US healthcare marketplaces shared citizenship and race data with ad tech giants
460 points
11 hours ago
| 23 comments
| techcrunch.com
| HN
TallGuyShort
9 hours ago
[-]
I used a state (Colorado) healthcare marketplace website when I was going to take a break between jobs for a couple of months, and I feel very violated by the whole process. I entered a bunch of information to the website, knowing that the data could be expected to be shared for quotes, but I got no quote. The information didn't just flow between systems, it was just sent directly to a bunch of individuals. Instead of getting anything useful from the website, I just got told that agents would contact me, and then literally hundreds of agents were calling and texting me at all hours of the day and night for weeks. I asked one of them how to get it to stop and they said it was impossible during the government shutdown.
reply
WillPostForFood
4 hours ago
[-]
Possible you got tricked into using a private site that buys the first google sponsored google result, and talks like it is the official Colorado site but is just lead gen?

https://i.imgur.com/d2fZlTc.png

reply
consumer451
5 hours ago
[-]
Welcome to the reality of the US federal government not even trying to do something like GDPR.
reply
paulryanrogers
5 hours ago
[-]
The dysfunction is intentional. Baby steps to rollback ACA. Every small inconvenience pushes voters closer to their side.
reply
teaearlgraycold
5 hours ago
[-]
So many things are intentionally broken. All of the complaints about illegal immigrants working on our farms, and yet no mention that we do have a migratory laborer visa - it's just the quota is way too low.
reply
WillPostForFood
3 hours ago
[-]
The migratory labor visa is not being ignored - a lot of action on that front. Some of it is stuck because of stalled budget negotiations. A full exemption of the cap for returning workers passed the house, but in the meantime, cap has been doubled.

https://www.epi.org/blog/rider-in-the-house-homeland-securit...

https://www.uscis.gov/working-in-the-united-states/temporary...

reply
Amezarak
4 hours ago
[-]
People complaining about illegal immigrants doing farm labor mostly don’t want you to simply give them paperwork making them legal, they want the pipeline of migrant labor restricted so labor prices are forced to rise enough to make the jobs worthwhile for citizens. I’ve noticed this is a common disconnect.
reply
fwipsy
3 hours ago
[-]
What wage would they have to pay you to pick berries? I suspect it's cheaper to automate these jobs (developing the tech to do so as necessary) rather than raising wages so US citizens take the job. These really aren't desirable jobs by US standards, and automation is already underway.

Edit: I acknowledge that you're just explaining a viewpoint and you don't necessarily hold it.

reply
throwaway85825
1 minute ago
[-]
Current labor costs are too low preventing the necessary investment in automation.
reply
levocardia
10 hours ago
[-]
The actual "sharing" was using the Meta pixel and TikTok's equivalent, presumably so the healthcare exchanges could do retargeting or similarity-based marketing to get people to sign up for health care coverage. Which, narrowly, seems like a reasonable thing to do. But of course using the pixel automatically "shares" the data with Meta/ByteDance/whoever, and they get to use it for whatever nefarious purpose they want.
reply
nickburns
8 hours ago
[-]
The state healthcare exchanges doing any kind of targeting and/or marketing, even to 'get people' to sign up for subsidized healthcare, could also be conceived of as unreasonable. I could be wrong, but I wouldn't think their mandate under the ACA contemplates any targeting or marketing of themselves whatsoever—even if it's ostensibly to increase enrollment.

That it feels like there's an implicit assumption that they would (target or market) seems to be part of the problem.

reply
vkou
5 hours ago
[-]
> could also be conceived of as unreasonable

It could also be conceived of as perfectly reasonable. One of the many (some very flawed) purposes of the ACA was to get more people insured, advertising that state-subsidized insurance is available for you is absolutely in that wheelhouse.

If retargeting is the problem, it should be banned across the board, both for public and private ad campaigns.

reply
Spooky23
5 hours ago
[-]
Nefarious indeed. Once they know who you are, they match you against insurance industry databases and can infer many health conditions and other stuff.

