Consumer Watchdog and Other Privacy Groups Urge FTC to Block Pending Facebook Privacy Changes

“A coalition of six consumer privacy groups is calling on the Federal Trade Commission to enforce an earlier consent order with Facebook and block proposed changes in the social network’s Statement of Rights and Responsibilities and its Data Use Policy because the proposed changes violate the 2011 settlement with the Commission.”

“The changes will allow Facebook to routinely use the images and names of Facebook users for commercial advertising without consent,” the groups said. “The changes violate Facebook’s current policies and the 2011 Facebook settlement with the FTC. The Commission must act to enforce its order.”

Signing the letter were Consumer Watchdog, the Electronic Privacy Information (EPIC), the Center for Digital Democracy, Patient Privacy Rights, U.S. PIRG, and Privacy Rights Clearing House. Read a copy of the letter here: http://www.consumerwatchdog.org/resources/ltrfacebookftc090413.pdf

“Facebook has long played fast and loose with users’ data and relied on complex privacy settings to confuse its users, but these proposed changes go well beyond that,” said John M. Simpson, Consumer Watchdog’s Privacy director. “Facebook’s overreach violates the FTC Consent Order that was put in place after the last major privacy violation; if the Commission is to retain any of its credibility, it must act immediately to enforce that order.”

To view the full article, please visit: http://www.marketwatch.com/story/consumer-watchdog-and-other-privacy-groups-urge-ftc-to-block-pending-facebook-privacy-changes-2013-09-05

Surgery photo leads to privacy lawsuit against Torrance Memorial

“A doctor put stickers on a patient who was under anesthesia, and a photo was taken. The lawsuit underscores how, despite hospitals’ rules, the pervasiveness of cellphones raises concerns about privacy.”

Quotes from Dr. Peel:

“‘The idea that people are using their cellphone or even have one in the operating room is crazy,’ said Dr. Deborah Peel, founder of Patient Privacy Rights, a nonprofit advocacy group in Austin, Texas. ‘It’s a massive security risk and incredibly insensitive to patients.’”

“In similar cases elsewhere, Peel said, hospital personnel often lose their jobs. In 2010, for instance, four employees at St. Mary Medical Center in Long Beach were terminated because they used cellphones to photograph a dead emergency-room patient and shared the photos with others, according to state records.”

To view the full article, please visit: http://www.latimes.com/business/la-fi-hospital-patient-privacy-20130905,0,7915045.story

Health apps run into privacy snags

“The next time you use your smartphone to inquire about migraine symptoms or to check out how many calories were in that cheeseburger, there is a chance that information could be passed on to insurance and pharmaceuticals companies.

The top-20 health and wellness apps, including MapMyFitness, WebMD Health and iPeriod, are transmitting information to up to 70 third-party companies, according to Evidon, a web analytics and privacy firm”

If you are a subscriber to ft.com, you can view the full article at: Health apps run into privacy snags

FTC Files Complaint Against LabMD for Failing to Protect Consumers’ Privacy

The public would be surprised how little thought or money healthcare businesses put into data security.  LabMD is probably just one of thousands of healthcare businesses that don’t encrypt patient data and whose employees who use file-sharing apps to download music, etc, exposing patient records online.

We need new laws that require businesses that hold health data to be audited to prove they protect it.

Shouldn’t businesses have to prove they use tough data security protections before they are allowed to handle sensitive health information?

To view the full article, please visit: http://www.ftc.gov/opa/2013/08/labmd.shtm

Privacy Advocates Set Their Sights on the Wrong G-Men

In the wake of NSA revelations, key privacy advocates make the point that private corporations and the government are working to ensure total surveillance of all digital information about all 300 million Americans and lock in billions in corporate revenue from the sale of personal data and detailed digital profiles of everyone in the US.

Corporate and government collection, use, and sale of the nation’s personal data is opaque.  The author of the story below trashes several  privacy advocates and misrepresents their key points about the hidden ‘government-industrial complex’.  And he claims that “Individuals can choose not to use a particular social network, search engine or website.”  But individuals have no meaningful choices online. See the documentary: “Terms and Conditions May Apply”.

The lack of trust online and in all holders of personal data is why President Obama proposed the Consumer Privacy Bill of Rights (CPBOR). Unfortunately the proposed data privacy protections in the CPBOR do not apply to the most sensitive data of all, health data.

