Author Archives: Ted North

Google, Fitbit, and the Sale of Our Private Health Data

On November 1, 2019, Google’s Senior Vice President of Devices and Services Rick Osterloh announced in a blog post that Google had entered into an agreement to acquire Fitbit, Inc. This move signaled Google’s efforts to become a leading company in the $25 billion wearables market after failing to make a splash with its own line of Wear OS products. However, many current Fitbit customers and privacy watchdogs are concerned over the implications the sale will have on the privacy of the health data that Fitbit collects. The current lack of legal protection over health data collected by wearable technology and the inherent value of consumer data to Google’s business model presents a problematic combination that could see an erosion of consumer privacy.

The primary legal structure governing the use of personal health information (“PHI”) is the Health Insurance Portability & Accountability Act of 1996, commonly referred to as HIPAA. The purpose of HIPPA is to mandate industry-wide standards for health care information and require the protection and confidential handling of PHI. Over the past two decades, the framework HIPAA established has become central to the protection of PHI and has held healthcare providers accountable in instances where PHI has been exposed.

Yet the rise in wearable technology and its functionality in recent years has exposed a gap in HIPAA protection. As the law is written, HIPAA does not apply to health data collected by wearable health technology. This is because HIPAA only governs organizations considered to be “covered entities,” which the law states as either a health plan, a health care clearinghouse, a health care provider, or health care. Fitbit, as an organization that only collects health data for its customers’ own use (e.g. tracking step count for the user to view) and not to provide health care services, does not qualify as a covered entity. As a non-covered entity, Fitbit is not required to abide by the HIPAA-mandated regulations for the protection of PHI even though the nature of the information it collects (e.g. name, address, phone identification number, height, weight, heart rate, etc.) qualifies as PHI as defined by HIPAA. Thus, users are left to rely upon Fitbit’s self-published privacy policy and the notion that the company will not breach or change that policy for the protection of their sensitive information.

Fitbit currently collects data from its 28 million active users, and even showed off the power of its data last year by showcasing trends it gleaned from 150 billion hours of heart data, the largest set of heart-rate data ever collected. This type of large-scale data collection and use falls perfectly in line with Google’s own business practices in recent years. According to a 2018 report, Google is one of the largest collectors of personal data—even collecting more than Facebook. Google uses its hardware, websites, and applications to actively and passively collect as much data on its users as possible. The Associated Press found that even when users disabled the “location history” feature in several Google websites and applications, Google was still collecting and storing users’ locations.

This data has become one of Google’s most valuable assets. Data is the driving force behind Google’s ability to effectively deliver ads, which accounted for 83.75% of its 2019 Q3 revenue. Google’s ad revenue has also increased year-over-year from $21 billion in 2008 to $116 billion in 2018. A company whose primary source of revenue is the use of data for targeted ads will gain unfettered access to one of the largest health data sets in the world. This is why, although Fitbit and Google both stated that Fitbit data would not be used in Google ads, many critics are skeptical of Google’s intentions.

Google is poised to control vast amounts of our personal data and can use it from targeted ads (e.g. ads for running shorts based upon increased running activity) to conducting beneficial or agenda-driven medical research. However the data is used, Google is gaining increased access to our most sensitive and personal information, not protected by HIPAA, while remaining a company whose main goal is not public health. This lack of legal protection over PHI data collected by wearable technology—and the immense value of data to Google’s business model—present clear privacy concerns for consumers that will only continue until action is taken to expand HIPAA in order to effectively protect all PHI.

Leave a Comment

Filed under Uncategorized

Domino’s Pizza May Deliver the Supreme Court a Chance to Modernize the ADA

The Supreme Court of the United States could soon provide greater clarity to the Americans with Disabilities Act’s (ADA) jurisdiction over websites and mobile apps.

Domino’s Pizza is reportedly preparing a petition for certiorari to appeal a Ninth Circuit decision, Robles v. Domino’s (913 F.3d 898), which held that blind plaintiff, Guillermo Robles, could proceed with a lawsuit against Domino’s after alleging the pizza purveyor’s website and mobile app were inaccessible to him using screen-reading software. On appeal, the Ninth Circuit reversed the decision of the district court and held that the ADA applies to the website and mobile application as services of a place of public accommodation. If the Supreme Court accepts Domino’s “cert petition” for Robles, the Court would have the opportunity to rule on the issue of whether websites and mobile apps must comply with ADA standards.

The ADA was passed in 1990 under President George H.W. Bush as the “world’s first comprehensive declaration of equality for people with disabilities.” Since then, the ADA has been further refined and empowered by a mix of legislation and landmark Supreme Court cases. The ADA, at its core, is a law that “prohibits discrimination against individuals with disabilities in all areas of public life, including jobs, schools, transportation, and all public and private places that are open to the general public.”

