Speaker 1: Every day you're generating data about your health. You might
Speaker 1: not even be aware of it. Maybe your phone counts
Speaker 1: how many steps you take. Maybe your watch measures your
Speaker 1: pulse or your heart rhythm, or you use an app
Speaker 1: to track your exercise or diet, and that doesn't even
Speaker 1: count your medical data, the records that doctors and insurance
Speaker 1: companies and pharmacies keep about all of us. All that
Speaker 1: data goes somewhere, and it's valuable to someone. Welcome to Prognosis,
Speaker 1: Bloomberg's podcast about the intersection of health and technology and
Speaker 1: the unexpected places it's taking us. I'm your host Michelle
Speaker 1: fay Cortes. The amount of health data is increasing fast,
Speaker 1: from medical records, to health apps and devices, to our
Speaker 1: shopping habits and online browsing. Every day we leave digital
Speaker 1: footprints revealing intimate aspects of our lives. That comes with
Speaker 1: benefits and risks. But no one has sorted it all
Speaker 1: out yet and lost protect people haven't caught up with
Speaker 1: the advances in technology. Having all that data promises to
Speaker 1: help researchers come up with new treatments, and it can
Speaker 1: improve doctor's care. But the risk is that personal information
Speaker 1: you'd rather keep to yourself could be exposed. Here's Bloomberg's
Speaker 1: health reporter John Tazzi. Good afternoon, Thank you for calling
Speaker 1: Anthem Member services. My name is Kathy. How can I help? Hi, Kathy,
Speaker 1: my name is John Tazzi. I'm a reporter with Bloomberg
Speaker 1: News and I'm recording this for a story about medical
Speaker 1: data and privacy. Um. I'm an ANTHEM member and I'd
Speaker 1: like to request a list of who Anthem has shared
Speaker 1: my personal information with. So you're a reporter with Bloomberg correct, Okay,
Speaker 1: and you are inquired. I recently learned that I have
Speaker 1: the right to ask my health insurance company what they're
Speaker 1: doing with my data. It's one of the rights given
Speaker 1: to me under a law called HIPPA. HIPPA stands for
Speaker 1: the Health Insurance Portability and Accountability Act. It was passed
Speaker 1: and it's the main law in the United States that
Speaker 1: governs what medical providers and insurance companies can do with
Speaker 1: our healthcare data. HIPPA determines how medical data can be
Speaker 1: shared and what happens if it's shared improperly. It also
Speaker 1: gives people rights over their data, like the right to
Speaker 1: get a copy of your medical record or to find
Speaker 1: out how your data has been shared with other parties,
Speaker 1: but HIPPA doesn't cover everything. There is the idea, and
Speaker 1: it is extremely widespread that health information is inherently going
Speaker 1: to be protected by some law somewhere, but it's not true,
Speaker 1: not at all. This is Pam Dixon. I am the
Speaker 1: executive director of the World Privacy Forum, we're a public
Speaker 1: interest research group, and has been a privacy advocate for
Speaker 1: twenty years. She told me that people often assume there's
Speaker 1: some kind of automatic protection for health data. That's not
Speaker 1: the case. People universally believe that their health data, no
Speaker 1: matter where it is, has some form of legal protection
Speaker 1: and is somehow magically confidential. HIPPA applies to the records
Speaker 1: that your doctor, other medical providers, and your insurance plan hold,
Speaker 1: But more and more data about our health isn't just
Speaker 1: in medical records. HIPPO covered data is a smaller and
Speaker 1: smaller percentage of all of the health data that's out
Speaker 1: there now, And it is so so important for folks
Speaker 1: to understand this because much of the health data that's
Speaker 1: that we're working with today is not covered under HIPPO protections.
Speaker 1: Here's one famous example. Journalist Charles J. Hig reported that
Speaker 1: target used detailed profiles of customers to predict when women
Speaker 1: became pregnant, and then the company sent them promotions for
Speaker 1: baby cones or diapers. The result was creepy in the
Speaker 1: best case, and in the worst case, could have revealed
Speaker 1: information they may not have wanted public. Increasingly, health data
Speaker 1: is being collected by technology companies, data brokers, advertisers, and
Speaker 1: other entities that are not subject to hip hop, and
Speaker 1: it's being used and may be misused in ways that
Speaker 1: a lot of people don't understand. Think about the apps
Speaker 1: on your phone. Maybe you have something to track your
Speaker 1: steps or to log what foods you eat or when
Speaker 1: you exercise. Unless those apps come from your medical provider
Speaker 1: or health plan, they're not covered by HIPPA, and that
Speaker 1: means that the company is collecting your data are far
Speaker 1: less restricted in how they use it, and how they
Speaker 1: use it may not always be transparent. A study published
Speaker 1: in the journal Drama Network Open in April looked at
Speaker 1: thirty six top apps to help people with depression and
Speaker 1: quitting smoking. Of them, we're sending data to Google or
Speaker 1: Facebook for marketing, advertising, or analytics, But less than half
Speaker 1: of those apps disclosed that. The authors wrote most apps
Speaker 1: offered users no way to anticipate that data will be
Speaker 1: shared in this way. As a result, users are denied
Speaker 1: an informed choice about whether such sharing is acceptable to them.
