I used a state (Colorado) healthcare marketplace website when I was going to take a break between jobs for a couple of months, and I feel very violated by the whole process. I entered a bunch of information to the website, knowing that the data could be expected to be shared for quotes, but I got no quote. The information didn't just flow between systems, it was just sent directly to a bunch of individuals. Instead of getting anything useful from the website, I just got told that agents would contact me, and then literally hundreds of agents were calling and texting me at all hours of the day and night for weeks. I asked one of them how to get it to stop and they said it was impossible during the government shutdown.
The actual "sharing" was using the Meta pixel and TikTok's equivalent, presumably so the healthcare exchanges could do retargeting or similarity-based marketing to get people to sign up for health care coverage. Which, narrowly, seems like a reasonable thing to do. But of course using the pixel automatically "shares" the data with Meta/ByteDance/whoever, and they get to use it for whatever nefarious purpose they want.
The state healthcare exchanges doing any kind of targeting and/or marketing, even to 'get people' to sign up for subsidized healthcare, could also be conceived of as unreasonable. I could be wrong, but I wouldn't think their mandate under the ACA contemplates any targeting or marketing of themselves whatsoever—even if it's ostensibly to increase enrollment.
That it feels like there's an implicit assumption that they would (target or market) seems to be part of the problem.
Every piece of data collected should be an opt-in both for the initial collection and any sharing to a third party. There should be an explanation for why it is collected and an explanation for what features are not possible if it is not collected. It should be a violation of the law to disable a feature based on failure to opt-in for data points that aren't absolutely necessary for the operation of that feature.
The problem is that the government often requires the providers/counter-parties to collect the data, so that a regulator can check for systemic discrimination.
What would happen if you just lied? I guess you wouldn't get healthcare coverage once they found out? But isn't there something in law about material damages, they'd have to prove you cost them money by choosing the wrong race?
If it's an official government form, there's usually verbiage stating that knowingly and willingly falsifying information is considered perjury or some such wording.
I wouldn't be surprised if both are illegal. But these days, the correlation between "X is illegal" and "larger org's do not do X" just ain't what it yousta be.
My understanding is that it's legal with opt-in, but the opt-in is allowed to be confusing, opaque, and sticky, so most people "consent" without informed consideration. We really need to revisit contract law in a modern context. Call me crazy but I don't think it's reasonable that our society operates in such a way that easily 90+% of people are subject to contract terms they signed but don't know or understand.
On top of the GDPR/American concept of "it is all OK if there is consent" which applies to most organization, health related organizations face stronger HIPPA regulations in the US.
Damn near anything in business in the US is allowed with "opt in" where the opt in is literally the scene from Charlie and the Chocolate factory, including the part where you don't get to come after the factory for your death and dismemberment as stated in 1pt font after an entire chapter of reading to dull your attention.
Most long contracts are a reaction to 'failure to warn' lawsuits where plaintiffs (successfully) argued that they should have been notified of something. The problem is that when you add up all those 'somethings', you get absurdly long documents.
I agree that these extensive disclaimers and contracts are not an effective way to communicate information, but dispensing with them will require either a better way to disclaim many (relatively unimportant) risks, or a change to product (and service) liability law, reducing failure-to-warn legal risk.
Well the tech companies/offense contractors are probably using it to enrich the department of wars efforts. Hmm I wonder what they want race and citizenship data for? Ohhh... Oh...
Why would politicians ever pass such a law? Who do you think they work for?
update: Yeah, my bad. The point of this comment was to express my increasing cynicism at how we just keep seeing this kind of corporate behavior over and over again and how even when a tiny win is achieved on things like data collection, right to repair, ease for cancelling subscriptions, privacy, and so on and so on, they are so quickly over taken by new tactics or clawbacks/loopholes/non-enforcement of those laws.
HN comments was probably the wrong place to vent and its too late to delete it.
So it should be as easy as buying tracking data and searching for Congressmen. We can put up license plate readers around Washington too, since that's legal.
Very rarely. Most of the consumer protection laws were passed before Reagan in 1980. We did get the CFPB after the 2008 financial meltdown but it's been under attack ever since.
Doesn’t really seem like the environment where the common persons going to get more rights or protections since the POTUS and SCOTUS are currently ripping those up while Congress sits in the cuck chair.
"Citizens" United (which allows unlimited corporate political donations by classifying them as "speech", for those out of the loop) has fundamentally changed the core incentive structures of the modern political landscape. To compare a pre-CU world to a post-CU world when it comes to matters at the intersection of corporate interests and government regulatory / legislative power is comparing apples to oranges.
We need to overturn CU if we want to be able to go back to a world where government serves people rather than multinational conglomerates.