If you’re timely with prenatal care, marketers can predict a woman’s delivery data within a week with high confidence.

reply
vkou
2 hours ago
[-]
Obamacare banned insurer price discrimination for pre-existing conditions.
reply
Spooky23
2 hours ago
[-]
They sell the data for marketing other products.
reply
wewtyflakes
10 hours ago
[-]
It should be illegal to send the data, and illegal to accept it; burn both sides of that bridge.
reply
goda90
10 hours ago
[-]
Every piece of data collected should be an opt-in both for the initial collection and any sharing to a third party. There should be an explanation for why it is collected and an explanation for what features are not possible if it is not collected. It should be a violation of the law to disable a feature based on failure to opt-in for data points that aren't absolutely necessary for the operation of that feature.
reply
analog31
2 hours ago
[-]
I think possession of the data should be illegal. And it should be subject to statutory damages, like music piracy.
reply
traderj0e
10 hours ago
[-]
At least make it an explicitly protected right to lie about your race in any context. It's a lot easier to ruin a dataset than it is to hide from it.
reply
nostromo
9 hours ago
[-]
I wish it were illegal to ask or record people's race in any commercial context in the US.
reply
nickff
8 hours ago
[-]
The problem is that the government often requires the providers/counter-parties to collect the data, so that a regulator can check for systemic discrimination.
reply
rationalist
9 hours ago
[-]
Yes, but does anyone treat it as ruined, or do you get targeted for both/all races?

If someone targets black people, you're on that list; if someone targets white people, you're also on that list!

reply
traderj0e
9 hours ago
[-]
It's a two way street. The companies doing the targeting lose money if their models are inaccurate.
reply
tardedmeme
9 hours ago
[-]
What would happen if you just lied? I guess you wouldn't get healthcare coverage once they found out? But isn't there something in law about material damages, they'd have to prove you cost them money by choosing the wrong race?
reply
1659447091
1 hour ago
[-]
> What would happen if you just lied?

What is lying in this case?

Where is the official government backed race classification list? If you look at the options they don't even know what they mean by "race". There are options asking if you are hispanic, which my definition of the meaning takes the Spanish speaker form, what about french or german speakers why are they discriminated against? And surely when they list colors they can't be talking about people. I don't know what white race is, or black as I have never seen people of either of those colors, unless and except if they mean for hair color, shades of brown and peach maybe then okay. Then they add some regions and a couple countries, by why are so many left out if thats what they mean by race? I would really prefer they gave a proper taxonomy here, until that happens they can not say that whatever you entered is lying or wrong.

reply
ButlerianJihad
1 hour ago
[-]
reply
1659447091
46 minutes ago
[-]
My point being, Where is the complete taxonomy? The argument I have parsed from links, with the absents of context or words, is not about race, it's about if a person is Native to the Americas. Wait, no it's not because many Mexicans are natives but not that kind of native. So which native american? Hope you are seeing the argument that can be made if someone actual whats to spend the time and money arguing it.

They still don't define Native in a context with any other definitions of "race". Just because people want to "cancel" others for identity labels it doesn't make a race, which is what I am asking for. A proper and complete taxonomy, until then they can not prove one was lying -- only out spend in lawyer fees to make it not worth fighting. Which is outside the point of: what is lying.

reply
dylan604
7 hours ago
[-]
If it's an official government form, there's usually verbiage stating that knowingly and willingly falsifying information is considered perjury or some such wording.
reply
traderj0e
7 hours ago
[-]
Yeah I was about to lie one time then saw that. Whoever does the PSAT thinks I'm black though.
reply
kevin_thibedeau
9 hours ago
[-]
It's a tracking pixel. They fool you into sending it.
reply
afavour
9 hours ago
[-]
A technicality without a meaningful difference. Users didn't consent to sending it, nor were they aware of it.
reply
staz
9 hours ago
[-]
If someone attach a bomb to you car that detonate when you start the motor; they didn't fool you into killing yourself.
reply
janalsncm
9 hours ago
[-]
The relevant facts are that the website owner voluntarily put the tracking code on their own website, and the tracking code worked as designed.
reply
worik
9 hours ago
[-]
> The relevant facts are that the website owner voluntarily put the tracking code...

The civil discussion should now be about the punishment for that.

Regulation is required for handling people's data

reply
dylan604
7 hours ago
[-]
Sounds like that will work similar to incarcerating drug users instead of the drug makers and distribution network?
reply
janalsncm
4 hours ago
[-]
In your analogy I would argue the website owners are analogous to the distribution network and Meta/Tiktok are analogous to the manufacturers.