Although the ADA’s jurisdiction over those places listed above is clear, its claim over the internet has been tenable at best. The ADA still does not address digital or online compliance specifically, even as our lives become increasingly digitized. The current state of the law regarding online compliance to ADA standards is made up of a patchwork of federal appellate court decisions, which often have different or contradicting standards. This legal uncertainty was highlighted in 2018, in which over 2,250 website accessibility lawsuits were filed in the U.S., increasing from 814 the year before. Still, the Supreme Court has yet to take up one of these cases to provide clarity in the law and relief to lower courts. A ruling by the Court on a website accessibility case could replace the appellate patchwork of case law with a single federal standard.

In Robles, the district court granted Domino’s summary judgment motion and dismissed the case holding that “imposing […] standards on Domino’s without specifying a particular level of success criteria and without the Department of Justice (DOJ) offering meaningful guidance on this topic … fl[ew] in the face of due process.”

The case was then appealed to the Ninth Circuit, which reversed the district court’s dismissal, holding that the ADA applied to websites and mobile apps for operators of places of public accommodation. This holding reaffirmed the standard “that, to be covered by the ADA, a website or mobile app must have a nexus to a physical place of public accommodation.” The court expounded upon this noting that the ADA applies to services “of a place of public accommodation,” not “in a place of public accommodation.” The distinction by the court broadens the applicability of the ADA from beyond the physical space to websites and mobile apps.

The Ninth Circuit stated there was such a nexus, as the “alleged inaccessibility of Domino’s website and app impedes access to the goods and services of its physical pizza franchises – which are places of public accommodation.” Additionally, the Ninth Circuit held that due process did not require DOJ to issue specific guidelines as Domino’s had been on notice “since 1996 of DOJ’s position that its website and app must provide effective communication.”

After the decision by the Ninth Circuit, Domino’s requested a sixty-day extension to file a petition of certiorari with the Supreme Court, which was subsequently granted by Justice Kagan; the petition must now be filed by June 14, 2019. In the request, Domino’s states, “[t]he Ninth Circuit’s decision in this case presents important and complex issues concerning the scope of the ADA, the resolution of which will have a significant impact on all businesses and institutions seeking to maintain an online presence.”

The stage is set for an overdue landmark determination of the extent of ADA’s jurisdiction over websites and mobile applications if a “cert petition” is filed and granted. A decision by the Supreme Court, in this case, could have immediate and far-reaching implications for both businesses and individuals covered under the ADA. Thus, lawyers, industry leaders, and ADA-covered individuals are closely watching this case as it develops.

Leave a Comment

Filed under Uncategorized

Blockchain’s Promise for the Future of Healthcare

In the winter of 2017, the world was captivated by the rise and fall of Bitcoin. Every night during its historic rise, local news ran rags-to-riches stories of basement investors who had cashed out at the right time. Every day, bloggers, tech journalists, and finance journalists tried to diagnose the market and divine what portents this fluctuation may hold for the future. Even before Bitcoin hit its fever pitch in December of 2017, the national conversation focused on the technology powering it – Blockchain. Intrigued by the success of Bitcoin, industry leaders sought to understand Blockchain’s structure, potential, and capabilities. Although the Bitcoin craze eventually came to an end, the conversation over Blockchain continues and it is now positioned to make inroads into the healthcare industry.

Blockchain, in its modern form, was created in the fallout of the 2008 financial crises. It is “[a] digital record or ledger [mini database] that is structured as a series of blocks that are strung together in a chain. Each block—a digital expression of a transaction or an event—is validated by multiple computers on the internet.” Blockchain is also highly secure by distributing “blockchains” to millions of computers, creating a decentralized database.

This combined ability to both secure and share files simultaneously makes Blockchain an attractive new frontier for the healthcare industry. Large healthcare providers such as Cigna, Aetna, and Sentara Health have signed onto Blockchain pilot programs; even Apple signaled interest in Blockchain applications. In 2018, 45% of the healthcare industry experimented with Blockchain applications and 11% of the industry deployed Blockchain applications for use in business. By 2025, it is projected that 55% “of healthcare applications will have adopted Blockchain for commercial deployment.”

This growing trend of Blockchain’s presence in healthcare is due to the enormous benefits the system presents. Cognizant’s 2017 report, “Healthcare: Blockchain’s Curative Potential for Healthcare Efficiency and Quality,” identifies top benefits that healthcare organizations could gain through its implementation, such as strengthened data security and improved interoperability. As Cognizant’s report states, “Blockchain technology enhances privacy through modern public key encryption techniques, reinforces data integrity with its properties of immutability, and improves security with its decentralized data model” allowing for improved patient care through data interoperability between different care providers. Deloitte’s 2018 global Blockchain survey also identifies areas where Blockchain will provide significant value, such as disintermediation, transparency and auditability, and industry collaboration.

These advantages present solutions to long-standing problems that have plagued the industry’s ability to modernize, specifically the ability to digitize patient records into Electronic Health Records. Blockchain’s decentralized data also provides a single authoritative source for patient records resulting in lower cost for patients, better collaboration between professionals, and increased efficiency for providers. Full realization of these benefits has the potential to revolutionize and modernize the healthcare industry and drastically increase the quality of care that patients receive.

