<story><title>Telehealth startup Cerebral shared millions of patients’ data with advertisers</title><url>https://techcrunch.com/2023/03/10/cerebral-shared-millions-patient-data-advertisers/</url></story><parent_chain><item><author>blakesterz</author><text>Holy crap. Sometimes I see headlines like this and then the details aren&amp;#x27;t all that bad. This one is all that bad.&lt;p&gt;They gave it all away. They do call it &amp;quot;inadvertent&amp;quot; though.&lt;p&gt;&lt;pre&gt;&lt;code&gt;  &amp;quot;The information disclosed may have included name, phone number, email address, date of birth, IP address, Cerebral client ID number, and other demographic or information. The information disclosed may also have included the service the individual selected, assessment responses, and certain associated health information, subscription plan type, appointment dates and other booking information, treatment, and other clinical information, health insurance&amp;#x2F;pharmacy benefit information (for example, plan name and group&amp;#x2F;member numbers), and insurance co-pay amount.&amp;quot;
&lt;/code&gt;&lt;/pre&gt;
Because Cerebral is a telehealth startup and handles confidential patient data, it’s considered a company covered under the U.S. health privacy law known as HIPAA. According to a list of health-related security lapses under investigation by the U.S. Department of Health and Human Services, which oversees and enforces HIPAA, Cerebral’s data lapse is the second-largest breach of health data in 2023.</text></item></parent_chain><comment><author>falcolas</author><text>&amp;gt; Cerebral’s data lapse is the second-largest breach of health data in 2023.&lt;p&gt;We&amp;#x27;re not even three full months into 2023, and this is the &lt;i&gt;second&lt;/i&gt; biggest? I can&amp;#x27;t even comprehend how anybody thought this was a good idea.&lt;p&gt;Really thinking that basing our economy&amp;#x27;s primary motivator on human greed isn&amp;#x27;t doing us many favors right now, not when it&amp;#x27;s so easy for bad actors to out-earn any and all penalties.</text></comment>
<story><title>Telehealth startup Cerebral shared millions of patients’ data with advertisers</title><url>https://techcrunch.com/2023/03/10/cerebral-shared-millions-patient-data-advertisers/</url></story><parent_chain><item><author>blakesterz</author><text>Holy crap. Sometimes I see headlines like this and then the details aren&amp;#x27;t all that bad. This one is all that bad.&lt;p&gt;They gave it all away. They do call it &amp;quot;inadvertent&amp;quot; though.&lt;p&gt;&lt;pre&gt;&lt;code&gt;  &amp;quot;The information disclosed may have included name, phone number, email address, date of birth, IP address, Cerebral client ID number, and other demographic or information. The information disclosed may also have included the service the individual selected, assessment responses, and certain associated health information, subscription plan type, appointment dates and other booking information, treatment, and other clinical information, health insurance&amp;#x2F;pharmacy benefit information (for example, plan name and group&amp;#x2F;member numbers), and insurance co-pay amount.&amp;quot;
&lt;/code&gt;&lt;/pre&gt;
Because Cerebral is a telehealth startup and handles confidential patient data, it’s considered a company covered under the U.S. health privacy law known as HIPAA. According to a list of health-related security lapses under investigation by the U.S. Department of Health and Human Services, which oversees and enforces HIPAA, Cerebral’s data lapse is the second-largest breach of health data in 2023.</text></item></parent_chain><comment><author>techwizrd</author><text>Handling confidential patient data does not necessarily mean the organization is a covered entity under HIPAA. One of the organizations I work with receives, stores, and uses significant amounts of confidential patient data, but they are not a covered entity under HIPAA (although they are covered separately under the Privacy Act).</text></comment>