Author Archives: Ted North

Airline COVID-19 Health Standards Remain Grounded While Holiday Travel Season Looms

The start of the holiday season—the busiest travel period in the United States—is just weeks away. Though the number of Americans taking to the skies this Thanksgiving is sure to be less than the 26 million travelers who passed through Transportation Security Administration checkpoints last year, passenger volume is nonetheless expected to surge.

However, potential travelers will have to weigh the risks of a COVID-19 resurgence against the range of travel options in an industry that remains largely outside the scope of any federally mandated COVID-19 safety regulations. The reticence to issue firm federal regulations to keep both passengers and workers safe has been a familiar narrative during this health crisis, and the airline industry has arguably been one of the most scrutinized segments of travel.

This unprecedented public health crisis begs the question: who is responsible for regulating passenger safety on airplanes as it pertains to COVID-19?

This is not a novel question. On March 14, 2020, in the early stages of the COVID-19 outbreak in the U.S., the Director of the Centers for Disease Control and Prevention (CDC) Dr. Robert Redfield issued a No Sail Order for all cruise ships operating within the United States, effectively shutting down cruise lines until further notice. In the No Sail Order, the Director rooted his decision in scientific information about the transmission of COVID-19 and on the powers granted to him as the CDC Director in 42 CFR § 71.32(b). Dr. Redfield justified issuing this federal mandate as he determined that the scope of this pandemic “cannot be controlled sufficiently by the cruise ship industry or individual state or local health authorities.”

However, the federal government has enacted no other substantive regulatory measures on other sectors of the travel industry during the course of the COVID-19 crisis. Instead, the CDC has opted for issuing non-binding COVID-19 safety guidelines for different industries, leaving sectors, such as the airline industry, to individually self-regulate.

The result of this recommended guidelines approach is a wide array of safety policies that differ between airlines with no legal mechanism for enforcement, meaning that the repercussions for consumer noncompliance extend only as far as what is within the company’s power to implement (e.g. denying service, customer banning, etc.). Furthermore, this range of options forces the consumer to compare health and safety measures between available choices or settle for the only option available to them.

Opponents to national standards often cite a disdain for government regulations as a driving factor for inaction. The Department of Transportation (DOT) recently denied a petition requesting the implementation of a nationwide mask policy for airports and air travel under their rule making powers found in 5 U.S.C. § 553(b)(3)(B). In DOT’s response, General Counsel Steven Bradbury stated his reasons for the denial being that guidelines recommending masks already exist, most air carriers have enacted mask policies, and DOT “embraces the notion that there should be no more regulations than necessary.”

Similarly, the New York Times reported that the CDC drafted a mandate last month that would require masks on all commercial and private transportation. The mandate was rooted in the CDC’s quarantine powers found in 42 USC § 264, 268, and was backed by the Secretary of Health and Human Services (HHS) Alex Azar II. However, the White House reportedly blocked the mandate, instead deferring to state and local authorities to issue their own guidance; Vice President Pence “declined to even discuss [the mandate]” with the White House Coronavirus Task Force.

This vacuum of federal safety regulation has led to a patchwork of self-regulation between industries and state officials attempting to establish legal standards to allow for enforcement of these standards. Some states, such as Virginia, have taken it upon themselves to codify CDC guidelines to provide legal standards for businesses and individuals alike whereas other states continue to pass the responsibility of public safety off to industries and individuals.

For interstate industries such as airlines, differing state and company standards are not sufficient to effectively manage the risks COVID-19 presents. Yet, a path toward the creation of national safety standards and a means of enforcement does exist. The CDC, DOT, HHS, and the president are provided various statutory powers while Congress has the ability to pass legislation—similar to some legislation passed at the state level—to create a national set of safety standards for certain industries.

As we approach the 2020 holiday travel season amidst the backdrop of a global pandemic, it is abundantly clear that the airline industry and the American people would be better served by a set of national safety regulations for air travel. The implementation of national safety regulations will provide the airline industry with means of legal enforcement for noncompliance, restore confidence in air travel, and provide airlines the best guidance from health experts to ensure consumer safety.

Leave a Comment

Filed under Uncategorized

The Growing Role of Big Data in Pandemics

In early April 2020, the New York Times published an article showing the tracked movement of Americans in the midst of the COVID-19 pandemic by analyzing cellphone location data across the entire country. Similarly, Tectonix, a data analytics firm who used locations of anonymized mobile devices, tweeted an analysis of the movement and spread of 5.6 thousand individuals identified on a Ft. Lauderdale beach on a specific day. While this near-real time analysis highlights the usefulness and practicality of Big Data in the fight against the pandemic, it also raises consumer privacy concerns in a largely unregulated sector.