They work for the people. In some countries, people actually vote for politicians that benefit the population. In other countries, people repeatedly vote for politicians despite knowing that those politicians are only interested in enriching themselves, with a track record going back decades of doing nothing but that. The problem, then, is the voters in certain countries, not the politicians.
Many of those countries have mechanisms by which one can express their preferences earlier in the process, ones which have been successfully used to pivot major political parties in new and unexpected directions, although those mechanisms are more complicated than just showing up at the end and whining about the results, so usually it's only motivated individuals and entities which leverage them.
In some countries a major party has succeeded in convincing a majority of voters to vote against their self interest by leveraging "red meat" topics such as abortion, jesus and guns.
It's possible. Ultimately the voters do make the decision, even if they can be swayed. How realistic it might be, I can't say. We certainly need a lot more engagement with the process. There are far too many people ignoring the primaries and then complaining about their lack of choice in the general.
I don't believe donations or corporate backing had anything to do with Trump, for example, winning. Trump won because he genuinely appeals to the average voting American. American voters are willingly choosing to support these politicians and all of the consequences that entails.
For the president election, maybe, but without corporate backing of the GOP he would have to face an adversarial congress. Or at least, that’s the hope
You overlooked plain cronyism in Russia 1991 and after, for example, and actual rich people who just invested very long ago, and repetitively over time, in companies making money (not timing the stock market), like Charlie Munger and Warren Buffett.
I would claim it's "better" these days than previously. At first, everyone thought they were getting something for free, no strings. Now it seems that even the "uneducated" public understands most of it...they just don't seem to care. The only one that people seem to be unaware of is the fairly precise location tracking that happens.
And also because they don’t realize how effectively that tracking data can be used to manipulate their emotions and behavior with the goal of squeezing out what money they do have.
Translation: The government does little to protect their citizens from predatory business practices because those in power have gained power via predatory business practices and have tricked many people into believing it's their own failings for being made a victim.
Crypto rug-pulls are now done by a sitting president and if you complain you simply have a "victim mentality" because you're not looking for a way to exploit your neighbor.
We should really be embarrassed of our selves yet people come on here every day to defend the scammers.
This is especially bad for public services because trust is already fragile. People should not have to worry that applying for healthcare also enrolls them in a tracking graph.
Is it that incomprehensible that you might want to limit healthcare offerings to lawful residents only, or that the government might track metadata about how services are doing so, regardless of how they choose to take action on it?
For someone not familiar with the US legal system, something is not clear here: if that's Meta/Facebook tracking via pixel, than why it's not possible to sue them for it?
Or if that tracking is considered legal in this particular case - WHY?
It is self reported according to the US census recognized racial categories: white, black, asian, native American/Alaskan, native Hawaiian or Pacific islander, and other (or two+ categories). Hispanic/latino identification is a separate box you check for reasons that are hard to explain without going over decades of bureaucratic decisions.
Are there any guides on how to decide which "race" you are? Because I cannot imagine that everyone knows exactly which part of the earth all of their ancestors originate from.
It is not a perfect or rigid system, but it's the one we have (and any attempt to improve it would get caught up in the weeds of how much 'racial science' can be endorsed by the US government).
Practically speaking, most Americans over the past 300 years knew of specific near ancestors who came from somewhere else (with little interbreeding among immigrant populations) and answered based on that. The obvious exceptions were descendants of slaves and Native Americans, which is why those were the first non-white (where 'white' includes all Europeans as well as large parts of the Middle East and North Africa) categories tracked by the census.
All levels of the US education system teach (now at least) that race is a social construct. There's no concept of population-genetics taught, until much later, in hard science classes.
Yes, this is a common point of confusion when talking to Europeans about racial issues in the US (as I found out myself recently). Race in our contexts refers to your background/birthplace/heritage. On our government forms: "What race are you?" "White, black, hispanic, etc."
This is fundamentally different by intent than in Europe (using french here) where we refer to 'la race humaine' which is the _species_.
The nuance is critical during debates. While I was discussing racial differences to some Swiss folks, they thought I was talking Nazi propaganda! We are all part of the human species, the human species has many races. We are all equal!
I am European, I have had this discussion with Europeans back home from various countries. This is a common point of confusion. Do you have something to add?
well, I mean, listen, if it's part of the census, that's... still government-level racial discrimination. It might not be a duck, but this thing has a certain duck-shaped silhuette.
I'm still surprised by the number of web developers who do not understand that, once you include someone else's Javascript on your site, they have full access to everything on your site, including all submitted customer data.
> Nearly all of the 20 state-run health insurance exchanges in the US have added advertising trackers that transmit user activity
...why?
