> It seems like Apple's interest in health data is an important part of their unusual concern for user privacy. The less secure the phone, the more problems they'll have with something like HIPAA.

Not really - I don't see a way in which any of Apple's statements or motions with regard to user privacy have any implications for HIPAA compliance.

HIPAA is a really arcane law, and it actually largely wouldn't even apply to the sorts of stuff being discussed here, because HIPAA doesn't cover anything that happens after the user receives the data. Broadly speaking: if it's encrypted in transit, once it reaches the phone, it doesn't matter if the phone is compromised or not; that wouldn't be a HIPAA violation either way.

It might matter if iCloud is breached (ie, their encryption is cracked).

But since HIPAA doesn’t apply to what patients do with their own data that is not as applicable. For example, if I add my medical record to Dropbox and it gets hacked, that isn’t a hipaa issue. But if my doctor puts my medical record in Dropbox and it gets hacked it is and either my doc or Dropbox have to handle the breach notification per hipaa.

Does HIPAA motivate hospitals to take security seriously? The recent outbreaks in cryto-ransomware seem to suggest the answer is 'no.'

Having experience with hospital IT working for an outside vendor before HIPAA had much impacted practice (though after it was adopted), yes, I think it's made them take it much more seriously. That's not to say it's good now, but if you hadn't experienced it you probably can't imagine how bad it used to be.

They take HIPAA seriously (because there are fines), but that is definitely not the same thing as taking security seriously.

That's a big thing that many don't seem to understand: there is a massive gulf between compliance and security.

Yes--HIPAA provides a mechanism for fines to be levied against (most) healthcare organizations that suffer data breaches through the office of civil rights (OCR), with a public reporting of organizations that have been penalized.

https://www.hhs.gov/hipaa/for-professionals/compliance-enfor...

> Yes--HIPAA provides a mechanism for fines to be levied against (most) healthcare organizations that suffer data breaches through the office of civil rights (OCR), with a public reporting of organizations that have been penalized.

Unfortunately, HIPAA is an incredibly rigid, incredibly broad law, and it's applied to a field in which security practices are incredibly inconsistent.

As a result, HIPAA violations are pretty commonplace, and the vast majority are never reported to HHS, let alone penalized.

the method they get data is patient mediated, so they are not beholden to hipaa laws. we use the same method at 1uphealth to bring clinical data from health system records to app developers and patients