How is "OK Google" not a massive HIPAA violation? (Massive leak of Google recordings in the Netherlands)
arstechnica.com/information-technology/2019/0...Posted Jul 12, 2019, 11:50 PM UTC
30589
arstechnica.com
HIPAA is a disaster in the modern Era. The large tech companies already know what people's medical conditions are because the information is surrendered to the search engine and used for marketing.
98
I'm sure Google thinks I have every disease that exists because as a med student, I Google everything
91
I’m a pediatrician so Google thinks I’m pregnant, have a massive acne problem, reflux, and diaper rash.
-PGY-15
73
As a male student going into OBGyn, Google offers me tampons, incontinence products, discrete STD testing, discounted baby diapers, and estrogen supplements.
52
Do you feel there are any stigmas or issues as a male going into obgyn?
8
Oh my god, I’ve said this so many times. Google is convinced I have SLE, hepatitis, multiple brain tumors and I’m probably pregnant. With a kid with Edwards. And I’m a guy.
9
It's interesting because eventually I suspect HIPAA will include this information, and we will get an unintentional right to privacy encoded in law. Crudely implemented, but it remains.
10
This event is in the Netherlands, but the technology works the same way in the US as far as I am aware.
Lots of doctors carry smartphones, and these days our phones are listening intermittently for advertising keywords, "OK Google / Hey Siri" prompts, and so on. The recordings are transmitted to Google or Apple or various advertisers, transcribed, analyzed, and marketed back to us.
Meanwhile, if you are a provider, recordings your phone makes while you are in a patient room seem like a massive HIPAA violation. Not to mention possibly violating state laws regarding consent-to-record. Why isn't this recording of doctor/patient conversations a massive HIPAA violation?
70
You can disable hotwording in your phone settings, then it won't record anything unless you tell it to. For medical professionals that's probably a good idea in general, because yeah, if something did come out of an accidental recording it would probably be your ass on the line.
44
This is the most logical response to the article. If I'm afraid of my phone recording PHI then I'm going to make sure to turn all assistant services off just in case.
26
Yep
1
Yeah I got a new pixel and noticed that every once in a while when I would say "OK" my phone would beep in my pocket and start sending what it could hear to the cloud trying to find a question or instruction.
About the third time that happened while talking with a patient I had an oh shit moment and went digging in my phone's settings to turn off voice activation for Google Assistant. It's surprisingly hard to do - thought I had it but it would keep randomly kicking on every once in a while so I finally disabled the whole Google Assistant.
Who the hell thinks "OK" is an obscure word to use? Why not "Abracadabra"?
19
Who the hell thinks "OK" is an obscure word to use? Why not "Abracadabra"?
It would not surprise me in the least that they chose those on purpose to get a lot of false positives/more data collection.
9
Well it backfired because it got turned off. Even my parents who aren't tech savvy at the very least would probably look for phones without this feature. When labor saving devices make life harder, it's time to pull back and recalibrate.
2
if something did come out of an accidental recording it would probably be your ass on the line.
Not at this scale. Everyone has a cellphone. Everyone.
When was the last time any significant data breach or loss was punished on a corporate scale? Equifax lost 145.5 million SSNs. The investigation was quashed.
Sure, sure. What about specific to Healthcare and HIPAA?
2016 - 21st Century Oncology - 2,200,000 records lost - victims offered one year of identity protection.
2013 - Advocate Medical Group - 4000000 records lost - one year of credit monitoring services.
2015 - Anthem - 80,000,000 records - credit monitoring or $50 up, until 15 million dollar fund exhausted ($0.19 per infraction)
2009 - Avmed - 1220000 records - $3 million settlement ($2.5 per infraction)
2009 - Blue Cross Blue Shield Tennessee - 1200000 records - $1.5 million fine ($1.25 per)
2015 - Carefirst Blue cross Blue shield Maryland - 1.1 million records - Initially dismissed, appealed and again in litigation
2014 - Community Health Systems - 4.5 million records - $3.1 million settlement ($0.69 per)
2015 - Excellus BlueCross BlueShield - 10 million records - Still in litigation
On and on and on, I'm only through E.
No providers were found at fault for any of the breaches. And the dollar amount per infraction is less than the cost of your lunch, in many cases less than lunch from the McDonald's Dollar menu.
Large-scale, corporate-level, tech-mediated, Healthcare-related data losses do not fall on the provider level. u/lf11 - Your ass would most certainly NOT be on the line.
17
I had no idea this was a thing. Do you have any sources on how to go about doin this?
6
If you have an iPhone, you can go to Settings > Siri & Search, then turn off at least “Listen for ‘Hey Siri’” and “Press Home for Siri”. I just never liked having it on since I would always accidentally trigger it, but now I’m glad it’s off!