> State officials say they embed this technology on the exchanges to measure marketing campaigns and to advertise to people who visit their sites
What an absurdist reality we live in
> Tara Lee, a spokesperson for the Washington state exchange, said the tracker on the site was used for advertising campaigns, adding that email, phone and country identifiers were shared with TikTok.
Personally, I feel local government should not be engaging these services in this way. I don't feel that it's a wise use and that our government employees should be more protective of the public who use their services.
The same reason that I put Google Analytics on my blog in 2014. They want to know how many people are using their site and how.
And like me, they didn't think about the fact that these analytics services are run by advertising companies that may use the data for other purposes. Unlike me, they have privacy laws to follow because they work with health data.
From my experience working with health data, HIPAA laws are utilized to generate leverage against whoever the gatekeepers want. There's no expectation of privacy for anyone with HIPAA, it's a failed policy meant to intimidate. They hold up a disguise that it's very hard and strict and enforce these regulations to punish whoever they deem unworthy. Usually, it's big corporations targeting competition with needles lawsuits.
I've seen unfathomable abuses in HIPAA privacy laws. Some of it is was for my own health records. If you only knew how bad it was. I can't detail it all because their lawyers will bully and intimidate me like they already have.
HIPAA was a way to provide surveillance of your health. Corporations, governments, law enforcement, healthcare professionals, or even a petulant child that annoys a parent who's a doctor has access to everyone's health records. The public sentiment on HIPAA laws is just so backwards.
I’m more annoyed that these government healthcare marketplaces are asking people their race in the first place. Really don’t think anything should be, including job applications.
I never (in the US) have understood why those questions include separate questions for race (seems to be like white or black or asian) and for ethnicity, including a really odd question about Latino or non Latino.
Why those questions, but no Danish vs non Danish, and so on?
It's because latinos can be white, black, or native - and historically most people tracking these data wanted to group latinos independently of non-latino whites, blacks, and natives.
That's not actually true. It applies to health care data. If you're a software engineer making a system that includes HIPAA-protected data, you can face individual criminal liabilities for mishandling the data.
No, not really. If you are not a covered healthcare entity, or a business association of a covered healthcare entity, the law simply does not apply to you at all.
Also, I believe (but am not certain) that if there was any criminal case, it would be leadership (C*O) not individual software engineers who would be charged. This is speculation on my part, if anybody has clear facts I'm happy to hear them.
That's not true. It's intended to define a regulated and standard means of transferring medical information while ensuring confidentiality and patient privacy.
You have to explicitly grant permission for your data to be sold. What's very likely is that either the healthcare provider or insurance company included a request for authorization to sell that data, and the authorization was signed without paying much attention to it.
You're referring to the privacy rule, which is only part of the law (and not its primary prupose). The original intent of the law was to ensure easy transfer of information to keep health coverage when changing jobs. The privacy rule was not even part of the original law, it was added by HHS 3 years later. See more details here: https://www.ncbi.nlm.nih.gov/books/NBK9576/
You wouldn't need such a modern privacy rule if it weren't for the need for information portability in the digital age. The distinction between whether or not portability or privacy is primary in the law kind of doesn't matter. The real purpose of HIPAA was to help make the newly emerging market forms of health care sustainable. Protocol standardization and modernization of the Hippocratic Oath were both necessities, technical and ideological respectively.
Honestly, we're better off with it than without it, speaking as someone with exposure to that industry's internals. That act drives a lot of good security practice within the organizations (mostly liability shifting, but still good). Specifically, the fear it instills of ruinous penalties from regulators drives good practice adoption, IME.
Further, multiple crappy patient portals across providers is a crummy experience, but it's an improvement over the world where providers held the data hostage and had zero interest in accommodating your requests for it, or even the idea that you owned it.
"The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a US federal law designed to protect sensitive patient health information from disclosure without consent."
That's not really correct. It was designed for portability- the ability to move data between health care providers.
(I work in healthcare-adjacent and have met with many lawyers and had to explain them all about "HIPAA compliance"; my comment was not made from ignorance, but practical experience based on learning about how the law is used. There is a privacy rule in it, but that was not the real intent of the law. The intent was to make it easy to keep your health care when you moved between jobs.)
Why would you call it an hallucination because you cant find immediately locate the source? You didnt say what in the single sentence would make you jump to that conclusion.
I highlighted SirFatty's text, looked up on google and first result show it near verbatim on cdc.gov.
Here's the original text of the bill's purpose; very little of the bill talks about privacy, and most of the rules around that are part of the HHS Privacy Rule.
To amend the Internal Revenue Code of 1986 to improve portability and continuity
of health insurance coverage in the group and individual markets, to combat
waste, fraud, and abuse in health insurance and health care delivery, to promote
the use of medical savings accounts, to improve access to long-term care services
and coverage, to simplify the administration of health insurance, and for other
purposes.
