site banner

Small-Scale Question Sunday for May 4, 2025

Do you have a dumb question that you're kind of embarrassed to ask in the main thread? Is there something you're just not sure about?

This is your opportunity to ask questions. No question too simple or too silly.

Culture war topics are accepted, and proposals for a better intro post are appreciated.

2
Jump in the discussion.

No email address required.

Sure, a hospital, and maybe my doctor, is going to put on this big show of paranoia when it comes to disclosing my PII to each other.

But if I have definitely "legally" given them "consent" to give my PII and PHI to 3rd-parties that I'm not even able to learn the names of, what reason do I have to think that those 3rd-parties will take similar "precautions"? The only thing those 3rd-parties have to do is make sure they don't literally have my legal name in the same CSV file as any specific diagnoses when they get hacked, and I'll be none the wiser.


My workplace offers as a benefit genetic cancer screening. I thought this would be a neat thing to check out, since I'm really unsure how much of the skin and breast cancer in my extended family is just due to their shitty lifestyle. But the screening company's privacy policy did not inspire confidence, so I sent them this e-mail:

  1. How do I opt out of “Health Information Exchange” sharing?

  2. How can I know when my information is used for “Research”?

    • How can I get copies of the IRB approval?

    • If the final research paper is paywalled, are the involved patients entitled to a free copy of it? 😁

  3. I see that you share patient health information with an undeclared list of Service Providers, Medical Providers, Public Health Authorities, Other Parties, Business Partners, Affiliates, Subsidiaries, Advertising Partners, and various "API and SDK providers".

    Assuming you maintain records of this sharing, how could I request a complete account of it, including:

    • Exactly what information was shared;
    • The legal name and address of the 3rd party the information was shared with;
    • The date the information was shared;
    • The specific purposes for which the information was shared;
    • Any specific constraints on when the 3rd party must delete the information;
    • A complete list of “4th parties” the 3rd party is authorized to share my information to, including legal name and address?

The reply I got back did not address most of my questions, and only claimed that

  1. they don't actually traffick information to HIEs at this time (that was just boilerplate from the privacy policy they blindly copy-pasted from a legal document repository);
  2. all their studies are done internally at this time; and
  3. "[Our company] does not sell or share any information ... with any advertising partners. We will be updating our Privacy Policy to ensure it accurately reflects our commitment to protecting your data and maintaining our trust."

(This was 3 months ago, but their posted privacy policy still explicitly states, "We may disclose your Personal Information with advertising partners.")

Sure, a hospital, and maybe my doctor, is going to put on this big show of paranoia when it comes to disclosing my PII to each other.

I can tell you it's not a show, if I'm in an elevator talking about "John Doe" or even like Dingle McCringleberry the nursing administration gestapo are going to crawl straight up my rectum.

I suspect the rest of your stuff would be resolved if you actually talked to someone who knew what they were talking about and wasn't worried about covering their ass (for instance an HIE in this context probably refers to routine health record sharing that you want in case you are in a car accident in another city).

Granted something like 23 and Me is a different story.