I can tell that you don't work in healthcare, or with janitors, or you'd know that they need to know most of this stuff.
It's the janitors that have the keys to everything. It's the janitors that know which bins go to the sanitation department and which ones go to the secure shredding company. It's the janitors who walk around the building at night and notice if someone's left papers on their desk after they went home (another one of those four-alarm-fire events), or a computer didn't lock itself, or someone dropped an access badge, or something else is amiss that could cause problems.
there’s no doubt a firehose of “anonymized” marketable data going out the door.
Please specify how it is that "there's no doubt." Do you have some evidence, or are you just being a cynic because that's the way anonymous wannabe cool kids act on the internet?
If you have evidence let me know, and I'll hook you up with our department that handles this sort of thing so they can take a look at it.
How did that happen? How did they know?
Well, each doctor’s flow of prescriptions is sent to an aggregator in near real-time, sometimes before the pharmacy gets it. That’s how they know to offer Dr. A a trip to Vegas and Dr. B a sandwich.
Hospital admissions, OB admissions and doctor fees are events that get sent to insurers for payment and subrogation. These vendors are allowed to “anonymize” (aka remove name and SSN, etc) and sell that data.
So you can buy marketing lists that contain, by zip code, addresses with inferences about medical conditions, events, and other metrics. I bought the list and discovered three pregnancies with projected due dates, 6 Type-2 diabetics, 2 people getting married in the next 6 months, etc on my block. And two babies were born, as projected.
There is a difference between compliance, privacy and security. The controls that I’m sure you’re diligent in implementing don’t address many privacy issues. HIPAA was enacted in the 90s and doesn’t address the risks today.
They can strictly require X, Y, and Z, while Z is not really necessary and X is really important to make sure it's done right. Later they'll add Xv2 and Xv3 signed in triplicate to ensure X is done right, but still won't really ensure that X is done right. That's just not what a bureaucracy is able to do. They can't just fire everyone and then re-hire only people who care enough about doing things right, that's impractical. So they can add more forms, policies, fire-drills ...
Side note, most people don't care about the "EULA" or "privacy policy" on everything, it's just for "compliance", 99.9% of people never read them, no one expects you to read them, you just sign, that's just how everything works. Yeah it's dumb. But you can see why pretty much all practical every-day people ignore the implications.
Phreesia is a subsidiary of United Health (NYSE: UNH) which has almost a half-trillion market cap (USD$478B).
It doesn't take a large company to not mine data that you're supposed to safe-keep. The problem there is not the lack of internal overseeing, but that they departed from their original administrative business, and went into advertising because "profit".
In my experience, and based on the article, it sounds like Phreesia is an outlier.
As someone who works for a large healthcare company, we're scared shitless company-wide about the potential for personal data to get outside our hands. We have an entire department of people just to constantly watch everything that is done — every process, every piece of hardware, every piece of software, everything — to make sure that personal data doesn't go where it doesn't belong. Every employee down to the janitors has training about this at least once a year.
Last year there was a minor data breach. Someone left a small stack of eight forms with people's PII on them on a desk in a conference room unattended for a few hours. It was an all-hands-on-deck five-alarm fire. It wasn't in my department, so I don't know what the result was or if any employees were disciplined. But seemingly every time another healthcare company gets fined for violating HIPAA, we get a company-wide memo about it as a reminder.
I haven't heard of Phreesia before now. It sounds like one of those scummy companies that sells cheap "office solutions" to small companies (in this case doctors offices) that don't have the resources to do things right and in-house.
People should complain to the proper authorities about Phreesia, or any other company that acts this way. HIPAA complaints are taken very seriously in the United States. Your doctor's office may act like it doesn't care, but the feds do, and then the doctor's insurance company sure as hell does. One way or another, the lazy/greedy/cheap doctor will pay. But you have to document, and report, not just moan anonymously online. That does nothing.
Document and report. Don't let the companies get away with it, or they will keep getting away with it.