But I also don’t think it’s perfect because usually drug users know they are buying drugs whereas with tracking pixels it’s being done secretly.

reply
dylan604
2 hours ago
[-]
Sure, but that's getting too far into it. Not that you're wrong though. The point was, the people that make the thing never/rarely get punished, but it is the individuals that get the hammer. If websites get fined for running the evilCorp SDKs, then the problem would be more effectively solved by going after evilCorp for providing the SDK. If there was no SDK nor reward for using it, the websites being fined would not have needed to be fined. Trying to scare people into not doing something is much less effective
reply
joquarky
6 hours ago
[-]
The former can't afford lawyers.
reply
adamnemecek
6 hours ago
[-]
That's like saying that Ted Kaczynski was innocent, because he didn't force anyone to open the packages.
reply
kevin_thibedeau
4 hours ago
[-]
The government wants these packages sent out to support its domestic surveillance initiative. It helps when 99% are unaware they exist.
reply
bell-cot
10 hours ago
[-]
I wouldn't be surprised if both are illegal. But these days, the correlation between "X is illegal" and "larger org's do not do X" just ain't what it yousta be.
reply
idle_zealot
10 hours ago
[-]
My understanding is that it's legal with opt-in, but the opt-in is allowed to be confusing, opaque, and sticky, so most people "consent" without informed consideration. We really need to revisit contract law in a modern context. Call me crazy but I don't think it's reasonable that our society operates in such a way that easily 90+% of people are subject to contract terms they signed but don't know or understand.
reply
PaulHoule
9 hours ago
[-]
On top of the GDPR/American concept of "it is all OK if there is consent" which applies to most organization, health related organizations face stronger HIPPA regulations in the US.
reply
mrguyorama
9 hours ago
[-]
Damn near anything in business in the US is allowed with "opt in" where the opt in is literally the scene from Charlie and the Chocolate factory, including the part where you don't get to come after the factory for your death and dismemberment as stated in 1pt font after an entire chapter of reading to dull your attention.
reply
filoeleven
9 hours ago
[-]
easily 90+% of people are subject to tens of thousands of pages of contract terms they signed but don't know or understand. It's madness.
reply
worik
9 hours ago
[-]
Here in New Zealand those pages and pages of fine print are disappearing as they are no longer enforceable.

The only things in a contract that can be enforced must be stated plainly and clearly

Turns out there are o ly a few conditions that are actually necessary

reply
nickff
8 hours ago
[-]
Most long contracts are a reaction to 'failure to warn' lawsuits where plaintiffs (successfully) argued that they should have been notified of something. The problem is that when you add up all those 'somethings', you get absurdly long documents.
reply
idle_zealot
8 hours ago
[-]
In effect it seems that people are still not being warned. The legal fiction that they are is exactly the insanity that needs to be thrown out.
reply
nickff
8 hours ago
[-]
I agree that these extensive disclaimers and contracts are not an effective way to communicate information, but dispensing with them will require either a better way to disclaim many (relatively unimportant) risks, or a change to product (and service) liability law, reducing failure-to-warn legal risk.
reply
2ndorderthought
9 hours ago
[-]
Well the tech companies/offense contractors are probably using it to enrich the department of wars efforts. Hmm I wonder what they want race and citizenship data for? Ohhh... Oh...
reply
Eddy_Viscosity2
10 hours ago
[-]
Why would politicians ever pass such a law? Who do you think they work for?

update: Yeah, my bad. The point of this comment was to express my increasing cynicism at how we just keep seeing this kind of corporate behavior over and over again and how even when a tiny win is achieved on things like data collection, right to repair, ease for cancelling subscriptions, privacy, and so on and so on, they are so quickly over taken by new tactics or clawbacks/loopholes/non-enforcement of those laws. HN comments was probably the wrong place to vent and its too late to delete it.