As previously discussed, the U.S. relies on a patchwork of regulations to govern the collection and use of Big Data and to protect consumer privacy; this patchwork creates large gaps in regulation for Big Data usage. On April 9, 2020, the U.S. Senate Committee on Commerce, Science, & Transportation held a paper hearing entitled, “Enlisting Big Data in the Fight Against Coronavirus,” in order to address these concerns. The primary goal of the Committee’s hearing was to find the best way to maximize potential benefits of Big Data while minimizing the privacy risks to consumers.

Leading privacy experts submitted written testimony to the Committee recognizing the crucial impact of Big Data in the fight against the current pandemic, and the need for legislation that can protect consumer privacy while not diminishing its effectiveness. From identifying where social distancing is failing and understanding future transmission hotspots, to identifying environmental and geographic factors affecting the rate of disease transmission, Big Data provides actionable insight that other sectors are unable to provide. Still, enabling such unregulated use of Big Data during this outbreak may be risky; history has shown that practices enacted during emergencies are hard to undo.

The Future of Privacy Forum, a leader in privacy standards and principled data practices in support of emerging technologies, recommends four components to a “comprehensive federal privacy legislation that [is] flexible enough to support data-driven public health initiatives under the right safeguards and within limits consistent with privacy and civil liberties.” These components are: legal protections for sensitive data that includes not just health information but also geo-location data; mandatory privacy risk assessments for corporations involved in high-risk data processing; mandatory independent ethical review boards overseeing research that utilizes sensitive data—especially in sectors that are currently unregulated in their Big Data usage; and strict purpose limitation policies, which would require scientific research utilizing personal data to be “compatible” with the initial purpose for which the personal data was processed—pursuant to the European model.

Additionally, a consistent theme across proposals for increased regulation is the necessity for transparency. The mounting number of non-HIPAA-covered entities that are regularly collecting, using, and sharing sensitive consumer information, makes it increasingly more difficult for individuals to know who has access to their information and how that information is being used. However, increased transparency, in coordination with other privacy regulations, may encourage individuals to participate in data-related studies and ease concerns about how private information may be used.

The COVID-19 pandemic continues to test countless aspects of our societal norms, economy, and legal system. Big Data pulls together many of these issues by calling into question how much, and under what circumstances, individual privacy should be exchanged for public health and safety. The Senate’s paper hearing on April 9 confirmed the importance of Big Data in responding to the current pandemic and also signaled potential legislative action to protect consumer privacy in the modern digital world. While Big Data is playing a critical role in fighting the pandemic, this crisis has nonetheless exposed legislative gaps in protecting consumer privacy.

Leave a Comment

Filed under Uncategorized

Google, Fitbit, and the Sale of Our Private Health Data

On November 1, 2019, Google’s Senior Vice President of Devices and Services Rick Osterloh announced in a blog post that Google had entered into an agreement to acquire Fitbit, Inc. This move signaled Google’s efforts to become a leading company in the $25 billion wearables market after failing to make a splash with its own line of Wear OS products. However, many current Fitbit customers and privacy watchdogs are concerned over the implications the sale will have on the privacy of the health data that Fitbit collects. The current lack of legal protection over health data collected by wearable technology and the inherent value of consumer data to Google’s business model presents a problematic combination that could see an erosion of consumer privacy.

The primary legal structure governing the use of personal health information (“PHI”) is the Health Insurance Portability & Accountability Act of 1996, commonly referred to as HIPAA. The purpose of HIPPA is to mandate industry-wide standards for health care information and require the protection and confidential handling of PHI. Over the past two decades, the framework HIPAA established has become central to the protection of PHI and has held healthcare providers accountable in instances where PHI has been exposed.

Yet the rise in wearable technology and its functionality in recent years has exposed a gap in HIPAA protection. As the law is written, HIPAA does not apply to health data collected by wearable health technology. This is because HIPAA only governs organizations considered to be “covered entities,” which the law states as either a health plan, a health care clearinghouse, a health care provider, or health care. Fitbit, as an organization that only collects health data for its customers’ own use (e.g. tracking step count for the user to view) and not to provide health care services, does not qualify as a covered entity. As a non-covered entity, Fitbit is not required to abide by the HIPAA-mandated regulations for the protection of PHI even though the nature of the information it collects (e.g. name, address, phone identification number, height, weight, heart rate, etc.) qualifies as PHI as defined by HIPAA. Thus, users are left to rely upon Fitbit’s self-published privacy policy and the notion that the company will not breach or change that policy for the protection of their sensitive information.

