hey there how are you
i am great i'm gonna turn up my volume a
little bit
so i can hear you okay
um we are recording a session on
um
an interview with the owner of the
twitter handle bad hipaa takes
by way of introduction
um at the start of the pandemic
um all the way through the insurrection
in the capital and on into the vaccine
rollout
nationwide healthcare privacy law hipaa
with two a's and one p
has gotten more famous and more
misunderstood than ever
out of this morass of politization and
polemic emerged the twitter handle uh
bad hypothetics at bad h-i-p-p-a notice
the misspelling
this twitter handle shines a light on
the absurd the funny the sad and even
the accurate in a must follow for anyone
interested in privacy
today i'm going to be interviewing the
author of that handle and asking them
some questions based on what they've
seen in the past year and the future of
uh health information privacy law in the
u.s so i'm just going to kick it off and
get started
i think the first question we want to
know is what motivated you to start
tweeting about bad hepatics
it all started with the epidemic of
masks exemption cards that showed up on
twitter back in may of 2020 when i
created the account
these were being shared all over by this
fictitious freedom to breathe agency and
they were talking about how you know
hipaa spilled incorrectly of course and
the fourth amendment prohibit people
from requiring masks and not being able
to ask about what you know why you're
not wearing a mask and those sort of
things
and those cards you know referenced
those those
those laws and
used official government logos to
appear credible and official
this misinformation campaign
really bothered me
i wanted to see if i could do something
to put a stop to it
in retrospect the answer is no clearly
but
that's just that's here we are
um and i'm a follower of the bad legal
takes account and a few others in that
same bad takes vein on twitter and i
thought that was a pretty good format to
emulate
so i started there and it just kept
going and here we are
13 months later yeah
and and we're going to be at it for a
while no doubt now when we were first
arranging this i checked and you had
about 15 000 followers that was a couple
of months ago what are you up to today
and does it surprise you that that many
people are following along
i'm over 18 000
and growing as of today there's actually
literally as we're recording this
session there's an incident going on
with one of the
one of the people that has has become a
favorite bad hipaa tweeter marjorie
taylor green
and you know my mentions are absolutely
exploding i i'm tremendously surprised
by this i i never imagined
that such a niche
area of interest would attract this kind
of attention
you know i think i tapped into a moment
people found the message relevant and
humorous i get a lot of gratification
from knowing that i make people laugh
with my content i get some nice dms from
people thanking you for running the
account which is which is always good i
don't do any kind of you know tweet
promotion or monetization or advertising
i've had solicitations for it it's just
not my thing so it's all been
purely organic growth
um you definitely people definitely get
more with honey than with vinegar and i
think humor you know goes a long way
about that
um and we'll get to marjory taylor green
maybe in a minute but i guess my next
question is sort of looking back over
the last 13 months almost 14 months now
do you feel like the takes you you find
sort of have categories and what would
those categories be
yeah for sure i mean the lowest hanging
fruit is just the simple misspelling
which you know that's that's kind of
boring on its own
you know people spelling it with you
know two p's in one a thinking that the
peas stand for privacy protection most
of the time which of course there's no
privacy mentioned in the name of the act
um then there's you know the the excuses
for not wearing masks and wanting
exemptions from that excuses for not
talking about vaccination status that's
another kind of major category and
probably the largest overall in volume
early on when contact tracing was a new
thing people were learning about because
probably most people had never heard of
it before
that was a big topic people were
thinking that contact tracers were you
know violating hipaa by asking about you
know how you came to contract the virus
right then there's
reporters
you know talking about sports injuries
or players being out for covet or you
know whether they're vaccinated or not
and you know this this is all stuff
that's like the the players have waived
their privacy in most cases you know
under the league collective bargaining
agreements and other contracts so that's
not not really a violation but it keeps
coming up and then there's the final
category really is the
celebrity and politician stuff you know
this this politician saying you know
x y is a hepa violation when it's not
or you know the members of the public
getting upset when you know their guy
has some kind of you know health
information out into the public by you
know reporters or people on twitter or
whatever
yeah yeah exactly and then in terms of
all of those categories and i'm sure
there will be more
hot bad takes coming in the future but
like what's your top one or the favorite
one you've had so far and i saw the
green day one just today i was checking
um and so that was pretty good but um
what's your favorite
yeah i i think
i don't know if i have a favorite bad
take you know there there have been so
so so many and i tried you know
researching back through my timeline and
couldn't find one that really jumped out
but you know by just by volume you know
the reactions by the public to