The US citizens will have to fight down those corporate overlords. It is now really just shameful how they leech off of the common man (and common woman). People in democracies outside of the USA shake their head in sadness now. Even Canada is doing better here - don't tell anyone the crazy orange king, for he may begin to potty-mouth and threaten them with invasion again.
corporate overlords? These are the state governments selling your data. The call is coming from inside the house. The sooner we realize that government is comprised of the same slithering slime of human greed and laziness, the more realistic discussions we can have.
It's not even remotely the same scale. At least the government ostensibly has its incentives aligned with the public. False equivance gets us further from where we need to by focusing people on the wrong problems.
"Ostensibly" is the mistake in your formula. Current events are replete with examples to the contrary. It's not equivocating to recognize that governments are organizations of humans, subject to the same limitations - the larger they get, the harder they are to manage well; talent is incredibly important to success in mission; leadership is incredibly important to integrity, ethics, and strategy; lower oversight and mediocre control structures lead to abuse. You can see the challenges that government as an organization has there. And as to scale..? Son. At least you can "ostensibly" choose whether or not to interact with corporations unless they are colluding with... government.
US isn’t a country, it’s an economic zone run by few corporates, who bribe and push law makers to pass whatever laws they like, everyone is winning except the citizens of that “country”.
anecdata - in Berkeley CA, in the late 2010s, two individuals showed up to be in the fast-paced AD scene. One was from a former Soviet Union country, who spoke English pretty well .. and the other a woman from Columbia .. to say that both of these two were "aggressive" is an understatement. He spoke English, she was in charge of "security" .. after a very few meetups, they both formed a company for "Ad tech for Hospitals" .. it was "heavy security" they said, and therefore did not discuss any details in public. They very obviously would do "aggressive" actions to get into the business, defeat competitors, and satisfy ..clients? Who were they satisfying with the cultural norms, constantly aggressive stance, move fast and break things approach? Every single person involved had the motivation of Big Money, Now.
I used a state (Colorado) healthcare marketplace website when I was going to take a break between jobs for a couple of months, and I feel very violated by the whole process. I entered a bunch of information to the website, knowing that the data could be expected to be shared for quotes, but I got no quote. The information didn't just flow between systems, it was just sent directly to a bunch of individuals. Instead of getting anything useful from the website, I just got told that agents would contact me, and then literally hundreds of agents were calling and texting me at all hours of the day and night for weeks. I asked one of them how to get it to stop and they said it was impossible during the government shutdown.
The actual "sharing" was using the Meta pixel and TikTok's equivalent, presumably so the healthcare exchanges could do retargeting or similarity-based marketing to get people to sign up for health care coverage. Which, narrowly, seems like a reasonable thing to do. But of course using the pixel automatically "shares" the data with Meta/ByteDance/whoever, and they get to use it for whatever nefarious purpose they want.
The state healthcare exchanges doing any kind of targeting and/or marketing, even to 'get people' to sign up for subsidized healthcare, could also be conceived of as unreasonable. I could be wrong, but I wouldn't think their mandate under the ACA contemplates any targeting or marketing of themselves whatsoever—even if it's ostensibly to increase enrollment.
That it feels like there's an implicit assumption that they would (target or market) seems to be part of the problem.
It should be illegal to send the data, and illegal to accept it; burn both sides of that bridge.
Every piece of data collected should be an opt-in both for the initial collection and any sharing to a third party. There should be an explanation for why it is collected and an explanation for what features are not possible if it is not collected. It should be a violation of the law to disable a feature based on failure to opt-in for data points that aren't absolutely necessary for the operation of that feature.
It's a tracking pixel. They fool you into sending it.
A technicality without a meaningful difference. Users didn't consent to sending it, nor were they aware of it.
If someone attach a bomb to you car that detonate when you start the motor; they didn't fool you into killing yourself.
The relevant facts are that the website owner voluntarily put the tracking code on their own website, and the tracking code worked as designed.
> The relevant facts are that the website owner voluntarily put the tracking code...
The civil discussion should now be about the punishment for that.
Regulation is required for handling people's data
Sounds like that will work similar to incarcerating drug users instead of the drug makers and distribution network?
The former can't afford lawyers.
That's like saying that Ted Kaczynski was innocent, because he didn't force anyone to open the packages.
At least make it an explicitly protected right to lie about your race in any context. It's a lot easier to ruin a dataset than it is to hide from it.
I wish it were illegal to ask or record people's race in any commercial context in the US.
The problem is that the government often requires the providers/counter-parties to collect the data, so that a regulator can check for systemic discrimination.
Yes, but does anyone treat it as ruined, or do you get targeted for both/all races?
If someone targets black people, you're on that list; if someone targets white people, you're also on that list!