5
For Android you open the "Google" app, click on "More" at the bottom right, click on "Settings", "Voice", "Voice Match" and turn everything off. That should do it, although someone else above claimed it still activates sometimes for them. Not sure what that's about... maybe it's only when the Google app is open, or they accidentally hit one of the shortcuts (like squeezing the phone) or anything. At least it shouldn't listen permanently anymore after that. (But you can also disable the Google Assistant as a whole if you want to be extra safe.)
2
Google/Android seems to make it difficult to truly disable hot word activations. If you turn the "Voice Match" setting off and say the hot words it will actually be listening and ask you to turn the setting back on 2-3 times... Now I don't really trust that it isn't listening. You can apparently disable microphone access, but I don't want to do that since I use Android auto.
1
Disabling the keyword doesn't stop or deny Google from listening and recording
1
There's no reason to listen if you're not trying to react to the keyword. Of course, if you're one of the people who think Google and Apple automatically record everything and send it to their evil underground lair to sell it on to the NSA anyway, I can probably not say anything to change your mind. But on an environment as battery-constrained as a smart phone, nobody keeps a microphone running for no reason.
2
it would probably be your ass on the line.
It most certainly would be.
0†
Well, I don't know if you trust them (I wouldn't), but for what it's worth, Google says that they don't store recordings not containing the hotwords, e.g. "OK, Google". It's a huge grey area, to be sure, but it seems to me that if the data are encrypted, and aren't leaving your device, that technically fulfills one of the pillars of HIPAA that data containing PHI be encrypted while "at rest".
38
The recordings are transmitted to Google in real-time for transcription.
The article I posted contains clear statements that not only were the recordings transmitted, but they were stored despite no "Ok Google" hotwords. Furthermore, these recordings were accessible to non-Google 3rd parties, and contained "professional" conversations which probably included medical conversations.
40
Yes. 153 of 1000 recordings did not start with “OK Google”. Wonder how much the government is going to fine Google, Apple, etc.
20
If it was the US, it would be nothing. Because $$$ matters more than legality. It’s not a Red vs. Blue thing, both sides do it.
Check out the Labor Secretary’s resignation yesterday. My jaw dropped
I do not believe it is right or fair for this administration’s labor department to have Epstein as the focus, rather than the incredible economy that we have today
$$$ > morals
11
We don't know the laws in the Netherlands. They may not have something like HIPPA.
8
As far as I know, they do not. However, the same technology is widely used in the US, which is why I bring this up.
5
I believe the algemene verordening gegevengsbescherming (general data protection regulation (GDPR)) is very similiar to HIPAA
4
The GPDR isn't limited to PHI though, it covers any personally-identifiable information. The penalties/reporting/enforcement mechanisms are also substantially different.
The closest thing to the GPDR in the US is California's Consumer Privacy Act. It is still unclear how the CCPA will interplay w/HIPAA and to what extent health data protections in the CCPA will be preempted.
2
Thanks!
1
The EU has GPDR, which is arguably more restrictive & comprehensive than HIPAA, but doesn't single out health data specifically.
2
TIL. Thanks!
2
[deleted]
1
Especially these days
1
I think those 153 conversations recorded without use of the buzzword were probably accidental, e.g., someone said something sounding similar to "OK Google" and triggered the recording/transmission. Nothing else is supposed to be transmitted from the device. There's a widespread belief that Google, Apple, Amazon, etc. record audio on a regular basis for advertising purposes, but to my knowledge they have all categorically denied this practice and there is no proof of this taking place, only anecdotal evidence. Do you have any evidence that these devices listen for "advertising keywords" or anything else besides the published buzzwords?
1
You say "Hey Siri" but Siri requests are processed on device which means Apple doesn't get those until after it has been activated. Voice recognition is processed by Apple but the request itself is client side not server side.
1
I forgot Siri requests are client side. That makes Apple significantly more attractive in healthcare settings.
1
For Apple, Hey Siri is only active while the phone is charging.
-PGY-15
-4
This was only true until the iPhone 6S onwards (2015). All iPhones since then are able to do Hey Siri while unplugged
9
Is Siri the only app that listens to background conversations?
2
I dunno but I have “Hey, Siri” turned off.
1
3rd party apps are not allowed access to the microphone while inactive. The system will alert you if an non-front facing app is currently using the microphone (colored status bar). See Skype for business for example.
1
Fair point, thank you. And Android is becoming more secure this way regarding 3rd party listeners although it still transmits OK Google requests.
1
[deleted]
11
This will likely become policy.
6
The only way to truly turn it off is with a physical switch on the phone that cuts power to the microphones. Without this, it's impossible to be 100% sure it's turned off. I don't think it is wise to assume Google, Apple, Amazon et al. will do the right thing. What if they release an update and the software gets silently turned back on "by mistake"?
2
Not sure what the problem is. The patient already gave Google their symptoms before coming in to see me, which is why they have "Wernicke-Korsakoff" as the chief complaint.