the the contact tracing early on and the
more recent announcements by the
administration about the door-to-door
vaccination outreach that one got a lot
of attention very quickly
and you know i i wanted to say something
about that you know personally i'm very
disappointed in the messaging on both of
these topics
the administration really stepped in it
when they spoke out so vaguely about
this door-to-door initiative and left
room for
the most disingenuous of their opponents
to you know make all these these
accusations that the government was
keeping you know secret lists of
unvaccinated people and all kinds of
this this nonsense
you know and and the whole just overall
politician politician politicizing our
response to the pandemic has has cost
people their lives and and that's just
it's just unforgivable yeah no it's and
i mean as somebody who used to explain
hipaa to the rest of my political
colleagues in the government i i i feel
that very um at a very empathetic level
because i remember my own conversations
where somebody would say well doesn't it
do blah blah i'm like no actually it
doesn't do that at all
um and so i think
a and a really important object lesson
uh in the privacy realm for all this is
that you can't explain it simply enough
often enough
and that's one of the great things about
your handle is that it it
tries to get to the nut of what what
really is the health information privacy
law and what it what it means and then
of course we'll talk about this in a
little bit
where does it not apply which is a
really key
key part of it
um
so i wanted to ask you you may it makes
people who read your handle laugh but
you must be laughing yourself sometimes
so do you have you know a favorite
humorous uh moment with your handle or
reply
to uh something you posted
yeah there was one
you know a day ago which you know
there was a good hypnotic because there
was an actual violation involved
but the the comedy of it was the set of
circumstances surrounding it i'll i'll
read the tweet and kind of paraphrase
what uh what they say because there's
some stuff in it that's a little you
know
adult in nature but you know oh i think
i know which one you're going to talk
about that one was that i bet you do
yeah so this is
a warning on the recording uh people
under 18 shouldn't be listening to this
part of the recording now go ahead
yeah
so the the handle that tweeted it out
you know
goes by the name bowl cut boy
they said you know
one of my fans got fired from his job
because he violated hipaa when he posted
a video of him
performing a sexual act i'll say in a
private inventory room for his only fans
and exposed six patient names and
addresses no words
and i mean this one was just hilarious
to me because you know it's
talk about a a bad way to get fired and
you know a ridiculous way to violate
hippa
and not to mention
is the person who tweeted that should
they even be telling the story of
somebody else's firing in such uh
extraordinary circumstances like there's
a whole privacy angle to that too right
the person
they're telling a story about somebody
else they're not telling their own story
yeah of course who knows if it's true or
not i mean you know if it's on the
internet it must be true
right insert left track here
right well that kind of takes me to the
one that i i found one of the funniest
ones here which was
several months ago you you had a whole
string from a
twitter author who was claiming that
hipaa derived from the nuremberg treaty
and i know quite a lot about the history
of privacy laws and most people date our
concern about health information privacy
to the 1970s the belmont report or maybe
farther back to justice brandeis but
i've never really heard the nuremberg
trials cited um i have to say i did go
down the rabbit hole of that tweeter's
tweets to like kind of see what was
there and whether there was any
substance like did i miss something
should i educate myself on something it
turned out to be a complete dead end
um but i wonder if you ever see takes
yourself that you're like hmm is there
is it should i go down that rabbit hole
should i check on whether that thing is
true or not um or mostly uh you avoid
the bait
so
like any human
i'm not always as thoughtful as i
probably should be
but there are definitely times when i
will pause and review
the regulation review the content that
i'm looking at look for more context and
try to find you know find out more about
who said what and why and what's behind
it there are plenty of submissions i
won't take on at all
just due to the nature of the topic some
some things are too radioactive
even for an anonymous account to really
want to engage with or things i just
don't want to associate myself with
you know a recent example
you know and this isn't too bad but you
know there there was a another tweet
i'll kind of you know paraphrase a
little bit because again it's got some
you know profanities in it
uh from a a person saying they're an er
nurse um had a effing cop come up to the
nurse's station trying to find out if a
patient was getting discharged so we can
detain the individual on the way out of
the hospital
i told him to get asked if he thought i
was going to violate hipaa and called
security felt good
so this was a person who you know in a
you know healthcare provider capacity
right hipaa does apply
but does it apply to this exact
situation and i you know i had to go
re-read the regulation and specifically
look for some cases where disclosures to
law enforcement without you know patient
authorization are allowed and you know
it's quite possible that there that this
does fall under one of those exceptions
but i don't know i would be speculating
because there's not enough facts in the