Meanwhile,  the ‘government-industrial complex’ is destroying Americans’ most fundamental rights to privacy. The highest right of civilized man is the right to be ‘let alone’—which happens to be the foundation of Democracy.  Yet all we read about are the wonders of ‘big data’ and the need to collect and use personal data without meaningful informed consent. We can certainly use big data for innovation and benefits—but the public wants to be asked permission for all uses of data, especially for ‘research’ uses. Big data analytics is research.

  • See Westin’s research that shows only 1% of the public approves use of health data for research without consent. See more of his findings here.

Today US citizens have no control over their most sensitive personal information: health data from DNA to prescriptions records to diagnoses—-because privacy-destructive technologies and system architectures prevent us from exercising our rights to give meaningful informed consent before health data is collected, used, disclosed, or sold.

To view the full article, please visit: Privacy Advocates Set Their Sights on the Wrong G-Men

Privacy groups criticize proposed $8.5 million Google settlement

“Five U.S. privacy groups have opposed a proposed $8.5 million settlement with Google in a class action lawsuit over search privacy, as it fails to require Google to change its business practices, they said.”

Read more at: http://www.pcworld.com/article/2047323/privacy-groups-criticize-proposed-85-million-google-settlement.html

Privacy Groups Seek To Scuttle Google’s $8.5 Million Data-Leakage Settlement

“Google’s attempt to settle a privacy lawsuit by donating $8.5 million to nonprofit groups and schools should be rejected, advocacy groups argue in a letter to U.S. District Court Judge Edward Davila.”

Read more: http://www.mediapost.com/publications/article/207420/privacy-groups-seek-to-scuttle-googles-85-milli.html#ixzz2eQQGnJNG

Health data breaches usually aren’t accidents anymore

While the healthcare industry has made advancements in how they protect our most personal information, those trying to steal our electronic health records have become even more savvy as to how to access them.

Key Quotes from the Article:

“One of the biggest changes during the past decade is the data being targeted. Ten years ago, it was personal identifiable information. Now, said Rick Kam, president and co-founder of ID Experts in Portland, Ore., personal health information is being targeted, mainly because of the value it holds and the relative ease thieves have getting their hands on it.”

“94% of health care organizations have had at least one breach in the previous two years.Because data can now reside in multiple locations, including unsecured smartphones, laptops and tablets, and can be transported to an infinite number of locations, thieves, whether they be outside hackers, device stealers or people who try to use staff to share sensitive information, have more areas to target.”

States Review Rules After Patients Identified via Health Records

To view the full article, please visit States Review Rules After Patients Identified via Health Records.

Key Quotes from the Article:

  • -”Some U.S. states are reviewing their policies around the collection and sale of health information to ensure that some patients can’t be identified in publicly available databases of hospital records.”
  • -Bloomberg News, working with Harvard University professor Latanya Sweeney, reported on June 4 that some patients of Washington hospitals could be identified by name and have their conditions and procedures exposed when a database sold by the state for $50 is combined with news articles and other public information.
  • -The state probes are focused on whether privacy standards for health information should be tightened as data-mining technologies get more sophisticated and U.S. President Barack Obama’s health-care overhaul drives rapid growth in the amount of patient data being generated and shared.
  • -Sweeney’s goal of identifying patients is to show that threats to privacy exist in datasets that are widely distributed and fall outside HIPAA’s regulations.

Hackers Sell Health Insurance Credentials, Bank Accounts, SSNs and Counterfeit Documents, for over $1,000 Per Dossier

The value of personal health information is very high inside and outside of the US healthcare system. At the same time, the US healthcare industry as a whole does a terrible job of protecting health data security. Most health data holders (hospitals and insurers) put health data security protection dead last on the list for tech upgrades.
Besides the lack of effective, comprehensive data security protections, thousands of low-level employees can snoop in millions of people’s health records in every US hospital using electronic records.

The public expects that only their doctors and staff who are part of their treatment team can access their sensitive health records, but that’s wrong. Any staff members of a hospital or employees of a health IT company who are your neighbors, relatives, or stalkers/abusers can easily snoop in your records.
In Austin, TX the two major city hospital chains each allow thousands of doctors and nurses access to millions of patient records.
All this will get much worse when every state requires our health data to be “exchanged” with thousands more strangers. The new state health information exchanges (HIEs) will make data theft, sale,  and exposure exponentially worse.
Tell every law maker you know: all HIEs should be REQUIRED by law to ask you to agree or OPT-IN before your health data can be shared or disclosed.

Today:

  • -many states do not allow you to ‘opt-out’ of HIE data sharing
  • -most states do not allow you to prevent even very sensitive health data (like psychiatric records) from being exchanged

There is no way to trust electronic health systems or HIEs unless our rights to control who can see and use our electronic health data are restored.