Live data from Hacker News

Pharmacies share medical data with police without a warrant, inquiry finds

washingtonpost.com

31–40 of 47 posts

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#31
post #28
post #27

As a former CEO of a pharma startup I can tell you that you can buy this information as well. Really useful for market research, but shit for patient privacy.

The data sold is aggregated and anonymized. Slightly different than what the article is talking about.

> data sold is aggregated and anonymized

Is it anonymised or “anonymised”? (Put another way, are there zip codes?)

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#32
post #26

Earlier quoted context omitted.

Did you read the article? I've read through what you've linked as well as this page: https://www.hhs.gov/hipaa/for-professionals/faq/190/who-must... I'm not seeing anything that explicitly calls out Pharmacies.

https://www.hipaajournal.com/hipaa-compliance-for-pharmacies... The police are breaking federal law and the article is wrong. This is not a gray area.

I don't think you read the article or the links you provided. It clearly states the police are obtaining this information through subpoena and not warrants:

In briefings, officials with America’s eight biggest pharmacy giants — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena, not a warrant, to share the records.

And in the link you provided:

When might it be permitted for a pharmacy to disclose PHI to law enforcement officers?

Bearing in mind that, once in a designated record set, PHI could be an individual´s name or physical description, a pharmacy (or pharmacy staff) is permitted to – but not required to – disclose PHI to law enforcement officers in the following six circumstances:

as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests

In this case, the leeway in the standard here is what the pharmacy chooses to comply with. They are choosing to comply with subpoenas. This article points out how that standard could be higher (warrants).

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#33
post #26

Earlier quoted context omitted.

https://www.hipaajournal.com/hipaa-compliance-for-pharmacies... The police are breaking federal law and the article is wrong. This is not a gray area.

I don't think you read the article or the links you provided. It clearly states the police are obtaining this information through subpoena and not warrants: In briefings, officials with America’s eight biggest pharmacy giants — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena, not a warrant, to share the…

https://www.hhs.gov/hipaa/for-professionals/faq/505/what-doe...

I really don't want to keep googling things for you. The police are not judicial officers. Yes, I've read the article.

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#34
post #28

Earlier quoted context omitted.

The data sold is aggregated and anonymized. Slightly different than what the article is talking about.

> data sold is aggregated and anonymized Is it anonymised or “anonymised”? (Put another way, are there zip codes?)

It's actually "anonymized."

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#35
post #33

Earlier quoted context omitted.

I don't think you read the article or the links you provided. It clearly states the police are obtaining this information through subpoena and not warrants: In briefings, officials with America’s eight biggest pharmacy giants — Walgreens Boots Alliance, CVS, Walmart, Rite Aid, Kroger, Cigna, Optum Rx and Amazon Pharmacy — told congressional investigators that they required only a subpoena, not a warrant, to share the…

https://www.hhs.gov/hipaa/for-professionals/faq/505/what-doe... I really don't want to keep googling things for you. The police are not judicial officers. Yes, I've read the article.

You keep dropping links for me to chase instead of just reading between the lines. Police cannot issue their own subpoenas. Police are not judicial officers. However, they are getting judicial officers to write their subpoenas. A judicial officer does not have to be a judge, therefore the standard is lower than a warrant.

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#36

Earlier quoted context omitted.

> data sold is aggregated and anonymized Is it anonymised or “anonymised”? (Put another way, are there zip codes?)

It's actually "anonymized."

British versus American English [1].

[1] https://www.collinsdictionary.com/dictionary/english/anonymi...

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#38
post #28

Earlier quoted context omitted.

The data sold is aggregated and anonymized. Slightly different than what the article is talking about.

> data sold is aggregated and anonymized Is it anonymised or “anonymised”? (Put another way, are there zip codes?)

There are zips or congressional voting districts, which are close enough as makes no never mind.

It hasn't been anonymized to beyond a degree of k-anonymity since at least 2018. With extra datasets like Plaid, or financials; all bets are off.

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#39
post #18

This sort of thing underscores how impossible it is to stay safe in our society. If you can't even get medical care without your data being mined for all it's worth, what can you do? So utterly depressing.

We can start by not voting for the usual suspects because the usual suspects mean the usual routine. Telling ourselves that "these usual suspects" are slightly better than "those usual suspects" is a poor trade. It garantees the usual routine.

There is more of course, such as insisting on the more private path when there is an option. Because often there is an option. Just not always.

Also this one is actually very easy to answer:

> Though some of the chains require their lawyers to review law enforcement requests, three of the largest — CVS Health, Kroger and Rite Aid, with a combined 60,000 locations nationwide — said they allow pharmacy staff members to hand over customers’ medical records in the store.

So there you go: CVS, Kroger, Rite Aid are clearly sending us to their competitors. In most places, it's easy to shift prescriptions to a competitor.

Re: Pharmacies share medical data with police without a warrant, inquiry finds

#40
post #21

Earlier quoted context omitted.

This is actually a pretty good use of the data if its done by a university for a study or the NIH in a nonprofit capacity. Using prescription data on insurance to see outcomes at a societial level for prescriptions since it's all in one place. Of course life insurance companies will instead use the data to decide someone's premiums or whether to give them life insurance at all if a prescription shows up on that perso…

> This is actually a pretty good use of the data if its done by a university for a study or the NIH in a nonprofit capacity. As long as everyone who's data is used has consented to it, then yes.

Does HIPPA apply if its a large study and each is anonymonized? I'm assuming insurance companies already use the data so the 20 page EULA already has consent.
Post reply on HN