tweet to really come to a solid
conclusion so that's that's one where i
i i couched my response a bit with you
know the possibility that there's not
enough information
right well and there are always that i
mean i have this myself i don't have 18
000 followers so i'm envious but uh
where people really just want you to
give them the entire regulatory analysis
not only on twitter but in public and
for nothing and since certainly for me
i'm in the business of being a lawyer i
like to get paid for my expertise um
unless i'm doing something as fun as
this in which case i'm all in on
volunteering
um
but uh
let me let me ask you about sort of some
a few more serious things right now so
18 000 followers is a pretty big
following in a really rarefied niche and
i have a few questions about this sort
of niche part of it the first one is um
you know that's a pretty loud big
platform i know i know who follows you
and it's a lot of people who can be good
amplifiers of well-placed
comments and ideas um do you ever want
to use your platform to like sort of
change the way our laws work and and if
so what would you want to change
i i think
it would be great to find an avenue for
using my you know using my powers for
good as it were
i think my desire for privacy and
anonymity might ironically present a
substantial obstacle to that i don't
think congress takes anonymous testimony
from novelty twitter accounts
but in the meantime you know in my
personal capacity you know i do what i
can to emphasize
appropriate customer privacy controls
and security as the first classes and of
the work that i do in
in my day job
um as far as
you know
going further than that
i'm not sure what you know what a good
approach would be but you know maybe
there is some space for collaboration
with some of the other higher profile
folks folks like yourself and others
that uh that are you know
on my timeline who would
be able to amplify some interesting
ideas
i don't know if you wanted to segue into
that one about prospect for changes in
hipaa or something else yeah i i think
that'd be great um i it's definitely
something for this particular audience
at the biohacking village that we talked
a lot about last year last year i did a
presentation about how to you know what
were the laws and how to influence them
i think that
in many ways the
consumer privacy conversation is
somewhat more abund obviously the bind
administration came in with some very
specific
um
agenda items that you know have to do
with covid and getting the economy back
on track and infrastructure and then of
course the politics of congress are very
complicated right now with these
uh very thin majorities sort of not
really a majority in the senate um but
it's also a situation from to my mind uh
being sort of in privacy and a digital
health advocate that if we don't fix the
consumer privacy side of the equation
then the power of digital information to
really help us improve our society will
be
quite a lot for stalled and so i'm a
huge advocate of actually individual
citizens letting their congress people
know what's important to them
but what do you think i mean you're
looking at that you're getting a lot of
information from people on twitter and
there are a wide a wide variety of
people are people
obviously they they don't understand
where hipaa ends so there's that but
what else are you observing in the way
people are interacting with you about
their consumers awareness of their
privacy rights whether privacy is
important to them
as opposed to like a convenient
political excuse
yeah i think it's both um
you know
as far as awareness goes i don't i don't
think that like over the last year i
don't think i've observed
that people are becoming any more aware
of their privacy rights and laws
you know even with
recent articles that they've been from
uh some of the trusted news outlets
highlighting how incorrect people are
about what hipaa is really about there's
so much resistance to those facts you
know again just going back to like
marjory taylor green she continues to
spout about hipaa and wrong ways and
she's making it worse
um i don't have data to support you know
the level of awareness um you know and
my my viewpoint on it will be naturally
biased by what i'm observing right i'm
looking for the worst and dumbest things
that i can find
because they're the funniest to talk
about
um but you know what i really think is
hipaa for a lot of people is a stand-in
for the general privacy protections that
they wish they had
it may be the only thing the only
raw regulation
that they've been exposed to in the
privacy space
so i don't blame most normal people for
not understanding it after not even
reading the notice of privacy practices
that they got handed at their doctor's
office like that's probably how most lay
people are even introduced to the
concept of hipaa
so short on details
they're they're they can be excused you
know for not knowing
yeah you know i i think i think that's a
as a standard i think that's a really
great way to frame it but uh then we
have to assume that people wish they had
some kind of better
privacy rights what are our prospects
for that and and
i mean you know there's like the
european method there's like the
brazilian method there's the you know
state of california state of colorado
there's a lot of different ideas kicking
around
um do you see kind of any prospects for
that and and if so where do you think
they should go
which direction should we go
i think um you know thinking about some
of the other laws that are out there you
know gdpr pivot uh you know
the uk's privacy uh data privacy act
there's all these templates right
california has the cpp colorado just
passed a new one
you know and all of these things