Fitbit currently collects data from its 28 million active users, and even showed off the power of its data last year by showcasing trends it gleaned from 150 billion hours of heart data, the largest set of heart-rate data ever collected. This type of large-scale data collection and use falls perfectly in line with Google’s own business practices in recent years. According to a 2018 report, Google is one of the largest collectors of personal data—even collecting more than Facebook. Google uses its hardware, websites, and applications to actively and passively collect as much data on its users as possible. The Associated Press found that even when users disabled the “location history” feature in several Google websites and applications, Google was still collecting and storing users’ locations.

This data has become one of Google’s most valuable assets. Data is the driving force behind Google’s ability to effectively deliver ads, which accounted for 83.75% of its 2019 Q3 revenue. Google’s ad revenue has also increased year-over-year from $21 billion in 2008 to $116 billion in 2018. A company whose primary source of revenue is the use of data for targeted ads will gain unfettered access to one of the largest health data sets in the world. This is why, although Fitbit and Google both stated that Fitbit data would not be used in Google ads, many critics are skeptical of Google’s intentions.

Google is poised to control vast amounts of our personal data and can use it from targeted ads (e.g. ads for running shorts based upon increased running activity) to conducting beneficial or agenda-driven medical research. However the data is used, Google is gaining increased access to our most sensitive and personal information, not protected by HIPAA, while remaining a company whose main goal is not public health. This lack of legal protection over PHI data collected by wearable technology—and the immense value of data to Google’s business model—present clear privacy concerns for consumers that will only continue until action is taken to expand HIPAA in order to effectively protect all PHI.

Leave a Comment

Filed under Uncategorized

Domino’s Pizza May Deliver the Supreme Court a Chance to Modernize the ADA

The Supreme Court of the United States could soon provide greater clarity to the Americans with Disabilities Act’s (ADA) jurisdiction over websites and mobile apps.

Domino’s Pizza is reportedly preparing a petition for certiorari to appeal a Ninth Circuit decision, Robles v. Domino’s (913 F.3d 898), which held that blind plaintiff, Guillermo Robles, could proceed with a lawsuit against Domino’s after alleging the pizza purveyor’s website and mobile app were inaccessible to him using screen-reading software. On appeal, the Ninth Circuit reversed the decision of the district court and held that the ADA applies to the website and mobile application as services of a place of public accommodation. If the Supreme Court accepts Domino’s “cert petition” for Robles, the Court would have the opportunity to rule on the issue of whether websites and mobile apps must comply with ADA standards.

The ADA was passed in 1990 under President George H.W. Bush as the “world’s first comprehensive declaration of equality for people with disabilities.” Since then, the ADA has been further refined and empowered by a mix of legislation and landmark Supreme Court cases. The ADA, at its core, is a law that “prohibits discrimination against individuals with disabilities in all areas of public life, including jobs, schools, transportation, and all public and private places that are open to the general public.”

Although the ADA’s jurisdiction over those places listed above is clear, its claim over the internet has been tenable at best. The ADA still does not address digital or online compliance specifically, even as our lives become increasingly digitized. The current state of the law regarding online compliance to ADA standards is made up of a patchwork of federal appellate court decisions, which often have different or contradicting standards. This legal uncertainty was highlighted in 2018, in which over 2,250 website accessibility lawsuits were filed in the U.S., increasing from 814 the year before. Still, the Supreme Court has yet to take up one of these cases to provide clarity in the law and relief to lower courts. A ruling by the Court on a website accessibility case could replace the appellate patchwork of case law with a single federal standard.

In Robles, the district court granted Domino’s summary judgment motion and dismissed the case holding that “imposing […] standards on Domino’s without specifying a particular level of success criteria and without the Department of Justice (DOJ) offering meaningful guidance on this topic … fl[ew] in the face of due process.”

The case was then appealed to the Ninth Circuit, which reversed the district court’s dismissal, holding that the ADA applied to websites and mobile apps for operators of places of public accommodation. This holding reaffirmed the standard “that, to be covered by the ADA, a website or mobile app must have a nexus to a physical place of public accommodation.” The court expounded upon this noting that the ADA applies to services “of a place of public accommodation,” not “in a place of public accommodation.” The distinction by the court broadens the applicability of the ADA from beyond the physical space to websites and mobile apps.

The Ninth Circuit stated there was such a nexus, as the “alleged inaccessibility of Domino’s website and app impedes access to the goods and services of its physical pizza franchises – which are places of public accommodation.” Additionally, the Ninth Circuit held that due process did not require DOJ to issue specific guidelines as Domino’s had been on notice “since 1996 of DOJ’s position that its website and app must provide effective communication.”

