We're not even three full months into 2023, and this is the second biggest? I can't even comprehend how anybody thought this was a good idea.
Really thinking that basing our economy's primary motivator on human greed isn't doing us many favors right now, not when it's so easy for bad actors to out-earn any and all penalties.
When sleepy enforcement caught up, the guy terminated all his willing sales guys with some cash to be quiet, and literally hid in his sister-in-law's basement for more than two years, with lots of money to pay bills.
How would you fix it?
Either bankrupt the company (fine is 20% of yearly revenue) or jail the executives and everyone responsible.
These aren't human beings. These are corporations: inanimate, unfeeling entities worth billions of dollars whose only point in existing is making money at your personal expense. They should think 10 times before engaging in any destructive behavior such as "leaking" patient data to advertising companies. If they're not afraid, then the fines aren't high enough and must be increased.
Of course we’re finding out repeatedly that no threatening fines don’t prevent that behavior either. :/ there’s a theoretical fine line where just enough fines will prevent such behavior but frankly I’m having a harder and harder time believing such rhetoric.
Maybe it’s the ownership of such companies that are wrong. I highly doubt Cerebral would’ve made this decision in the first place if it was owned by regular people, especially regular mental health professionals.
The greedy will just find ways to hide their greed.
In Burundi you'll probably just be captured and murdered.
The USA has very high recitivism when we throw ex convicts out on the streets homeless and broke, which is not a punishment, it's just piss-poor social management.
Norway has one of the lowestest recitivism rates in the world. They combine just punishments with actual correctional assistance for reintegration into society.
Punishments with real correctional assistance and social resources is a proven successful combination.
An uncle of an ex-girlfriend was put in jail for a MITM scheme in the construction bussiness. He was active for about 2 years until they got him. When I heard an estimate of how much he made, I went ahead and did the 24/7 hourly rate calculation for his jailtime. It was a 3 digit figure.
“The Nixon Campaign in 1968, and the Nixon White House after that, had two enemies: the antiwar Left, and Black people. You understand what I’m saying? We knew we couldn’t make it illegal to be either against the war or Black. But by getting the public to associate the hippies with marijuana and Blacks with heroin, and then criminalizing both heavily, we could disrupt those communities. We could arrest their leaders, raid their homes, break up their meetings and vilify them night after night on the evening news. Did we know we were lying about the drugs? Of course we did.” - Lee Atwater
The veracity of the quote has been questioned by Ehrlichman's family, while Vox senior correspondent German Lopez has suggested that Ehrlichman was either wrong or lying. According to Lopez:
But Ehrlichman's claim is likely an oversimplification, according to historians who have studied the period and Nixon's drug policies in particular. There's no doubt Nixon was racist, and historians told me that race could have played one role in Nixon's drug war. But there are also signs that Nixon wasn't solely motivated by politics or race: For one, he personally despised drugs – to the point that it's not surprising he would want to rid the world of them. And there's evidence that Ehrlichman felt bitter and betrayed by Nixon after he spent time in prison over the Watergate scandal, so he may have lied.
More importantly, Nixon's drug policies did not focus on the kind of criminalization that Ehrlichman described. Instead, Nixon's drug war was largely a public health crusade – one that would be reshaped into the modern, punitive drug war we know today by later administrations, particularly President Ronald Reagan...
"It's certainly true that Nixon didn't like blacks and didn't like hippies," Courtwright said. "But to assign his entire drug policy to his dislike of these two groups is just ridiculous."*
And this one deserves (in my opinion) to be punished more harshly than other things which today are already punished (you mention selling drugs, which is way better morally). The amount of people damaged by this privacy infringement is quite high.
Are people who attempted to opt out of online tracking, but got tracked anyway[0] victims? That's probably less severe than this case where a company sold health information, but it's definitely illegal in the EU and likely at least a deceptive business practice in other jurisdictions.
Are people who buy drugs and harm themselves by overdosing or spending all their time intoxicated victims? If the person is an adult and the drug is alcohol, that's not even illegal most places.
Are victims of secondary crimes victims of the illegal drug trade, of drug prohibition itself, or simply of the secondary crime? One could easily make a case for any of those.
[0] https://www.theregister.com/2023/03/03/online_privacy_tracki...
True, a lot of people are victims of their own stupid decisions. A society should still try reduce the likelihood of the stupid decisions, especially when there are obvious bad actors actively trying to increase such likelihood.
That's an interesting question whether it's fair to treat it this way. I can see valid arguments on both sides.
Also the people affected by this incident alone number in the millions.
With mental health data being at stake here, the amount of victims under this definition could also very well be non-zero.
Anyway there are a lot of crimes, that don't produce those kind of victims. If I mug someone and don't kill them or destroy their life in the process, have I not commited a crime?
The privacy infringement here is an obvious damage to the dignity of everyone affected. Wouldn't you feel victimized if I listened in on you speaking with your doctor, wrote everything down, stamped your name, address, and date of birth on it and started giving out copies of the resulting paper to random people? Which is exactly whats happening here, except my example is more harmless by a factor of a few million people and has a lot fewer data points.
