Privacy Research Group – NYU

By: Hannah Baker

Link: http://techcrunch.com/2013/02/18/tumblr-is-not-what-you-think/

Discussion:

This post by Adam Rifkin on techcrunch.com discusses Tumblr, one of the newer social networking/blogging websites. According to a quoted survey, Tumblr is now the most-used social networking site among both the 13-18 and the 19-25 age groups. While the survey’s informality and small sample size make its conclusions less than certain, there can be no denying the increasing popularity of Tumblr, especially amongst teenagers.

But, I can’t be the only one who has been frustrated by trying to read anything on Tumblr. The search is poor, the comment threads are impossible to follow, and the “reblogging” mechanism can make it difficult to figure out who originally posted any particular picture or piece of information.

What I found most intriguing about the Techcrunch.com post was its suggestion that Tumblr’s technological limitations may be a feature rather than a bug. Rifkin suggests that the problems people have in searching Tumblr is a bonus for many of its users, who want to be anonymous without necessarily gaining a large audience of unknown anonymous internet people. They want a personal page, like a Facebook page, but without Facebook’s corresponding public visibility.

Rifkin’s idea can be extended to some of Tumblr’s other seeming problems. Conversations and comment threads are difficult to follow, giving people the freedom to comment without complete accountability even to their online personas, yet without having to resort to complete anonymity.

I like the suggestion that privacy can be protected, not by deliberate privacy controls such as those offered on Facebook, nor by complete anonymity, but by less-than-perfect design. Whether or not Tumblr’s poor search system and lack of a good commenting system are deliberate, they function to protect the users’ privacy, to the point where better technology might be bad for the site.

This raises the larger question of whether better technology will always take off if it leads to a decrease in privacy. On the one hand, older, more private forms of technology seem generally to be abandoned. Few modifications to a cell phone will give a call the total privacy that comes when calling from a payphone, but payphones are now few and far between. Kindles and other e-readers are becoming increasingly popular, even though the readers’ notes and highlighting may be collected and seen in a way that is impossible with a physical book. On the other hand, Tumblr’s new popularity– despite the fact that, as Rifkin describes, it is a terrible platform by most standard metrics– may point in a new direction.

By: Katrina Henderson

President Obama’s 2009 stimulus plan set forth billions of dollars worth of incentives for medical health providers in order to urge them to begin using electronic medical records (EMR). The plan hoped to encourage health care providers to streamline medical care, due to the fact that EMR systems are both more efficient and accurate than paper records. The use of electronic records helps to reduce paperwork, eliminate handwriting errors, coordinate patient care, eliminate unnecessary tests and procedures, as well as provide direct access to health records.

Since this stimulus plan was put in place, the switch to electronic medical records has been quite large. By early 2012, the U.S. Department of Health and Human Services had already spent 25.9 billion on electronic health information systems. Recent research regarding family doctors, which are the largest group of primary care physicians, suggests that in 2011, about 68 percent of family doctors were using electronic health records. This percentage shows the use of such records has doubled between 2005 and 2011. Many health care providers still have concerns regarding these records. The first regarding EMR system is the cost of implementation and training. The second concern is patient privacy and who has access to this protected health information.

When it comes to privacy, the Health Information Portability and Accountability Act (HIPAA) attempts to mitigate any concerns by enacting rules to protect patient privacy. These rules, most recently tweaked by the HIPAA Omnibus Rule, create safeguards, which Covered Entities, and now their Business Associates, must implement in order to better protect patients’ personal health information. The over 500 pages of the Omnibus Rule are quite a lot to grasp. Included within the rules are four final rules, which (1) modify the HIPAA privacy, Security, and Enforcement Rules mandated by the Health Information Technology for Economic and Clinical Health Act (HITECH), (2) incorporate increased penalty structure within the HIPAA Enforcement Rule, (3) replace the “harm” threshold with a more objective standard under Breach Notification for Unsecured Protected Health information, and (4) prohibit most health plans from the use or disclosure of genetic information for underwriting purposes.

The Rule became effective on March 26, 2013. Covered Entities and Business associates still have 180 days past the effective date to become compliant with the Rule’s provisions. It is too soon to tell whether or not the new rules will be effective in terms of increasing health information privacy. For now the questions many health care providers and the U.S. Department of Health and Human Services may be asking are how much will compliance with these new rules cost and will the government incentives be enough to cover those expenses. It does not seem as though expansion of the use of EMR systems will slow due to the fact that physicians will be assessed a penalty for not adopting an EMR system by 2015. However, there may be a push for more guidance and financial assistance with implementation and compliance measures, especially by the newly liable Business Associates.