reply
post-it
10 hours ago
[-]
What's the point of this kind of comment? Have pro-citizen anti-corporate laws never been passed in the past?
reply
kevin_thibedeau
9 hours ago
[-]
Only when Congress might be embarrassed. The VPPA exists so we can't find out what videos they watch in their spare time between orgies.
reply
tardedmeme
9 hours ago
[-]
So it should be as easy as buying tracking data and searching for Congressmen. We can put up license plate readers around Washington too, since that's legal.
reply
guelo
9 hours ago
[-]
Very rarely. Most of the consumer protection laws were passed before Reagan in 1980. We did get the CFPB after the 2008 financial meltdown but it's been under attack ever since.
reply
wilg
10 hours ago
[-]
The point of the comment is to spread toxic and deadly cynicism.
reply
arikrahman
10 hours ago
[-]
And also to karma farm. Thankfully the comment is greyed out for what it is.
reply
traderj0e
10 hours ago
[-]
If you never trust anyone, nobody will ever fool you except for yourself.
reply
TheOtherHobbes
10 hours ago
[-]
You never see corporate media doing anything like that.
reply
lovich
9 hours ago
[-]
Doesn’t really seem like the environment where the common persons going to get more rights or protections since the POTUS and SCOTUS are currently ripping those up while Congress sits in the cuck chair.
reply
anonym29
9 hours ago
[-]
"Citizens" United (which allows unlimited corporate political donations by classifying them as "speech", for those out of the loop) has fundamentally changed the core incentive structures of the modern political landscape. To compare a pre-CU world to a post-CU world when it comes to matters at the intersection of corporate interests and government regulatory / legislative power is comparing apples to oranges.

We need to overturn CU if we want to be able to go back to a world where government serves people rather than multinational conglomerates.

reply
strictnein
3 hours ago
[-]
Citizens United has to be the most inaccurately cited case. It did not 'allow unlimited corporate political donations by classifying them as "speech"'.

It ruled that the federal government was wrong to restrict the speech rights of some groups while allowing other very similar groups to still retain their rights. One of the major examples of this was the media industry. A for-profit newspaper company could spend whatever amount of money it wanted to on political speech. An identical company in a different field could not. This, the court ruled, was unconstitutional.

It also did not grant corporations personhood, the other thing people like to state that it did.

reply
parineum
8 hours ago
[-]
> We need to overturn CU

Or we could stop looking at SCOTUS to fix legislation and ask the branch of government who's job it is to fix legislation, Congress.

reply
anonym29
5 hours ago
[-]
That would be nice in principle, yes, but in a CU world, that's asking the fox to vote to lock itself out of the hen house.

In practice most of the foxes that promise to do so never actually will.

What's your proposal to solve this?

reply
applfanboysbgon
10 hours ago
[-]
They work for the people. In some countries, people actually vote for politicians that benefit the population. In other countries, people repeatedly vote for politicians despite knowing that those politicians are only interested in enriching themselves, with a track record going back decades of doing nothing but that. The problem, then, is the voters in certain countries, not the politicians.
reply
dexterdog
10 hours ago
[-]
And in some countries people are only given a choice of two, neither of which benefit the population.
reply
roughly
10 hours ago
[-]
Many of those countries have mechanisms by which one can express their preferences earlier in the process, ones which have been successfully used to pivot major political parties in new and unexpected directions, although those mechanisms are more complicated than just showing up at the end and whining about the results, so usually it's only motivated individuals and entities which leverage them.
reply
grassfedgeek
9 hours ago
[-]
In some countries a major party has succeeded in convincing a majority of voters to vote against their self interest by leveraging "red meat" topics such as abortion, jesus and guns.
reply
wat10000
10 hours ago
[-]
Ideally because we'd vote in politicians who would do it, and vote out those who didn't.
reply
nomorewords
10 hours ago
[-]
Is that even possible in the US anymore with donations and corporate backing being so important to a campaign?
reply
wat10000
9 hours ago
[-]
It's possible. Ultimately the voters do make the decision, even if they can be swayed. How realistic it might be, I can't say. We certainly need a lot more engagement with the process. There are far too many people ignoring the primaries and then complaining about their lack of choice in the general.
reply
applfanboysbgon
10 hours ago
[-]
I don't believe donations or corporate backing had anything to do with Trump, for example, winning. Trump won because he genuinely appeals to the average voting American. American voters are willingly choosing to support these politicians and all of the consequences that entails.
reply
fn-mote
10 hours ago
[-]
You can believe the latter but the former ignores everything we know about the effectiveness of advertising.

