Re:Why did Phreesia share my medical data after I opted out?
by Spooky23 on Saturday April 08, 2023 @11:25AM
(#35494173)
I’ll tell you about about the time my wife almost bled out due to a ruptured ectopic pregnancy, and mysteriously received a “Welcome Baby” box from Enfamil about 38 weeks from the day she likely became pregnant.
How did that happen? How did they know?
Well, each doctor’s flow of prescriptions is sent to an aggregator in near real-time, sometimes before the pharmacy gets it. That’s how they know to offer Dr. A a trip to Vegas and Dr. B a sandwich.
Hospital admissions, OB admissions and doctor fees are events that get sent to insurers for payment and subrogation. These vendors are allowed to “anonymize” (aka remove name and SSN, etc) and sell that data.
So you can buy marketing lists that contain, by zip code, addresses with inferences about medical conditions, events, and other metrics. I bought the list and discovered three pregnancies with projected due dates, 6 Type-2 diabetics, 2 people getting married in the next 6 months, etc on my block. And two babies were born, as projected.
There is a difference between compliance, privacy and security. The controls that I’m sure you’re diligent in implementing don’t address many privacy issues. HIPAA was enacted in the 90s and doesn’t address the risks today.
How did that happen? How did they know?
Well, each doctor’s flow of prescriptions is sent to an aggregator in near real-time, sometimes before the pharmacy gets it. That’s how they know to offer Dr. A a trip to Vegas and Dr. B a sandwich.
Hospital admissions, OB admissions and doctor fees are events that get sent to insurers for payment and subrogation. These vendors are allowed to “anonymize” (aka remove name and SSN, etc) and sell that data.
So you can buy marketing lists that contain, by zip code, addresses with inferences about medical conditions, events, and other metrics. I bought the list and discovered three pregnancies with projected due dates, 6 Type-2 diabetics, 2 people getting married in the next 6 months, etc on my block. And two babies were born, as projected.
There is a difference between compliance, privacy and security. The controls that I’m sure you’re diligent in implementing don’t address many privacy issues. HIPAA was enacted in the 90s and doesn’t address the risks today.