Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pharmacies share medical data with police without a warrant, inquiry finds

washingtonpost.com

Post reply on HN
Print view View original

21–30 of 47 posts

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#21

Post by JohnFen »

Racing0461 wrote: post #5
underseacables wrote: post #2

If you get a prescription filled using insurance, that medication goes on a report. * Collects prescription drug purchase history for quantifying the relative mortality risk of life insurance applicants and provides risk scores for underwriting decisions.* https://www.consumerfinance.gov/consumer-tools/credit-report... Even if you don’t use insurance, it may still be possible to wind up on this list.

This is actually a pretty good use of the data if its done by a university for a study or the NIH in a nonprofit capacity. Using prescription data on insurance to see outcomes at a societial level for prescriptions since it's all in one place. Of course life insurance companies will instead use the data to decide someone's premiums or whether to give them life insurance at all if a prescription shows up on that perso…

> This is actually a pretty good use of the data if its done by a university for a study or the NIH in a nonprofit capacity.

As long as everyone who's data is used has consented to it, then yes.

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#22

Post by alexwilde »

yold__ wrote: post #12
alexwilde wrote: post #6

Earlier quoted context omitted.

The article covers this: The Health Insurance Portability and Accountability Act, or HIPAA, regulates how health information is used and exchanged among “covered entities” such as hospitals and doctor’s offices. But the law gives pharmacies leeway as to what legal standard they require before disclosing medical records to law enforcement.

I work in this space, and your comment is completely wrong. Data covered by HIPAA is always covered by HIPAA. A covered entity would also include a health insurer, and all payment intermediaries, this is straight from the HHS faq ( https://www.hhs.gov/hipaa/for-professionals/faq/covered-enti... )

Did you read the article? I've read through what you've linked as well as this page: https://www.hhs.gov/hipaa/for-professionals/faq/190/who-must...

I'm not seeing anything that explicitly calls out Pharmacies.

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#26

Post by yold__ »

alexwilde wrote: post #22
yold__ wrote: post #12

Earlier quoted context omitted.

I work in this space, and your comment is completely wrong. Data covered by HIPAA is always covered by HIPAA. A covered entity would also include a health insurer, and all payment intermediaries, this is straight from the HHS faq ( https://www.hhs.gov/hipaa/for-professionals/faq/covered-enti... )

Did you read the article? I've read through what you've linked as well as this page: https://www.hhs.gov/hipaa/for-professionals/faq/190/who-must... I'm not seeing anything that explicitly calls out Pharmacies.

https://www.hipaajournal.com/hipaa-compliance-for-pharmacies...

The police are breaking federal law and the article is wrong. This is not a gray area.

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#28

Post by refurb »

gumby wrote: post #27

As a former CEO of a pharma startup I can tell you that you can buy this information as well. Really useful for market research, but shit for patient privacy.

The data sold is aggregated and anonymized. Slightly different than what the article is talking about.

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#29

Post by Scoundreller »

Ensorceled wrote: post #16
Teever wrote: post #10

Earlier quoted context omitted.

I'm in Canada so HIPAA doesn't apply for me but when I was going into my second year of university the student union signed a contract with a health insurance company that provided some piddly policy for students that was mandatory unless you could provide proof of insurance with another company. Not only was there no way to refuse this but you were automatically enrolled unless you could provide that proof by a cert…

> I'm in Canada so HIPAA doesn't apply for me But PIPEDA definitely applies to this situation, but PIPEDA only came into effect on April 2020 so it would depend upon when you were a student.

Depends on province, you might be covered under a provincial regulation. PIPEDA takes effect if your province doesn't have a substantially similar law. PIPEDA came into effect in 2000.

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#30

Post by Scoundreller »

Teever wrote: post #10
deepfriedchokes wrote: post #4

Earlier quoted context omitted.

Wouldn’t this be a massive HIPAA violation??

I'm in Canada so HIPAA doesn't apply for me but when I was going into my second year of university the student union signed a contract with a health insurance company that provided some piddly policy for students that was mandatory unless you could provide proof of insurance with another company. Not only was there no way to refuse this but you were automatically enrolled unless you could provide that proof by a cert…

> I've never found out what information was transmitted from the student union to the health insurance company, if the company managed to get access to my health records

The insureco initially would only get your basic demographics (name, gender, age, DOB, phone# & maybe address). The student union doesn't have anything else to give.

In terms of health info, the insureco would only have what you gave them (indirectly via the pharmacy if you presented a prescription for billing to your health plan).

So other than the basic demographics, even if you're forced into the plan, any further info the insureco gets is voluntarily provided by you (but I get that it's a kick in the teeth to pay for insurance, but not use it).

> I ended up opting out in time

were you already with another insurance company provided by someone's employer? Mine keeps changing providers every few years and I can't opt-out other than resign.

Post reply on HN