After the decision by the Ninth Circuit, Domino’s requested a sixty-day extension to file a petition of certiorari with the Supreme Court, which was subsequently granted by Justice Kagan; the petition must now be filed by June 14, 2019. In the request, Domino’s states, “[t]he Ninth Circuit’s decision in this case presents important and complex issues concerning the scope of the ADA, the resolution of which will have a significant impact on all businesses and institutions seeking to maintain an online presence.”

The stage is set for an overdue landmark determination of the extent of ADA’s jurisdiction over websites and mobile applications if a “cert petition” is filed and granted. A decision by the Supreme Court, in this case, could have immediate and far-reaching implications for both businesses and individuals covered under the ADA. Thus, lawyers, industry leaders, and ADA-covered individuals are closely watching this case as it develops.

Leave a Comment

Filed under Uncategorized

Blockchain’s Promise for the Future of Healthcare

In the winter of 2017, the world was captivated by the rise and fall of Bitcoin. Every night during its historic rise, local news ran rags-to-riches stories of basement investors who had cashed out at the right time. Every day, bloggers, tech journalists, and finance journalists tried to diagnose the market and divine what portents this fluctuation may hold for the future. Even before Bitcoin hit its fever pitch in December of 2017, the national conversation focused on the technology powering it – Blockchain. Intrigued by the success of Bitcoin, industry leaders sought to understand Blockchain’s structure, potential, and capabilities. Although the Bitcoin craze eventually came to an end, the conversation over Blockchain continues and it is now positioned to make inroads into the healthcare industry.

Blockchain, in its modern form, was created in the fallout of the 2008 financial crises. It is “[a] digital record or ledger [mini database] that is structured as a series of blocks that are strung together in a chain. Each block—a digital expression of a transaction or an event—is validated by multiple computers on the internet.” Blockchain is also highly secure by distributing “blockchains” to millions of computers, creating a decentralized database.

This combined ability to both secure and share files simultaneously makes Blockchain an attractive new frontier for the healthcare industry. Large healthcare providers such as Cigna, Aetna, and Sentara Health have signed onto Blockchain pilot programs; even Apple signaled interest in Blockchain applications. In 2018, 45% of the healthcare industry experimented with Blockchain applications and 11% of the industry deployed Blockchain applications for use in business. By 2025, it is projected that 55% “of healthcare applications will have adopted Blockchain for commercial deployment.”

This growing trend of Blockchain’s presence in healthcare is due to the enormous benefits the system presents. Cognizant’s 2017 report, “Healthcare: Blockchain’s Curative Potential for Healthcare Efficiency and Quality,” identifies top benefits that healthcare organizations could gain through its implementation, such as strengthened data security and improved interoperability. As Cognizant’s report states, “Blockchain technology enhances privacy through modern public key encryption techniques, reinforces data integrity with its properties of immutability, and improves security with its decentralized data model” allowing for improved patient care through data interoperability between different care providers. Deloitte’s 2018 global Blockchain survey also identifies areas where Blockchain will provide significant value, such as disintermediation, transparency and auditability, and industry collaboration.

These advantages present solutions to long-standing problems that have plagued the industry’s ability to modernize, specifically the ability to digitize patient records into Electronic Health Records. Blockchain’s decentralized data also provides a single authoritative source for patient records resulting in lower cost for patients, better collaboration between professionals, and increased efficiency for providers. Full realization of these benefits has the potential to revolutionize and modernize the healthcare industry and drastically increase the quality of care that patients receive.

Yet Blockchain’s real world implementation highlighted some operational hurdles. The Mayor’s office of Austin, Texas undertook a project called the “MyPass Initiative” to utilize Blockchain technology to improve the city’s homeless services by replacing paper records with “electronic encrypted records that would be more reliable and secure.” The initiative aims to “consolidate the identity and vital records of each homeless person in a safe and confidential way while providing a means for service providers to access that information.” Yet the program faces difficulties such as social buy-in and a reliable way to connect a person with an identity, which can hamper full implementation and in turn preclude the complete realization of the initiative’s benefits. These challenges are not insurmountable and overcoming them will pave the way for larger implementation of Blockchain technology in fields such as healthcare.

Blockchain’s utilization in healthcare is nowhere near complete, but its capabilities and potential operational effectiveness are becoming clear to industry leaders. Its promise to improve patient care through better interoperability, heightened data security, and lower cost is a benefit that the healthcare industry has long been looking to provide to patients. With growing industry engagement with Blockchain technologies and continued innovative pilot programs, such as Austin’s MyPass Initiative, we move ever closer to realizing Blockchain’s promise for the future of healthcare.

Leave a Comment

Filed under Uncategorized