can serve as templates and experiments
for
you know figuring out what works and
what doesn't and what consumers and you
know individuals need and don't care
about
you know and so that state by state
aspect is interesting you know it's one
of the benefits of federalism you know
we can try things across different
states and see how it goes and you know
people in their own kind of unique
cultures and in those states can can ask
for the things they want
um and then it gives us the opportunity
to observe and correct and continuously
improve
the downside of it though is
the resulting confusion and disparity in
how individuals are protected and how
companies must act you know think about
the this huge shift to remote work we've
seen
what do you do and you're an employer
and you've got employees in multiple
states office locations in multiple
states the business is incorporated
somewhere else
you've got probably maybe even some
global offices how do you possibly begin
to manage the the different privacy
regulations in you know in a single
population that has unique laws that
apply to it
you know even in the consumer retail
space how does somebody like amazon
handle 50 different privacy regulations
for 50 different states
what if you're a customer and you have
homes in different two different states
and now you
when you buy a thing which privacy
regulation applies to it so i i would
advocate that
you know that this is just to give a
little bit of window into my my
philosophy i think this is one of the
rare cases where i were where i would
want the federal government to
take a position and for that position to
be largely driven by
individuals who have done like you said
earlier contact your your congress
person
let them know what matters to you about
privacy let them know how you're not
being served let them know how you've
been injured by
your privacy breaches
and and that sort of thing
and then maybe we can actually get
something that represents uh the needs
of a broad cross-section and doesn't
create undue burdens
for everybody to try to implement and
understand
yeah and i think that's right and i mean
it's you know the whole conversation in
congress is moribund good good thing for
the states that can take action but
it is you know the people are mobile and
so is their data
and that for that reason alone we should
have something that's the same
everywhere i'm i'm supposedly an expert
in this and i don't want to have to
think about it as i move from state to
state or buy something from through
amazon but the shipper is actually in
kentucky like i don't want to have to
think about it
you know and and and i can imagine what
it's like for somebody who barely who
knows enough about hipaa to know that
it's a thing and spells it wrong
right
um as opposed to being a general law
that applies to everyone i i i don't
know what will make the
will jump start the political
conversation perhaps it's
um something having to do with cyber
security or the other activities that
are occurring relative to our big social
media platforms and so i want to turn
there
um in uh some of our remaining time
um so you know the biden administration
has done a couple of things since coming
into office one is it enacted a really
uh what appears to be a very uh broad
and cross-cutting executive order on
cyber security but my take on it is that
it's primarily about um
the supply chain particularly the supply
chain controlled by the government which
makes a lot of sense given what
executive orders do they don't regulate
private conduct they tell the executive
branch how to execute their duties
um but sometimes especially in the
purchasing realm the way the executive
branch executes its duty can really have
a great ripple effect into the rest of
society and so a question has come up
that we would we really would appreciate
your insights on which is you know will
that executive order on cyber security
change anything about the we what we
experience as consumers and health care
patients or health care
people working in health care um from a
privacy and security perspective i don't
see that but maybe i'm missing something
yeah i mean executive orders can only do
so much as you pointed out right by
their nature and constitutional limits
on executive power their scope is
limited
biden can direct his agencies to
undertake these efforts and figure out
how they spend money and who they spend
it with but this infrastructure
hardening is going to take a ton of time
and money
whatever they don't have in the budget
they'll have to run through congress
and back your point about congress and
it's you know moribund nature
uh i don't see progress happening there
and with all you know
what we
if we do manage to spend the money i
think what we'll mostly see is
an enrichment of existing i.t
contractors federal i.t contractors like
general dynamics boozell and hamilton
raytheon et cetera i see these kinds of
executive orders more as a vehicle for
publicity and call to action than
something that actually does a whole lot
yeah you know i i'm not i'm not
especially bothered that
this order doesn't mention health or
health care you know it i think to the
extent that there are federal systems
that handle health care data you know i
guess medicare and medicaid could be
affected by this so if we've hardened
the infrastructure that supports those
services and those
those agencies then you know the people
that are using those services should
experience some knock-on benefit from
that
but
uh you know the the other side of it the
thing that scares me about executive
orders like this is that whenever the
government starts talking about and
using the language of fear which you can
definitely read that in in that