And also about the targeting of swing districts.

reply
dgellow
10 hours ago
[-]
For the president election, maybe, but without corporate backing of the GOP he would have to face an adversarial congress. Or at least, that’s the hope
reply
triceratops
9 hours ago
[-]
Both can be true.
reply
exe34
9 hours ago
[-]
To discount advertising and manipulation in this context amounts to conspiracy theory in my opinion.
reply
downbad_
10 hours ago
[-]
The richest tech companies and richest men in the world got rich by invading people's privacy and selling invasive ads.
reply
TehCorwiz
10 hours ago
[-]
> The richest tech companies and richest men in the world got rich by invading people's privacy and ~selling invasive ads.~

I think you mean "manipulating content algorithms to favor their viewpoints and to target individuals for maximum effect."

reply
BeetleB
8 hours ago
[-]
Looking at the 15 richest people in the world, 11 did not get rich that way.
reply
jjtheblunt
9 hours ago
[-]
You overlooked plain cronyism in Russia 1991 and after, for example, and actual rich people who just invested very long ago, and repetitively over time, in companies making money (not timing the stock market), like Charlie Munger and Warren Buffett.
reply
mcmcmc
9 hours ago
[-]
They got rich because people were stupid enough to think free services come without a cost.
reply
consumer451
9 hours ago
[-]
If we have learned anything in recent decades, it is that we are all easily manipulated, and we are all pretty darn stupid.
reply
MSFT_Edging
9 hours ago
[-]
Translation: The government does little to protect their citizens from predatory business practices because those in power have gained power via predatory business practices and have tricked many people into believing it's their own failings for being made a victim.

Crypto rug-pulls are now done by a sitting president and if you complain you simply have a "victim mentality" because you're not looking for a way to exploit your neighbor.

We should really be embarrassed of our selves yet people come on here every day to defend the scammers.

reply
tardedmeme
9 hours ago
[-]
People prefer to pay with tracking data instead of money because they have lots of tracking data and not much money.
reply
mcmcmc
8 hours ago
[-]
And also because they don’t realize how effectively that tracking data can be used to manipulate their emotions and behavior with the goal of squeezing out what money they do have.
reply
nomel
8 hours ago
[-]
I would claim it's "better" these days than previously. At first, everyone thought they were getting something for free, no strings. Now it seems that even the "uneducated" public understands most of it...they just don't seem to care. The only one that people seem to be unaware of is the fairly precise location tracking that happens.
reply
themafia
4 hours ago
[-]
Ah yes. The casual misanthropy explanation.

Isn't there supposed to be a vast and powerful federal government with incredible investigatory and arrest powers? The one that people are taught to rely on since they stand no chance against a trillion dollar monopoly?

reply
Ylpertnodi
8 hours ago
[-]
Who is clicking on the ads though?
reply
deferredgrant
9 hours ago
[-]
This is especially bad for public services because trust is already fragile. People should not have to worry that applying for healthcare also enrolls them in a tracking graph.
reply
hyperadvanced
9 hours ago
[-]
Is it that incomprehensible that you might want to limit healthcare offerings to lawful residents only, or that the government might track metadata about how services are doing so, regardless of how they choose to take action on it?
reply
ZeidJ
11 hours ago
[-]
reply
zx8080
7 hours ago
[-]
For someone not familiar with the US legal system, something is not clear here: if that's Meta/Facebook tracking via pixel, than why it's not possible to sue them for it?

Or if that tracking is considered legal in this particular case - WHY?

reply
krior
8 hours ago
[-]
Can someone from the US explain what race even means in this context and how it is determined?
reply
_--__--__
8 hours ago
[-]
It is self reported according to the US census recognized racial categories: white, black, asian, native American/Alaskan, native Hawaiian or Pacific islander, and other (or two+ categories). Hispanic/latino identification is a separate box you check for reasons that are hard to explain without going over decades of bureaucratic decisions.
reply
krior
7 hours ago
[-]
> US census recognized racial categories

Thank you for a googleable term.

Are there any guides on how to decide which "race" you are? Because I cannot imagine that everyone knows exactly which part of the earth all of their ancestors originate from.

reply
_--__--__
7 hours ago
[-]
It is not a perfect or rigid system, but it's the one we have (and any attempt to improve it would get caught up in the weeds of how much 'racial science' can be endorsed by the US government).

Practically speaking, most Americans over the past 300 years knew of specific near ancestors who came from somewhere else (with little interbreeding among immigrant populations) and answered based on that. The obvious exceptions were descendants of slaves and Native Americans, which is why those were the first non-white (where 'white' includes all Europeans as well as large parts of the Middle East and North Africa) categories tracked by the census.

reply
trallnag
7 hours ago
[-]
They can pick "mixed" or the race they identify with the most.
reply
nomel
8 hours ago
[-]
All levels of the US education system teach (now at least) that race is a social construct. There's no concept of population-genetics taught, until much later, in hard science classes.
reply
BowBun
8 hours ago
[-]
Yes, this is a common point of confusion when talking to Europeans about racial issues in the US (as I found out myself recently). Race in our contexts refers to your background/birthplace/heritage. On our government forms: "What race are you?" "White, black, hispanic, etc."