It's a two way street. The companies doing the targeting lose money if their models are inaccurate.
What would happen if you just lied? I guess you wouldn't get healthcare coverage once they found out? But isn't there something in law about material damages, they'd have to prove you cost them money by choosing the wrong race?
If it's an official government form, there's usually verbiage stating that knowingly and willingly falsifying information is considered perjury or some such wording.
Yeah I was about to lie one time then saw that. Whoever does the PSAT thinks I'm black though.
I wouldn't be surprised if both are illegal. But these days, the correlation between "X is illegal" and "larger org's do not do X" just ain't what it yousta be.
My understanding is that it's legal with opt-in, but the opt-in is allowed to be confusing, opaque, and sticky, so most people "consent" without informed consideration. We really need to revisit contract law in a modern context. Call me crazy but I don't think it's reasonable that our society operates in such a way that easily 90+% of people are subject to contract terms they signed but don't know or understand.
On top of the GDPR/American concept of "it is all OK if there is consent" which applies to most organization, health related organizations face stronger HIPPA regulations in the US.
Damn near anything in business in the US is allowed with "opt in" where the opt in is literally the scene from Charlie and the Chocolate factory, including the part where you don't get to come after the factory for your death and dismemberment as stated in 1pt font after an entire chapter of reading to dull your attention.
easily 90+% of people are subject to tens of thousands of pages of contract terms they signed but don't know or understand. It's madness.
Here in New Zealand those pages and pages of fine print are disappearing as they are no longer enforceable.
The only things in a contract that can be enforced must be stated plainly and clearly
Turns out there are o ly a few conditions that are actually necessary
Most long contracts are a reaction to 'failure to warn' lawsuits where plaintiffs (successfully) argued that they should have been notified of something. The problem is that when you add up all those 'somethings', you get absurdly long documents.
In effect it seems that people are still not being warned. The legal fiction that they are is exactly the insanity that needs to be thrown out.
I agree that these extensive disclaimers and contracts are not an effective way to communicate information, but dispensing with them will require either a better way to disclaim many (relatively unimportant) risks, or a change to product (and service) liability law, reducing failure-to-warn legal risk.
Well the tech companies/offense contractors are probably using it to enrich the department of wars efforts. Hmm I wonder what they want race and citizenship data for? Ohhh... Oh...
Why would politicians ever pass such a law? Who do you think they work for?
update: Yeah, my bad. The point of this comment was to express my increasing cynicism at how we just keep seeing this kind of corporate behavior over and over again and how even when a tiny win is achieved on things like data collection, right to repair, ease for cancelling subscriptions, privacy, and so on and so on, they are so quickly over taken by new tactics or clawbacks/loopholes/non-enforcement of those laws. HN comments was probably the wrong place to vent and its too late to delete it.
What's the point of this kind of comment? Have pro-citizen anti-corporate laws never been passed in the past?
Only when Congress might be embarrassed. The VPPA exists so we can't find out what videos they watch in their spare time between orgies.
So it should be as easy as buying tracking data and searching for Congressmen. We can put up license plate readers around Washington too, since that's legal.
Very rarely. Most of the consumer protection laws were passed before Reagan in 1980. We did get the CFPB after the 2008 financial meltdown but it's been under attack ever since.
The point of the comment is to spread toxic and deadly cynicism.
And also to karma farm. Thankfully the comment is greyed out for what it is.
If you never trust anyone, nobody will ever fool you except for yourself.
You never see corporate media doing anything like that.
Doesn’t really seem like the environment where the common persons going to get more rights or protections since the POTUS and SCOTUS are currently ripping those up while Congress sits in the cuck chair.
"Citizens" United (which allows unlimited corporate political donations by classifying them as "speech", for those out of the loop) has fundamentally changed the core incentive structures of the modern political landscape. To compare a pre-CU world to a post-CU world when it comes to matters at the intersection of corporate interests and government regulatory / legislative power is comparing apples to oranges.
We need to overturn CU if we want to be able to go back to a world where government serves people rather than multinational conglomerates.
> We need to overturn CU
Or we could stop looking at SCOTUS to fix legislation and ask the branch of government who's job it is to fix legislation, Congress.
They work for the people. In some countries, people actually vote for politicians that benefit the population. In other countries, people repeatedly vote for politicians despite knowing that those politicians are only interested in enriching themselves, with a track record going back decades of doing nothing but that. The problem, then, is the voters in certain countries, not the politicians.
And in some countries people are only given a choice of two, neither of which benefit the population.
Many of those countries have mechanisms by which one can express their preferences earlier in the process, ones which have been successfully used to pivot major political parties in new and unexpected directions, although those mechanisms are more complicated than just showing up at the end and whining about the results, so usually it's only motivated individuals and entities which leverage them.