executive order the fear of you know
cyber attacks and all these things
you can expect bad things
um yeah when we passed the patriot act
and you know and all that domestic
surveillance that came with the patriot
act that's one example so i worry about
a potential expansion of that kind of
activity you know with like an unholy
alliance between the federal government
and network carriers
you know and trying to do things like
you know
go go and get get those back doors to
encryption methods that the the federal
government's been begging for for
decades
so that's that's what i see as a
potential downside of this kind of of
order and the things that might come out
of it
you know it's an interesting discussion
point as a person who whose data was
stolen by whoever hacked opm
um you know they they took a whole big
file i know i know exactly of mine what
they took but also many many many
millions of americans um you know and at
the end of the day i think the the story
in the po in the washington post which
has pretty good reporting in cyber
security was that you know opm
outsourced something that outsourced
something that outsourced it to somebody
else who outsourced it to china and a
backdoor got built in
um and so that all i always think about
the supply chain and how it basically
uh is a uh
something that comes into conflict with
the government's desire to spend as
little of taxpayer money as possible and
it's a complicated a complicated thing
good cyber security takes resources
yes it certainly does and that supply
chain i mean
that's you know we've seen lots of
supply chain attacks in the last few
years and that's going to continue to
grow especially when there's valuable
data targets out there
yep and and when people are you know
giving giving them short shrift um
that's almost a whole conversation for a
whole nother day
but i had a second thing i wanted to ask
about relative to the bite
administration so the second thing
they've been doing and some of the
states back to the trump administration
and the last years of the obama
administration as well but some of it is
new is really kind trying to look at um
the the relationship of um
platforms large platforms dominant
platforms with
higher volumes of data and i'll get to a
few of those in a second and that the
impact of that on competition so um
you know we have a new a brand new
caught off the press last week executive
order on um competition in
uh social media platforms really looking
at or you know the facebooks the
twitters the googles the amazons of the
world but even before that we had um the
hhs attempt to kind of unblock health
information that was really held by two
or three dominant ehr systems which are
uh from a structural standpoint
analogous to a google or a facebook like
everybody is there and that's why you go
there right that's the walled garden and
all that kind of stuff and so and that
resulted in this you know ban on
information blocking and the
governmental attempts literally since
2015 to fortify
um the right of you and i as individuals
to get and control our own health data
from a holder of it so in my mind those
things are related because the more you
hoard the data the harder it is for
incumbents to
bring new ideas to market new
innovations to market of course the
harder it is for patients
if their data is being hoarded to you
know take the action they might want to
take to find another doctor or whatever
it is because it can't get their data
out of the place it is and i was
wondering if you had um sort of any
thoughts about
um whether really focusing on these
incredibly large data data oh i was
going to say one more thing and the
third thing is obviously within the big
social media platforms people do use
those to you know to talk about their
health their facebook is chock full of
um
uh you know groups where people are
providing peer support for particular
health conditions from hiv aids to
domestic violence to breast cancer to uh
veterans with ptsd it's really the whole
gamut and they're all kind of trapped
because there are no other networks that
have
that level of peer interaction you know
the same number of peers as it were so
people really feel stuck there as well
so looking at that whole big stew of the
relationship between large caches of
data
and the effect of that on competition
both from a business innovation
perspective that might benefit consumers
and from uh the perspective of consumer
empowerment
do you see the same kind of uh
issues that i see or do you have a
different perspective that you know it's
okay
how would we go about uh how and if if
it's not so great what should we do
about it
i agree completely that privacy and
competition are inextricably intertwined
you know
just from my own experiences you might
guess that i'm a fairly outspoken person
i've had my share oh gee i never would
have thought that
right
i i've had my share of run-ins with
facebook's defective in my opinion
content moderation system
i don't mean the algorithms only i mean
the people that review bad automated
decisions as well
and i would love nothing more than to be
able to take you know take my toys and
go home take my data from their platform
and take it to somewhere else you know
maybe miwi or some other social network
upstart
could build an import method so that i
could download my facebook data from
there and import it over there and then
boom now i'm kind of you know i still
have all my stuff
but the problem with that is the network
effect
i can't convince many people to migrate
off of facebook despite all of the
things that they also don't like about
it it is just so powerful and the force
of inertia keeping people in that one
place
makes it very very hard to to make that
kind of a move