I would. I would also feel victimized if you mugged me (without killing me or hurting me physically). The question we are debating here is - should you be punished equally harshly in this two scenarios? I'm leaning towards "no". If you disagree I would like to understand your reasoning.
A doctor who reveals some information on one of their patients should be treated less harshly then a mugger of one person.
A mugger who robs ten people should be treated more harshly than a mugger who robs one person.
A doctor/company who reveals thousands of patients' information can reasonably treated more harshly than a mugger of ten people, because the absolute negative impact may be greater.
No ones life is directly injured because of a data leak. It's just data, it is entirely inert on it's own. Their life is injured entirely because of what third parties do with that data.
If data leaked and there were no bad actors in the world, there would be zero harm.
Note this is not the same as being against punishing illegal sale of private data.
Absolutely. It is 100% worse than selling drugs to willing buyers. How is this even a question?
Of course we do. We, as a society, have decided that murder is a more serious offense, and assigned a punishment for each accordingly. This process has to be repeated every time a new type of crime emerges.
A breach of one's personal data is clearly less severe than a violent attack upon one's person. But the former could enable the latter (eg if information were purchased by a stalker). And it certainly increases the base level of risk from fraud and adversarial commercial contact (secretly exploiting knowledge of a target to manipulate them into a purchase/sale decision).
Now scale the individual loss up by huge numbers of people, and consider what incentives led to the information security failure. While it's sometimes practical to remediate individual losses of privacy, at scale future injuries are virtually assured. It seems to me that this warrants an application of strict liability principles.
As for restitution, in ym view not only should injured parties be compensated in cash (and much more of it), but they should also be granted, individually or by proxy, partial ownership of the offending firm; that is, existing investors should have the value of their asset significantly diluted. The loss of personal security should be reflected in a loss of financial security to the asset holders.
Directly punish executives, upper management, board members and large shareholders when their companies break the law rather than just fining the company. This could include fines, prohibitions from holding similar positions, and jail time.
Stop commoditizing ownership by prohibiting ownership of companies by non-participants. This last one would have the largest impact but is the least likely.
But, the necessary context is right in the first paragraph:
> ...more than 3.1 million patients in the United States...
So to clarify, "We're not even three full months into 2023, and 3.1 million records is the second biggest?" which is quite alarming.
Oh, it's easy. Advertisers showed people millions of dollars. People were quickly convinced of the "need" for patients to consent to having their medical information sold to the highest bidder.
They corrupt everything.
More accurately, their own corruption exposed the corruption already present in others. It just needed the right opportunity to hatch. Live for money, die by money.
(Generally speaking, it's quite common for most of us to think highly of ourselves and our moral character ("I'm a good person. I'm not Hitler!"), but under the right circumstances, many (but not all) of us would discover the flaws in our own hearts. A routine examination of conscience, and refinement or correction of defects in the conscience, is enormously helpful and essential to leading a life of moral excellence and virtue.)
According to HHS incident listing[1], the are a Business Associate. This means they handle patient data because they are contracted to do so by a HIPAA-covered entity. I've never heard of Cerebral before (and hopefully I won't again), but that likely means that their customers are the hospitals.
Cerebral is a mental health therapy app, but unlike most apps, they also prescribed medicine until very recently. They stopped after the FDA started investigating them for being a pill mill for schedule II controlled substances like adderall (ie amphetamine salts)
https://www.theverge.com/2022/5/9/23063356/cerebral-teleheal...
You can however, circumvent the spirit of HIPAA and what most people would expect for data privacy by "deidentifying" your data and monetizing it in one of many ways which are wholly inadequate and usually reversable without much effort.
Prior to that, it was just a polite suggestion.
I work in publicly funded mental health and our responses to possible/actual HIPAA breaches are monitored very closely by our funders. So even if an event occurs that is not deemed to be an actual breach, if our response/investigation/corrective action is found to be unsatisfactory, our county/state/fed contracts, foundation grants, and Joint Commission Accreditation could be altered/canceled.
Would be great to have a retrospective on this a year from now. I realize it isnt HIPPA, but from what I see from Credit Agency breaches, regulations are often just suggestions and there are no real consequences. Would be happy to see otherwise.
While infringements are taken seriously, and intentional infringement (e.g. looking up the records of a famous celebrity being treated in your hospital without reason to) results in hefty penalities, 99% sure this was a case of them using Google Analytics/Tag Manager and accidentally tagging stuff with protected PII fields. Yes, definitely a serious issue, but on my scale of "breaches I would be concerned about", this one would actually be relatively low.
However, there is apparently an addendum to the law that the State Attorney General is authorized to impose civil penalties in addition to this.
As we see, Anthem settled for $115,000,000 for a similar breach.
So, yeah, unless Cerebral gets a very lenient AG, they're done.
https://www.hipaajournal.com/court-approves-anthem-115-milli...
https://www.hipaajournal.com/what-is-the-maximum-penalty-for...
They gave it all away. They do call it "inadvertent" though.
Because Cerebral is a telehealth startup and handles confidential patient data, it’s considered a company covered under the U.S. health privacy law known as HIPAA. According to a list of health-related security lapses under investigation by the U.S. Department of Health and Human Services, which oversees and enforces HIPAA, Cerebral’s data lapse is the second-largest breach of health data in 2023.