In some countries a major party has succeeded in convincing a majority of voters to vote against their self interest by leveraging "red meat" topics such as abortion, jesus and guns.
Ideally because we'd vote in politicians who would do it, and vote out those who didn't.
Is that even possible in the US anymore with donations and corporate backing being so important to a campaign?
It's possible. Ultimately the voters do make the decision, even if they can be swayed. How realistic it might be, I can't say. We certainly need a lot more engagement with the process. There are far too many people ignoring the primaries and then complaining about their lack of choice in the general.
I don't believe donations or corporate backing had anything to do with Trump, for example, winning. Trump won because he genuinely appeals to the average voting American. American voters are willingly choosing to support these politicians and all of the consequences that entails.
You can believe the latter but the former ignores everything we know about the effectiveness of advertising.
And also about the targeting of swing districts.
For the president election, maybe, but without corporate backing of the GOP he would have to face an adversarial congress. Or at least, that’s the hope
Both can be true.
To discount advertising and manipulation in this context amounts to conspiracy theory in my opinion.
The richest tech companies and richest men in the world got rich by invading people's privacy and selling invasive ads.
> The richest tech companies and richest men in the world got rich by invading people's privacy and ~selling invasive ads.~
I think you mean "manipulating content algorithms to favor their viewpoints and to target individuals for maximum effect."
Looking at the 15 richest people in the world, 11 did not get rich that way.
You overlooked plain cronyism in Russia 1991 and after, for example, and actual rich people who just invested very long ago, and repetitively over time, in companies making money (not timing the stock market), like Charlie Munger and Warren Buffett.
They got rich because people were stupid enough to think free services come without a cost.
People prefer to pay with tracking data instead of money because they have lots of tracking data and not much money.
I would claim it's "better" these days than previously. At first, everyone thought they were getting something for free, no strings. Now it seems that even the "uneducated" public understands most of it...they just don't seem to care. The only one that people seem to be unaware of is the fairly precise location tracking that happens.
And also because they don’t realize how effectively that tracking data can be used to manipulate their emotions and behavior with the goal of squeezing out what money they do have.
If we have learned anything in recent decades, it is that we are all easily manipulated, and we are all pretty darn stupid.
Translation: The government does little to protect their citizens from predatory business practices because those in power have gained power via predatory business practices and have tricked many people into believing it's their own failings for being made a victim.
Crypto rug-pulls are now done by a sitting president and if you complain you simply have a "victim mentality" because you're not looking for a way to exploit your neighbor.
We should really be embarrassed of our selves yet people come on here every day to defend the scammers.
Who is clicking on the ads though?
This is especially bad for public services because trust is already fragile. People should not have to worry that applying for healthcare also enrolls them in a tracking graph.
Is it that incomprehensible that you might want to limit healthcare offerings to lawful residents only, or that the government might track metadata about how services are doing so, regardless of how they choose to take action on it?
For someone not familiar with the US legal system, something is not clear here: if that's Meta/Facebook tracking via pixel, than why it's not possible to sue them for it?
Or if that tracking is considered legal in this particular case - WHY?
Ok?
2 relevant attributes as it turns out.
Can someone from the US explain what race even means in this context and how it is determined?
It is self reported according to the US census recognized racial categories: white, black, asian, native American/Alaskan, native Hawaiian or Pacific islander, and other (or two+ categories). Hispanic/latino identification is a separate box you check for reasons that are hard to explain without going over decades of bureaucratic decisions.
> US census recognized racial categories
Thank you for a googleable term.
Are there any guides on how to decide which "race" you are? Because I cannot imagine that everyone knows exactly which part of the earth all of their ancestors originate from.
It is not a perfect or rigid system, but it's the one we have (and any attempt to improve it would get caught up in the weeds of how much 'racial science' can be endorsed by the US government).
Practically speaking, most Americans over the past 300 years knew of specific near ancestors who came from somewhere else (with little interbreeding among immigrant populations) and answered based on that. The obvious exceptions were descendants of slaves and Native Americans, which is why those were the first non-white (where 'white' includes all Europeans as well as large parts of the Middle East and North Africa) categories tracked by the census.
They can pick "mixed" or the race they identify with the most.
All levels of the US education system teach (now at least) that race is a social construct. There's no concept of population-genetics taught, until much later, in hard science classes.
Yes, this is a common point of confusion when talking to Europeans about racial issues in the US (as I found out myself recently). Race in our contexts refers to your background/birthplace/heritage. On our government forms: "What race are you?" "White, black, hispanic, etc."
This is fundamentally different by intent than in Europe (using french here) where we refer to 'la race humaine' which is the _species_.