so
because that
the competition is limited both
naturally by that network effect and
mechanically by the information service
providers like facebook
there is no way to migrate your data
from one to the other you can't migrate
your your friend network from one you
know service to another
consumers don't really have a way out to
your point these support groups that are
on
you know facebook or take your pick of
whichever network
it's very very difficult to to pick up
and move that and there's so much value
in those communities being able to
support each other and do all of that
work that
you know it feels like
there's a spot for the government to
push on this somehow
i'm a fan of a light touch from our
government
but there's
got to be some way to balance the the
property rights of service providers
who've built these immense platforms and
run them at incredible cost
and the privacy protections and maybe
portability protections for individuals
and thinking about hipaa you know tying
this back to hipaa that was originally
about portability right the ability to
move from one employer to another move
your health data move your health
coverage all that stuff
and so i think there's a pretty strong
parallel there for you know a personal
information portability regulation that
if if you are
submitting all your information and
getting stored in these these massive
databases
you ought to be able to have control
over it i think that's something that
people can all kind of agree to i think
if you talk to individuals they would
agree to that
but getting people to think about that
and care about that enough that they
would talk to their representatives
about it that's a different kind of
effort
yeah no i think i think that's right but
that that's a great segue to my next
question which is of course um hhs and
omc and the office for civil rights are
working on this pretty hard with this
fortification of the long-standing right
under hipaa of an individual to get a
copy of their own data and of course 20
years ago that meant a photocopy from a
manila folder but it's come to mean you
know the electronic data in the ehr
that um your doctor's office is storing
on you or in fact in this case your
health plan as well
and um you know the requirement that
covered entities make that data
available
when you you as a person present an app
to them i was actually just talking
about this at work yesterday
and i can tell you i will be changing
doctors in uh january changing health
systems and i plan on taking all my data
with me if i can
depending on how hard it is um but i was
wondering i know you're aware of that
what are your plans are you gonna are
you gonna get your data and put it you
know on your files at home or pull it
into your apple um health kit or
whatever your own personal phr is you're
gonna take advantage of your right
to whatever extent i need to you know
i'll say i'm i'm blessed with generally
very good health so i have what i would
say is fairly limited you know phi
hanging out out there in various
databases
so you know for me i don't
i don't typically experience difficulty
with getting that data from the doctor's
offices or hospitals or whoever when i
when i need it but that's also because i
know about these rights and i am able to
as an outspoken person be a strong
advocate for myself with the house
health system
that's not something that everybody
is blessed with
right you know but all that said like i
think the requirement that phi be made
available electronically and
transferable to personal health app is
great
i think going back to the the commentary
about
portability and
competition and privacy and security
you know
there have to be some pretty strong
controls and
i think pretty significant penalties in
place available for those personal
health apps you know if those become
pretty rich targets again for cyber
security threat actors
and so where where that data
consolidates
it becomes an interesting target
it might
it might have the opposite effect if
there's an explosion of personal health
apps then maybe that distribution of the
data across you know dozens of
of different systems and databases and
applications
means that there's never as much of a
single big important interesting target
you know that that might be an
interesting effect
sort of like blockchain but for real
um
sorry i'm a cynic about but yeah
you know i understand and also it could
be in in our dream world that if there's
an explosion of competition in the space
of people helping you as an individual
manager health data that there will be
competition on privacy i mean it might
be that it turns into pay for privacy
but it also
could be
just
right
rising tide of privacy in in in the way
these apps function that's that's for
sure
um well we're coming up to the end of
our time i have one last question for
you which is here we are we're making
this recording for the biohacking
village at defcon if you had one thing
about hipaa that you want your audience
to take away with them today what would
it be
uh the big thing really is
hipaa is about more than just your
privacy
a key thing that i think everybody needs
to know about it and we talked about it
a little bit already is that right of
access
the ability for you the patient to
always have the right to receive your
health information is so important
for you to be able to advocate for
yourself um you know you have to be able
to see what your records say you might
need to audit them and correct things
that aren't accurate because not
everything is perfect in the health
system and
you know the ability to then share that
data with other providers that might not
be connected with
you know the insurer that you're working
with or might be in it you know