Yet Blockchain’s real world implementation highlighted some operational hurdles. The Mayor’s office of Austin, Texas undertook a project called the “MyPass Initiative” to utilize Blockchain technology to improve the city’s homeless services by replacing paper records with “electronic encrypted records that would be more reliable and secure.” The initiative aims to “consolidate the identity and vital records of each homeless person in a safe and confidential way while providing a means for service providers to access that information.” Yet the program faces difficulties such as social buy-in and a reliable way to connect a person with an identity, which can hamper full implementation and in turn preclude the complete realization of the initiative’s benefits. These challenges are not insurmountable and overcoming them will pave the way for larger implementation of Blockchain technology in fields such as healthcare.

Blockchain’s utilization in healthcare is nowhere near complete, but its capabilities and potential operational effectiveness are becoming clear to industry leaders. Its promise to improve patient care through better interoperability, heightened data security, and lower cost is a benefit that the healthcare industry has long been looking to provide to patients. With growing industry engagement with Blockchain technologies and continued innovative pilot programs, such as Austin’s MyPass Initiative, we move ever closer to realizing Blockchain’s promise for the future of healthcare.

Leave a Comment

Filed under Uncategorized

Electronic Health Records: The Dark Side of Digitizing Health Data in the Online Era

The Electronic Health Record (EHR) is permeating the healthcare industry. Easily accessible “minute clinics” and mobile apps providing diagnostic services are all fortuitous results of the increasing digitization of our medical history. While there are many clear benefits to having an EHR—providing accurate and better healthcare, better clinical decision making, and lower healthcare costs—there are numerous privacy risks associated with EHR utilization.

The EHR was a little-known concept when President George W. Bush broached the idea of computerizing health records in his 2004 State of the Union Address. Since then, the healthcare industry has seen a national push to become 100% EHR-dependent; a mission bolstered by President Obama promoting the use of EHRs in both the American Recovery and Reinvestment Act as part of the Health Information Technology for Economic and Clinical Health Act (HITECH) of 2009 and the Affordable Care Act (ACA) of 2010.

Private industries and the general public are increasingly buying into the idea of EHRs as well; according to the Agency for Healthcare Research and Quality, there has been an upward trend in the percentage of patients who find the implementation of EHRs important. There has also been a year-over-year increase in the percentage of healthcare providers who have adopted EHRs, reaching 67% in 2017.

However, this progress toward 100% EHR utilization has also caused increased privacy concerns as EHRs contain a patient’s most sensitive data. These medical records are valuable on the black market as they include a wide range of personal information such as medical history, social security numbers, and insurance details. The permanency of this information provides criminals enough data to completely steal an individual’s identity as well as the ability to commit a wide array of other crimes.

In the summer of 2016, a rogue online actor known as “thedarkoverlord,” stole 655,000 health records from three healthcare providers in the United States. The hacker quickly put the stolen records up for sale on the dark web for an asking price of $700,000. The anonymous hacker told Vice’s Motherboard publication that “[t]he data could be used for anything from getting lines of credit to opening bank accounts to carrying out loan fraud and much more.” This data breach represented a mere 2.4% of all stolen electronic health records in 2016.

More often than not, the burden to resolve the theft of medical records—such as in the case of “thedarkoverlord”—rests with the patient. According to Ponenom Institute’s Fifth Annual Study on Medical Identity Theft, “[s]ixty-five percent of medical identity theft victims […] had to pay an average of $13,500 to resolve the crime.” The heavy financial burden and continued attacks directly affect the public’s concern for its privacy. In 2015, 68% of patients were not confident that their healthcare providers could protect their medical records from loss or theft.

To prevent and combat security concerns, lawmakers have enacted regulations “to protect the privacy of individuals’ health information while allowing covered entities to adopt new technologies to improve the quality and efficiency of patient care.” These competing interests have become more difficult to balance with the increasing reliance on EHRs and thus the increasing opportunity to steal data.

The Health Insurance Portability and Accountability Act (HIPAA) has been the cornerstone legislation on health-data privacy and holds organizations responsible for breaches of data it protects, yet major data breaches still occur through company oversight. In an attempt to incentivize private entities to keep cybersecurity frameworks up to date, Ohio recently passed a law that creates a safe harbor against tort claims for companies who are victims of a data breach. In order to take advantage of this law, companies must comply with the strict state-mandated security framework criteria. Ohio’s innovative approach to cybersecurity enforcement aims to encourage all businesses to implement cybersecurity programs tailored to protect sensitive information while still allowing for technologies to improve.

When President Bush called for implementing EHRs in 2004, he—nor anyone—could have predicted the scale of the current data breaches. A healthcare system reliant upon EHRs is new territory for the health industry and will continue to draw in those who wish to steal its data. However, with continued reliance upon the protections of our regulations such as HIPPA and innovative methods to incentivize a high level of cybersecurity in the private sector, we can feel secure in our progress towards the future that EHRs can provide.

Leave a Comment

Filed under Uncategorized