This is fundamentally different by intent than in Europe (using french here) where we refer to 'la race humaine' which is the _species_.

The nuance is critical during debates. While I was discussing racial differences to some Swiss folks, they thought I was talking Nazi propaganda! We are all part of the human species, the human species has many races. We are all equal!

reply
rf15
7 hours ago
[-]
> they thought I was talking Nazi propaganda!

well, I mean, listen, if it's part of the census, that's... still government-level racial discrimination. It might not be a duck, but this thing has a certain duck-shaped silhuette.

reply
krior
8 hours ago
[-]
> background/birthplace/heritage

Are those slashes AND or OR?

reply
Ylpertnodi
8 hours ago
[-]
Most Europeans are NOT confused by this. Sheesh.
reply
BowBun
7 hours ago
[-]
I am European, I have had this discussion with Europeans back home from various countries. This is a common point of confusion. Do you have something to add?
reply
durkie
8 hours ago
[-]
i believe it is self-declared.
reply
ButlerianJihad
8 hours ago
[-]
There are various risk factors, and some lab tests, that differ among racial groups.

For example, my labs include at least two that have different specified thresholds for "African-American" or "non-AA" patients.

https://en.wikipedia.org/wiki/Sickle_cell_disease#United_Sta...

reply
offmycloud
9 hours ago
[-]
I'm still surprised by the number of web developers who do not understand that, once you include someone else's Javascript on your site, they have full access to everything on your site, including all submitted customer data.
reply
tantalor
10 hours ago
[-]
> whether they provided details about whether they have incarcerated family members

Okay. That's not much of a signal, is it? This is "metadata" level of detail.

reply
fusslo
10 hours ago
[-]
> Nearly all of the 20 state-run health insurance exchanges in the US have added advertising trackers that transmit user activity

...why?

> State officials say they embed this technology on the exchanges to measure marketing campaigns and to advertise to people who visit their sites

What an absurdist reality we live in

> Tara Lee, a spokesperson for the Washington state exchange, said the tracker on the site was used for advertising campaigns, adding that email, phone and country identifiers were shared with TikTok.

https://www.bloomberg.com/features/2026-healthcare-advertisi...

Personally, I feel local government should not be engaging these services in this way. I don't feel that it's a wise use and that our government employees should be more protective of the public who use their services.

reply
Legend2440
9 hours ago
[-]
>...why?

The same reason that I put Google Analytics on my blog in 2014. They want to know how many people are using their site and how.

And like me, they didn't think about the fact that these analytics services are run by advertising companies that may use the data for other purposes. Unlike me, they have privacy laws to follow because they work with health data.

reply
nickburns
8 hours ago
[-]
> They want to know how many people are using their site and how.

Yeah, why?

reply
lava_pidgeon
10 hours ago
[-]
Cookie Banner isn't such a bad idea now
reply
xp84
9 hours ago
[-]
Nah, it’s still stupid and pointless
reply
lesuorac
2 hours ago
[-]
Why shouldn't somebody has to ask for permission before using your stuff (disk space)?

It's just by default nobody really wants to give up disk space so you can do better ad tracking so the banner is necessary to convince them to.

reply
Pacers31Colts18
7 hours ago
[-]
This is nothing new. They do the same with drivers license data.
reply
giwook
2 hours ago
[-]
And just when you thought the American healthcare landscape couldn't be any more fucked.
reply
avazhi
6 hours ago
[-]
Ok?

2 relevant attributes as it turns out.

reply
kittikitti
7 hours ago
[-]
From my experience working with health data, HIPAA laws are utilized to generate leverage against whoever the gatekeepers want. There's no expectation of privacy for anyone with HIPAA, it's a failed policy meant to intimidate. They hold up a disguise that it's very hard and strict and enforce these regulations to punish whoever they deem unworthy. Usually, it's big corporations targeting competition with needles lawsuits.

I've seen unfathomable abuses in HIPAA privacy laws. Some of it is was for my own health records. If you only knew how bad it was. I can't detail it all because their lawyers will bully and intimidate me like they already have.

