his administration has done.

Does he want to "destroy or slow down the growth" of these companies, or bend them to his will?

He didn't seem to have any "hatred for the tech industry" when it comes to what Robert & Rebekah Mercer are doing with Cambridge Analytica.

Re:Hashing and anonymity

[b0s0z0ku]

Except the article summary implies that the anonymized medical records would be released to Facebook, which would then attempt to match them with profile information. If they can be matched, they're not anonymized enough -- thus, HIPAA violation.

Re: Hashing and anonymity

[CanHasDIY]

The definition of a useful idiot, in fact!

Re: Hashing and anonymity

[b0s0z0ku]

Frankly, Obama was less authoritarian, or at least in the right places.

He made an attempt to fix the corporate-infested parasitic US health insurance system. He hired Holder as AG, who (at least temporarily) rolled back civil forfeiture, also known as legalized theft by police. He pushed for sentencing reform and wasn't always on the side of law enforcement or the military. He chose to allow states to have their own marijuana policy.

Obama was a welcome change from the Bush era, though he didn't go far enough in rectifying the wrongs of the past 30 years (wars on drugs/terror/crime) stemming from constant moral panics.

Re: Hashing and anonymity

[DogDude]

That was a shitty compromise that had to be made. The fact is that millions of people have health care now that didn't before the ACA. Do I have to say that that's a good thing?

Re: Hashing and anonymity

[b0s0z0ku]

ACA got rid of the worst pricing excesses. The fine was a token penalty.

Limiting insurance rates to being based on age, location (county), and smoking status with no more than a 3:1 spread between top and bottom tiers of a given policy was a good thing. So was guaranteed issue.

They could no longer say, "you have epilepsy, you can buy our individual insurance policy at $3000 per month."

Re: Hashing and anonymity

[b0s0z0ku]

The mandate was essentially toothless.

The salient points were guaranteed issue and limitation of pricing disparity for a specific policies to a 3:1 ratio of highest to lowest price.

Oh, and subsidies.

Even without subsidies, I can still get a low-deductible policy for about $600/mo where my deductible is $600/yr, regardless of health status. As a self-employed person, that's a good thing. Then again, my state actually cares about keeping the ACA intact.

For $500/mo, I can raise the deductible to $2000/yr, which is still pretty good. But I'm risk-averse, so I'd rather have the low deductible.

Re: Hashing and anonymity

[Humbubba]

An A.C. said

HIPAA like most laws is around to be wield like whip towards the peons. Monied interests like Feciesbook have little to worry about.

You are so right, it's scary.

In my city, the cops have a one way data flow from the hospital's computers. The idea that it is of some benefit, some 'special care or treatment' for the patient is absurd. And it's more than just data mining to match patients with crimes. It involves identity processing and crime prevention via predictive analytics, doing things like estimating emergent crime trends and matching them with pools of potential suspects. Hospital records aren't the only thing they vacuum up, it's far more intrusive and invasive. They got all of city hall's stuff for starters.

Knew the guy who developed this crime prediction software. Really impressive. He said the cops could use it to do things like run potential perpetrators out of town. But it's the other things they can do with such a tool that worry me.

What can be done to society and the individual with big data is Kafkaesque.

Re: Hashing and anonymity

[Humbubba]

b0s0z0ku says

Under HIPAA, this generally requires a warrant or specific exigent circumstances. "Open line to data" is illegal.

I am outraged at this as much as I am awestruck by these practices. If I'm reading this wrong, and this line to hospital records is illegal, someone please let me know. I am pro-privacy, in spite of the times we live in. None the less, this is how I read the law:

Under HIPAA, medical information can be disclosed without an individual's permission to "any government official at any level of government authorized to either investigate or prosecute a violation of the law." This applies to doctors, health plans, pharmacies, health care clearinghouses, medical research labs, hospitals and other health facilities. HIPAA requires no court involvement, as long as there is a written statement of relevancy. But HIPAA does not preempt state law when it comes to privacy. For example, California requires court approval, but that can be had with a search warrant, showing of probable cause, a showing of cause, or even just an administrative subpoena. [1]

No court authorization is required in my state. When coming under the care of my city's hospital, you sign a notice of privacy practices that includes law enforcement access to medical records.

[1] https://www.eff.org/issues/law-enforcement-access

Facebook versus HIPAA

[93 Escort Wagon]

Jenny Johnson is currently in Virginia Mason hospital, room 1231! If you know Jenny, click "Like" to send her your best wishes.

Re:Facebook versus HIPAA

[mrbester]

I'll text her instead. The number is still 867-5309, right?

Re:Facebook versus HIPAA

[PolygamousRanchKid]

! If you know Jenny, click "Like" to send her your best wishes.

If she gets enough "Likes" . . . she will receive proper treatment . . . otherwise, the nurses have plastic bags that fit over heads . . .

On the Bright Side

[techsoldaten]

On the bright side, such an agreement could work towards furthering our understanding of the root causes of a variety of medical and psychological problems.

Facebook is nothing but an ad-funded spy network. It gathers information about billions of people. If there is any good to come from that colossal invasion of privacy, it would be preventative care.

Re:On the Bright Side

[b0s0z0ku]

Any such study can be undertaken with customer permission.

Medical studies on unwilling subjects conducted by various authoritarian governments also helped us understand things like radiation poisoning, starvation, and hypothermia. The ends don't justify the means.

Re:Well, Trump will die in prison anyway

[Train0987]

He's one of those Russian spy trolls sent here to make Democrats look even dumber, ensuring Trump is reelected in 2020.

Re:Computers made me a luddite.

[kbonin]

Enjoy having a doctor that tries to protect your privacy while you can.
from New Hampshire: A doctor who won't use a computer loses her license to practice medicine

Re:Computers made me a luddite.

[b0s0z0ku]

Her actual issue was poor record-keeping -- excessive opioid prescriptions also played into it. BTW, local electronic medical record solutions that can be totally isolated from the "cloud"/Internet do exist, and are used.