The nuance is critical during debates. While I was discussing racial differences to some Swiss folks, they thought I was talking Nazi propaganda! We are all part of the human species, the human species has many races. We are all equal!
> background/birthplace/heritage
Are those slashes AND or OR?
Most Europeans are NOT confused by this. Sheesh.
I am European, I have had this discussion with Europeans back home from various countries. This is a common point of confusion. Do you have something to add?
> they thought I was talking Nazi propaganda!
well, I mean, listen, if it's part of the census, that's... still government-level racial discrimination. It might not be a duck, but this thing has a certain duck-shaped silhuette.
There are various risk factors, and some lab tests, that differ among racial groups.
For example, my labs include at least two that have different specified thresholds for "African-American" or "non-AA" patients.
https://en.wikipedia.org/wiki/Sickle_cell_disease#United_Sta...
i believe it is self-declared.
Bloomberg Study: https://www.bloomberg.com/features/2026-healthcare-advertisi...
I'm still surprised by the number of web developers who do not understand that, once you include someone else's Javascript on your site, they have full access to everything on your site, including all submitted customer data.
This is nothing new. They do the same with drivers license data.
> whether they provided details about whether they have incarcerated family members
Okay. That's not much of a signal, is it? This is "metadata" level of detail.
> Nearly all of the 20 state-run health insurance exchanges in the US have added advertising trackers that transmit user activity
...why?
> State officials say they embed this technology on the exchanges to measure marketing campaigns and to advertise to people who visit their sites
What an absurdist reality we live in
> Tara Lee, a spokesperson for the Washington state exchange, said the tracker on the site was used for advertising campaigns, adding that email, phone and country identifiers were shared with TikTok.
https://www.bloomberg.com/features/2026-healthcare-advertisi...
Personally, I feel local government should not be engaging these services in this way. I don't feel that it's a wise use and that our government employees should be more protective of the public who use their services.
>...why?
The same reason that I put Google Analytics on my blog in 2014. They want to know how many people are using their site and how.
And like me, they didn't think about the fact that these analytics services are run by advertising companies that may use the data for other purposes. Unlike me, they have privacy laws to follow because they work with health data.
> They want to know how many people are using their site and how.
Yeah, why?
Cookie Banner isn't such a bad idea now
Nah, it’s still stupid and pointless
From my experience working with health data, HIPAA laws are utilized to generate leverage against whoever the gatekeepers want. There's no expectation of privacy for anyone with HIPAA, it's a failed policy meant to intimidate. They hold up a disguise that it's very hard and strict and enforce these regulations to punish whoever they deem unworthy. Usually, it's big corporations targeting competition with needles lawsuits.
I've seen unfathomable abuses in HIPAA privacy laws. Some of it is was for my own health records. If you only knew how bad it was. I can't detail it all because their lawyers will bully and intimidate me like they already have.
HIPAA was a way to provide surveillance of your health. Corporations, governments, law enforcement, healthcare professionals, or even a petulant child that annoys a parent who's a doctor has access to everyone's health records. The public sentiment on HIPAA laws is just so backwards.
"race data"... this isn't a thing, this should not be a thing. am i the only one being shocked?
I’m more annoyed that these government healthcare marketplaces are asking people their race in the first place. Really don’t think anything should be, including job applications.
I never (in the US) have understood why those questions include separate questions for race (seems to be like white or black or asian) and for ethnicity, including a really odd question about Latino or non Latino.
Why those questions, but no Danish vs non Danish, and so on?
It's because latinos can be white, black, or native - and historically most people tracking these data wanted to group latinos independently of non-latino whites, blacks, and natives.
do they ask about pre existing conditions? then prbly race also makes sense.
> do they ask about pre existing conditions? then prbly race also makes sense
Why?
How is this not a HIPAA violation?
HIPAA applies to healthcare professionals and providers, not ad tech companies. And race and citizenship are not personal health-related data.
That's not actually true. It applies to health care data. If you're a software engineer making a system that includes HIPAA-protected data, you can face individual criminal liabilities for mishandling the data.
No, not really. If you are not a covered healthcare entity, or a business association of a covered healthcare entity, the law simply does not apply to you at all.
Also, I believe (but am not certain) that if there was any criminal case, it would be leadership (C*O) not individual software engineers who would be charged. This is speculation on my part, if anybody has clear facts I'm happy to hear them.
It might be a HIPAA violation, depending on the details of the data being shared. Several other healthcare websites have gotten in trouble over the same thing: https://techcrunch.com/2023/04/17/pixel-tracking-hipaa-start...
It is if it connects an individual to an explicit health outcome or category.
HIPAA as a law is intended to ease transfer of medical information, not restrict it.
That's not true. It's intended to define a regulated and standard means of transferring medical information while ensuring confidentiality and patient privacy.
https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg...