HIPAA was a way to provide surveillance of your health. Corporations, governments, law enforcement, healthcare professionals, or even a petulant child that annoys a parent who's a doctor has access to everyone's health records. The public sentiment on HIPAA laws is just so backwards.

reply
xp84
9 hours ago
[-]
I’m more annoyed that these government healthcare marketplaces are asking people their race in the first place. Really don’t think anything should be, including job applications.
reply
jjtheblunt
9 hours ago
[-]
I never (in the US) have understood why those questions include separate questions for race (seems to be like white or black or asian) and for ethnicity, including a really odd question about Latino or non Latino.

Why those questions, but no Danish vs non Danish, and so on?

reply
nostromo
8 hours ago
[-]
It's because latinos can be white, black, or native - and historically most people tracking these data wanted to group latinos independently of non-latino whites, blacks, and natives.
reply
dominotw
9 hours ago
[-]
do they ask about pre existing conditions? then prbly race also makes sense.
reply
worik
9 hours ago
[-]
> do they ask about pre existing conditions? then prbly race also makes sense

Why?

reply
alucardo
8 hours ago
[-]
"race data"... this isn't a thing, this should not be a thing. am i the only one being shocked?
reply
josefritzishere
11 hours ago
[-]
How is this not a HIPAA violation?
reply
SoftTalker
10 hours ago
[-]
HIPAA applies to healthcare professionals and providers, not ad tech companies. And race and citizenship are not personal health-related data.
reply
malcolmgreaves
10 hours ago
[-]
That's not actually true. It applies to health care data. If you're a software engineer making a system that includes HIPAA-protected data, you can face individual criminal liabilities for mishandling the data.
reply
dekhn
9 hours ago
[-]
No, not really. If you are not a covered healthcare entity, or a business association of a covered healthcare entity, the law simply does not apply to you at all.

Also, I believe (but am not certain) that if there was any criminal case, it would be leadership (C*O) not individual software engineers who would be charged. This is speculation on my part, if anybody has clear facts I'm happy to hear them.

reply
Legend2440
9 hours ago
[-]
It might be a HIPAA violation, depending on the details of the data being shared. Several other healthcare websites have gotten in trouble over the same thing: https://techcrunch.com/2023/04/17/pixel-tracking-hipaa-start...
reply
monksy
9 hours ago
[-]
It is if it connects an individual to an explicit health outcome or category.
reply
dekhn
10 hours ago
[-]
HIPAA as a law is intended to ease transfer of medical information, not restrict it.
reply
ux266478
10 hours ago
[-]
That's not true. It's intended to define a regulated and standard means of transferring medical information while ensuring confidentiality and patient privacy.

https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg...

You have to explicitly grant permission for your data to be sold. What's very likely is that either the healthcare provider or insurance company included a request for authorization to sell that data, and the authorization was signed without paying much attention to it.

reply
dekhn
10 hours ago
[-]
You're referring to the privacy rule, which is only part of the law (and not its primary prupose). The original intent of the law was to ensure easy transfer of information to keep health coverage when changing jobs. The privacy rule was not even part of the original law, it was added by HHS 3 years later. See more details here: https://www.ncbi.nlm.nih.gov/books/NBK9576/
reply
arikrahman
10 hours ago
[-]
The article you cited states congress was aware of privacy concerns at the time and covered them as part of the third stated provision.
reply
incr_me
9 hours ago
[-]
You wouldn't need such a modern privacy rule if it weren't for the need for information portability in the digital age. The distinction between whether or not portability or privacy is primary in the law kind of doesn't matter. The real purpose of HIPAA was to help make the newly emerging market forms of health care sustainable. Protocol standardization and modernization of the Hippocratic Oath were both necessities, technical and ideological respectively.
reply
aksss
10 hours ago
[-]
Narrator: "But it did neither."

Honestly, we're better off with it than without it, speaking as someone with exposure to that industry's internals. That act drives a lot of good security practice within the organizations (mostly liability shifting, but still good). Specifically, the fear it instills of ruinous penalties from regulators drives good practice adoption, IME.

Further, multiple crappy patient portals across providers is a crummy experience, but it's an improvement over the world where providers held the data hostage and had zero interest in accommodating your requests for it, or even the idea that you owned it.

reply
SirFatty
10 hours ago
[-]
"The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a US federal law designed to protect sensitive patient health information from disclosure without consent."
reply
dekhn
10 hours ago
[-]
That's not really correct. It was designed for portability- the ability to move data between health care providers.