a specialty provider in another state
and it's difficult for them to interact
with your provider directly you know i
have friends who
i've counseled about this where they're
having terrible time you know they're
they've got complex health problems that
they're trying to navigate
and they're having difficulty getting
their data delivered from you know like
the imaging
provider
hasn't been able to send imaging over to
their specialist
right
yeah
so for me like
yeah well different formats different
applications different systems i mean
that's all it's all hard right you go to
you go to the imaging place and they had
you with a cd and it's like what am i
going to do with this right
well you know imaging is weird so the
other
i was just gonna say imaging is a weird
one because in fact the radiology
centers are usually using storing it in
the cloud and they could just give you a
credential
right they don't actually have to give
you the cd they could give you a
credential or they could give a
credential to the person you want to
have read the image it doesn't have to
be a cd but that's like a whole nother
problem yeah
did hipaa scare them off from being able
to do that were all of the the scary
regulations and things something that
made them say well no i have to do this
in this like maximally secure way and a
cd nobody could ever intercept that you
know
i don't know i that's one of the myths i
never got to bust but it's definitely
i've looked at it myself for my own
radiology like why don't you just give
me a credential to your cloud and i'll
go look at it
right
and then beyond that the other thing
changing in that right of access is a
new requirement to go to 15 days instead
of 30 for the delivery of those records
so that's really key to
you know when when you're trying to get
something
you know when you have a health problem
time is of the essence and you know you
can't be waiting on providers to send
data back and forth to each other
sometimes you have to take it into your
own hands to acquire that data and move
it to them yourself
and so i think again just right of
access everybody should go go visit the
hhs.gov website search for hipaa right
of access read about your provider's
obligations understand what they have to
do and and what they're not allowed to
do
and make sure that you're able to
advocate for yourself in the health
system
there's also hot tip there are actually
some really great videos live action
videos that are on the ocr's youtube
channel and you can uh put the links on
your phone and then you can just play
them in the doctor's office for the
receptionist
even better
i know having having written the check
for those videos uh we had a lot of fun
making those well we were we are kind of
at time and i'm really glad to have been
able to do this i want to give you a
chance to ask me a question if you want
i kind of live out loud and people know
who i am but if there's anything i can
answer for you i'd be happy to
any questions that you want to put on
out on the table
i guess what do you what do you think is
going to be
the
evolution of things over the next decade
in
health i.t you know where where are we
really going to go i mean there's stuff
starting to happen now you know systems
are getting more interoperable and all
that does that just kind of continue
does that accelerate
uh
what do you what do you see happening
there
i mean i've i've been working in this
space for a long time and i definitely
see that the digital technology has um
really enabled a convergence
of economic sectors that used to operate
pretty separately
and they're converging at kind of at a
business to business level
the thing i don't know is that back to
sort of more abundant consumer privacy
law i think that they will
um
we will never really get the value of
that from a uh an economic learning and
improving our society
uh
perspective until we can make sure that
consumers feel 100
secure or far more secure than they feel
now about how data about them is being
used because the consumer mistrust will
erode
the ability of the digital technology to
innovate
it's it'll be like a little like the
tide coming in and out right there's
always a wave in but there's always the
undertow pulling back
um so that's what i would really like to
see solved i would really like to see
a world in which consumers feel a lot
more confidence
both about what's happening specifically
with information collected in the health
information system so technically
subject to hipaa right now but also
information that is some people call
health adjacent information's about your
health but is being exposed about you in
the rest of your life in facebook in
your amazon shopping in your google
search
um you know in your in your personal
social media posts wherever you post
your your own status your flu tracking
and all that kind of stuff so that
people feel that they can contribute
knowledge without
actually having it harm them that's
where i want to go is people to be more
confident about contributing knowledge
that they're not going to be harmed when
they do that so that's why i hope that's
where i hope we go that's why i get up
every morning and keep working at it
yeah that sounds like a great future i'd
love to see that
yeah well this has been super fun thank
you so much for being open and sharing
your views with us um for the audience
this is a great uh follow just
keep keep the follow count up it's at
bad hippa with two peas at bad
hypothetics um it'll be a source of
constant amusement and you might even be
able to post a question so thank you so
much for your time today
appreciate it and enjoy them
oh it was it was amazing let's stay in
touch on twitter
we shall all right take care