You have to explicitly grant permission for your data to be sold. What's very likely is that either the healthcare provider or insurance company included a request for authorization to sell that data, and the authorization was signed without paying much attention to it.
You're referring to the privacy rule, which is only part of the law (and not its primary prupose). The original intent of the law was to ensure easy transfer of information to keep health coverage when changing jobs. The privacy rule was not even part of the original law, it was added by HHS 3 years later. See more details here: https://www.ncbi.nlm.nih.gov/books/NBK9576/
The article you cited states congress was aware of privacy concerns at the time and covered them as part of the third stated provision.
You wouldn't need such a modern privacy rule if it weren't for the need for information portability in the digital age. The distinction between whether or not portability or privacy is primary in the law kind of doesn't matter. The real purpose of HIPAA was to help make the newly emerging market forms of health care sustainable. Protocol standardization and modernization of the Hippocratic Oath were both necessities, technical and ideological respectively.
Narrator: "But it did neither."
Honestly, we're better off with it than without it, speaking as someone with exposure to that industry's internals. That act drives a lot of good security practice within the organizations (mostly liability shifting, but still good). Specifically, the fear it instills of ruinous penalties from regulators drives good practice adoption, IME.
Further, multiple crappy patient portals across providers is a crummy experience, but it's an improvement over the world where providers held the data hostage and had zero interest in accommodating your requests for it, or even the idea that you owned it.
The second “P” in HIPAA stands for “Privacy”
I wonder if that's why so many people write it as HIPPA.
That's because it's very similar to the name of an animal which is not called a hipoo.
"The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a US federal law designed to protect sensitive patient health information from disclosure without consent."
That's not really correct. It was designed for portability- the ability to move data between health care providers.
(I work in healthcare-adjacent and have met with many lawyers and had to explain them all about "HIPAA compliance"; my comment was not made from ignorance, but practical experience based on learning about how the law is used. There is a privacy rule in it, but that was not the real intent of the law. The intent was to make it easy to keep your health care when you moved between jobs.)
Could you please cite the source for that quote? I looked for it, but couldn't find a source; it seems like an AI hallucination.
Why would you call it an hallucination because you cant find immediately locate the source? You didnt say what in the single sentence would make you jump to that conclusion.
I highlighted SirFatty's text, looked up on google and first result show it near verbatim on cdc.gov.
https://www.cdc.gov/phlp/php/resources/health-insurance-port...
Here's the original text of the bill's purpose; very little of the bill talks about privacy, and most of the rules around that are part of the HHS Privacy Rule.
To amend the Internal Revenue Code of 1986 to improve portability and continuity of health insurance coverage in the group and individual markets, to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, to simplify the administration of health insurance, and for other purposes.
Oh, I bet they fucking did.
That's it, that's the comment.
The US citizens will have to fight down those corporate overlords. It is now really just shameful how they leech off of the common man (and common woman). People in democracies outside of the USA shake their head in sadness now. Even Canada is doing better here - don't tell anyone the crazy orange king, for he may begin to potty-mouth and threaten them with invasion again.
corporate overlords? These are the state governments selling your data. The call is coming from inside the house. The sooner we realize that government is comprised of the same slithering slime of human greed and laziness, the more realistic discussions we can have.
It's not even remotely the same scale. At least the government ostensibly has its incentives aligned with the public. False equivance gets us further from where we need to by focusing people on the wrong problems.
"Ostensibly" is the mistake in your formula. Current events are replete with examples to the contrary. It's not equivocating to recognize that governments are organizations of humans, subject to the same limitations - the larger they get, the harder they are to manage well; talent is incredibly important to success in mission; leadership is incredibly important to integrity, ethics, and strategy; lower oversight and mediocre control structures lead to abuse. You can see the challenges that government as an organization has there. And as to scale..? Son. At least you can "ostensibly" choose whether or not to interact with corporations unless they are colluding with... government.
US isn’t a country, it’s an economic zone run by few corporates, who bribe and push law makers to pass whatever laws they like, everyone is winning except the citizens of that “country”.
anecdata - in Berkeley CA, in the late 2010s, two individuals showed up to be in the fast-paced AD scene. One was from a former Soviet Union country, who spoke English pretty well .. and the other a woman from Columbia .. to say that both of these two were "aggressive" is an understatement. He spoke English, she was in charge of "security" .. after a very few meetups, they both formed a company for "Ad tech for Hospitals" .. it was "heavy security" they said, and therefore did not discuss any details in public. They very obviously would do "aggressive" actions to get into the business, defeat competitors, and satisfy ..clients? Who were they satisfying with the cultural norms, constantly aggressive stance, move fast and break things approach? Every single person involved had the motivation of Big Money, Now.
Relevance?