References:

http://health.usnews.com/health-news/news/articles/2013/01/15/many-more-doctors-using-electronic-health-records

http://www.healthit.gov/patients-families/benefits-health-it

http://www.medicalrecords.com/physicians/meaningful-use-government-incentives-information

By: Carey Shenkman

In Florida it is now harder for surviving spouses to obtain health records of diseased loved ones, a victory for more uniform federal healthcare privacy. Indeed, this case is particularly significant given the historical context of HIPAA, which broke significant ground when it was passed. At the same time, the law, since passing, has raised some fears by critics about the expanded federal role in health insurance reform.

In Opis Management Resources v. SecretaryFlorida Agency for Health Care Administration case ruled that HIPAA (the Health Insurance Portability and Accountability Act of 1996) trumps a Florida statute § 400.145 governing access to health records. The bar set by HIPAA is higher than that in Florida. Under HIPAA, medical records for a diseased party may only be released to a designated “personal representative.” Under the superseded Florida law, several parties including spouses, attorneys, guardians, and other enumerated parties may make such requests.

This case was an important decision for intersecting issues of federalism and privacy. The rationale of the 11th Circuit Court of Appeals rested largely on the Supremacy Clause and express preemption language in HIPAA. HIPAA provided that the statute “shall supersede any contrary provision of State law,” providing for limited exceptions. The Court of Appeals rejected the State’s argument that the Florida law supplemented, rather than conflicted with, the federal law. The Court held that “The fatal flaw in the State Agency’s argument is that the plain language of § 400.145 does not empower or require an individual to act on behalf of a deceased resident.” Instead, the statute allows what the court called “sweeping disclosures” without requirements for authorization for the individual making the request. The Court also held that 400.145 is not limited in the same way as analogous federal law or regulation.

Particularly with the complex grid of state-level and federal regulations on privacy, this type of conflict is not an issue that will go away. We already see the potential for state-federal conflict in other privacy spheres, such as through issues of police investigations (such as through video or online surveillance) and commercial use of information. Scholar Michael Hail asserts that state courts are in a way ahead of the curve of their federal counterparts, calling them “more advanced in dealing with judicial policy.” Citing a Georgia Supreme Court decision Pavesich v. New England, Hail writes how the state was at the forefront of crafting a right to privacy. States can serve as laboratories for policy experimentation, but this inevitably leads to conflicts as Opis Management reveals.

In a sense, as journalist Michael Doyle points out, cases like these are beneficial for healthcare providers themselves who are caught in the middle of conflicting regulatory frameworks. Indeed, nursing home operators cheered the decision in Opis Management.

Sources:

http://www.mcclatchydc.com/2013/04/10/188184/florida-and-federal-court-clash.html#.UYPlvbXP168

http://cdn.intechopen.com/pdfs/13676/InTech-Federalism_privacy_rights_and_intergovernmental_management_of_surveillance_legal_and_policy_issues.pdf

http://www.ca11.uscourts.gov/opinions/ops/201212593.pdf

http://www.urban.org/UploadedPDF/NICHOLS.pdf

By: Michael Lucien

Information privacy in the healthcare context is a very tricky issue.  On one hand, individuals stand to benefit greatly from a more efficient system of storing and transmitting medical information.  On the other hand, health information is among the information that we are the most concerned about falling into the wrong hands.  As such, while many other industries have been quicker to use cloud computing for day-to-day consumer services (examples include: stock trading, online banking, email, social media, many online purchases and even online movie rentals), the healthcare industry has been particularly reluctant to follow suit.  A large part of the hesitation on the part of the healthcare industry stems from regulation-imposed liability from HIPAA.

The aversion to adopting new technology appears to be changing due to two separate happenings.  First, the American Recovery and Reinvestment Act requires that healthcare agents begin migrating patient records and other data to cloud computing by 2015.  Albeit a far off deadline, this has provided some motivation for the industry to modernize.

The second, and perhaps more important happening was the proliferation of Business Associate Agreements (BAAs) under the finalized HIPAA rules as modified by the Department of Health and Human Services.  It was discovered that in earlier versions of the rules, liability only extended to Covered Entities (usually the originators of health information).  The finalized rules make clear that liability should also extend to Business Associates, essentially anyone that in in the course of business with the Covered Entity deals with the protected information.  This development lead to the birth of the BAA.  These are agreements between the originator of the information and the Business Associate that extends liability.  In lieu of these agreements, Business Associate liability would fall to the Covered Entity.   Needing the business of the Covered Entities, Business Associates including could vendors have begun to accept BAAs is droves.  What new innovations lie ahead in the healthcare industry remains to be seen.  What is clear is that thee course for increased efficiency has been paved and consumers stand to benefit.

Sources: http://www.healthtechzone.com/topics/healthcare/articles/2013/05/02/336675-healthcare-ready-embrace-cloud.htm

http://www.forbes.com/sites/danmunro/2013/05/01/hipaa-support-widens-in-cloud-vendor-community/