8
To add to this, even documents produced by HHS such as this only consider health data revealed to Siri or Google by the patient. There is no consideration of health data about the patient revealed by the doctor's phone and the doctor is most definitely a covered entity.
6
I’m trying to think of a logical way for providers to avoid this. Obviously you can chose to not bring your phone into patient areas, but I’d be more concerned with conversations that occur in workrooms with colleagues... should we just not have phones at work?
4
You should have voice activation disabled for the Google/Apple digital assistants, or disable them entirely. Really, you should know whats on your phone, and in theory should have already known this is an issue, but only a tiny number of people think about this stuff without prompting.
1
Can we trust that? I have voice activation disabled on my phone; do my colleagues? Should we be verifying that everyone has done the same? If so, who is responsible for this? What if someone is conscientious enough to leave their phone at their desk, but someone else discusses a patient within desk range and that phone picks it up? There’s a lot of interesting things at play here.
2
HIPAA primarily applies to conversations between patients and healthcare providers (not including business associates). Not patients and their artificial intelligence machines.
2†
Right. The patient is allowed to disclose their own healthcare information without restriction. What about the doctor's artificial intelligence machine, eavesdropping on the conversation?
12
Ideally, the Doctor shouldnt have one in the room.
1
Ideally, the doctor shouldn’t have to worry that their virtual assistant is a privacy violation
1
I dont understand how that is possible with current technology or with those laws. I land up advising doctors all the time. They are aware of the limitations, its more wilful ignorance coz of ease.
1
The Dutch version of HIPAA only applies to registrated health care professionals like nurses and doctors, so it in no way applies to Google.
2
Ah. Does it not apply to conversations collected by the nurses' or doctors' phones?
2
It doesn't apply to google who is collecting the information as they are not healthcare professionals.
2
What about the doctor, though. You. When you walk into the patient room, are you not a covered entity under HIPAA? If you carry a recording device into the room, is that not covered under HIPAA? When the recording device sends the data to a 3rd party whom you have not signed a BAA with, is that not a blatant HIPAA violation?
they are not healthcare professionals.
Well, actually Google is a covered entity, they have a lot of HIPAA-compliant offerings and they do a lot of healthcare work. But OK Google is not a HIPAA-compliant product, nor are healthcare professionals signing BAA agreements with Google to allow the disclosure of protected patient data to a 3rd party.
Even if you did sign a BAA, the disclosure is not pertinent to patient care, and therefore prohibited.
5
They have HIPAA compliant offerings because they are offering that service to healthcare workers who are covered. It wouldn't make sense for a company to offer a product that fails to meet an industry standard. That doesn't mean that they can ever be held liable for violating the specific law
2
I don't think there's a law against recording patients, knowingly sharing information is what the main laws are about
1
I don't know about the Dutch law, but US HIPAA penalizes accidental disclosure. You may be able to beg a smaller fine for an accidental disclosure.
5
I don't know the specifics about that either, but I don't think they can blame a doctor for having a phone.
1
This is true of the US version as well.
1
Firstly, and most importantly, because HIPAA is a US law and not applicable in the Netherlands. If this happens in the US, it would likely be. But the challenge would be determining who is liable for said breach.
2
[deleted]
1
OK Google is not a covered entity
1
Knowing how things go... They will blame doctors and you wont be allowed a smartphone.
And they will take away your laptop and force you to document your SOAP notes by hand.
but... But.... HOW CAN I COPY PASTE ON PAPER?!?!
Actually it might change notes from these 4 page long dissertations into short one page texts again!
Cons: no one can read the handwriting in the note so they still won't read the progress note.
Lmao that assumes anyone reads notes now
I'm in the UK and we still write all of our ward round notes by hand.
No wonder you can see so many more people than we do here in the US.
We should go back to T-Sheets. Those long paragraph progress notes need to go.
Can we? I don't think a typical ward round sees that many patients. A consultant led ward round last year would've had generally been 14 patients, or half a ward over a few hours.
I don't feel particularly quick reviewing patients when I do my own ward rounds either, in fact if I don't know the patient it takes me longer because I don't have juniors to bring up the blood results and imaging etc. while I do other things. I also think that as juniors we tend to write more than the consultants.
My hospital still has a sign on the door that says "No cell phone use allowed in this building." As every nurse carries a portable phone required of them....
Hah yeah love this. "It'll interfere with the machines!" Well, better hope there ain't any solar flares, thunder storms, or wifi nearby. I hope to god we're not using unshielded cables in electronics patients are dependent on. And it's not like the radio signals from cell towers and phones outside the room just, you know, stop going through a particular room because phones are banned.
And since many hospitals are also requiring a smart phone for secure paging services....
Actually I have nowhere to go with this. The hospital will both require you to have one and will ban them and they won't see the problem here
That would be the time for collective resistance. Maybe not a full-blown strike, but definitely some work refusals…