(I work in healthcare-adjacent and have met with many lawyers and had to explain them all about "HIPAA compliance"; my comment was not made from ignorance, but practical experience based on learning about how the law is used. There is a privacy rule in it, but that was not the real intent of the law. The intent was to make it easy to keep your health care when you moved between jobs.)

reply
nickff
10 hours ago
[-]
Could you please cite the source for that quote? I looked for it, but couldn't find a source; it seems like an AI hallucination.
reply
nickthegreek
10 hours ago
[-]
Why would you call it an hallucination because you cant find immediately locate the source? You didnt say what in the single sentence would make you jump to that conclusion.

I highlighted SirFatty's text, looked up on google and first result show it near verbatim on cdc.gov.

https://www.cdc.gov/phlp/php/resources/health-insurance-port...

reply
dekhn
10 hours ago
[-]
Here's the original text of the bill's purpose; very little of the bill talks about privacy, and most of the rules around that are part of the HHS Privacy Rule.

To amend the Internal Revenue Code of 1986 to improve portability and continuity of health insurance coverage in the group and individual markets, to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, to simplify the administration of health insurance, and for other purposes.

reply
ButlerianJihad
10 hours ago
[-]
The second “P” in HIPAA stands for “Privacy”
reply
dekhn
10 hours ago
[-]
I wonder if that's why so many people write it as HIPPA.
reply
tardedmeme
9 hours ago
[-]
That's because it's very similar to the name of an animal which is not called a hipoo.
reply
59percentmore
9 hours ago
[-]
Oh, I bet they fucking did.

That's it, that's the comment.

reply
shevy-java
11 hours ago
[-]
The US citizens will have to fight down those corporate overlords. It is now really just shameful how they leech off of the common man (and common woman). People in democracies outside of the USA shake their head in sadness now. Even Canada is doing better here - don't tell anyone the crazy orange king, for he may begin to potty-mouth and threaten them with invasion again.
reply
aksss
10 hours ago
[-]
corporate overlords? These are the state governments selling your data. The call is coming from inside the house. The sooner we realize that government is comprised of the same slithering slime of human greed and laziness, the more realistic discussions we can have.
reply
DangitBobby
8 hours ago
[-]
It's not even remotely the same scale. At least the government ostensibly has its incentives aligned with the public. False equivance gets us further from where we need to by focusing people on the wrong problems.
reply
aksss
6 hours ago
[-]
"Ostensibly" is the mistake in your formula. Current events are replete with examples to the contrary. It's not equivocating to recognize that governments are organizations of humans, subject to the same limitations - the larger they get, the harder they are to manage well; talent is incredibly important to success in mission; leadership is incredibly important to integrity, ethics, and strategy; lower oversight and mediocre control structures lead to abuse. You can see the challenges that government as an organization has there. And as to scale..? Son. At least you can "ostensibly" choose whether or not to interact with corporations unless they are colluding with... government.
reply
aksss
1 hour ago
[-]
Which isn’t to say government is bad as an institution.. just to say that we regard it with an assumption of good faith at our collective peril - it’s track record counsels the opposite.
reply
tamimio
9 hours ago
[-]
US isn’t a country, it’s an economic zone run by few corporates, who bribe and push law makers to pass whatever laws they like, everyone is winning except the citizens of that “country”.
reply
mistrial9
10 hours ago
[-]
anecdata - in Berkeley CA, in the late 2010s, two individuals showed up to be in the fast-paced AD scene. One was from a former Soviet Union country, who spoke English pretty well .. and the other a woman from Columbia .. to say that both of these two were "aggressive" is an understatement. He spoke English, she was in charge of "security" .. after a very few meetups, they both formed a company for "Ad tech for Hospitals" .. it was "heavy security" they said, and therefore did not discuss any details in public. They very obviously would do "aggressive" actions to get into the business, defeat competitors, and satisfy ..clients? Who were they satisfying with the cultural norms, constantly aggressive stance, move fast and break things approach? Every single person involved had the motivation of Big Money, Now.
reply
anigbrowl
3 hours ago
[-]
OK, who? Vagueposting doesn't help anyone.
reply
oarla
10 hours ago
[-]
Relevance?
reply