Speaker 1: This is the kind of risk that has some people
Speaker 1: really worried. Even though some privacy advocates think hipp as
Speaker 1: protections should be stronger, they're a good start. It's the
Speaker 1: world of data beyond hip as reach that we need
Speaker 1: to pay a lot more attention to. Because of the
Speaker 1: lack of UH sort of a uniform standard across the
Speaker 1: country with regard to data that it isn't protected by
Speaker 1: hippa UM, there are concerns about the privacy, particularly of
Speaker 1: health data. This is Aleana Peters. I'm currently a shareholder
Speaker 1: at Pulsonelli, which is a national law firm. Aliana worked
Speaker 1: for the federal government for about twelve years. She wrote
Speaker 1: and enforced hippa regulations before she went to work for
Speaker 1: a private law firm in twenty bike PAM. She's concerned
Speaker 1: about the growing volume of health data that hippo doesn't cover.
Speaker 1: The information that your employer holds about you related to
Speaker 1: your health would not be protected by hippa UM. The
Speaker 1: information that you share with social media about your health
Speaker 1: or the groups that you participate in on social media
Speaker 1: about health issues is not protected. There are applications that
Speaker 1: are direct to consumer. That means they are marketed directly
Speaker 1: to consumers and have everything to do with you know,
Speaker 1: weight loss, to disease management, UM to disease prevention, because
Speaker 1: they're marketed directly to a consumer and don't ever interact
Speaker 1: with a healthcare provider on their behalf or with a
Speaker 1: health plan that would not be covered by hippa UM.
Speaker 1: So there's a there's a huge amount of healthcare data
Speaker 1: UM out there that isn't actually covered by a standard
Speaker 1: set of legal requirements. Here are some of the ways
Speaker 1: you might be revealing data without knowing it. You use
Speaker 1: a credit card to buy a pregnancy test at a
Speaker 1: retail drug store. You order new pants online, revealing your
Speaker 1: waist size. You search Google for symptoms of anxiety. You
Speaker 1: subscribe to a magazine about diabetes. You use an app
Speaker 1: to track your morning runs. You take a direct to
Speaker 1: consumer DNA test, You take an uber to your therapist's
Speaker 1: office at the same time each week. Just because information
Speaker 1: about your health could be gleaned from these activities doesn't
Speaker 1: mean it will be the problem is. We often don't
Speaker 1: have a very good idea of where this data ends
Speaker 1: up after it's collected. Some of it could end up
Speaker 1: in the hands of data brokers. Data brokers are a
Speaker 1: multibillion dollar industry made up of thousands of companies that
Speaker 1: you've probably never heard of. They compile information about people
Speaker 1: and sell it to marketers. They collect information from public
Speaker 1: records and even that data that you might not realize
Speaker 1: you're making, like your retail purchases, what groups you belong to,
Speaker 1: online magazines and services you subscribe to, and information you
Speaker 1: fill out in surveys or online registrations. They take all
Speaker 1: of this information and make lists of people for marketers
Speaker 1: to target. In testimony before the Senate Commerce Committee, in
Speaker 1: Pam the Privacy Advocate described how the data broker industry
Speaker 1: tracks people by the diseases they have and the medicines
Speaker 1: they take. There are lists of millions of people that
Speaker 1: are categorized by the diseases that they have, ranging from
Speaker 1: cancer to bed wedding, Alzheimer's terrible diseases, some of them benign,
Speaker 1: some of them relating to mental illness. There are lists
Speaker 1: of millions of people and what prescription drugs that they take,
Speaker 1: and these lists exist entirely outside of hip hop, outside
Speaker 1: of what hip hop o the any kind of federal
Speaker 1: health protection. Pam told Congress about some lists that the
Speaker 1: darker sides of this business model. They included lists of
Speaker 1: rape victims and people with genetic diseases. She found lists
Speaker 1: for sale of people who had HIV and aids, of
Speaker 1: people with dementia, and of people with alcohol or drug addiction.
Speaker 1: There were lists of domestic violence victims and police officers
Speaker 1: home addresses. The list of rape victims cost less than
Speaker 1: eight cents per name. Pam said that some of these
Speaker 1: lists were taken down within an hour or two of
Speaker 1: her testimony, but most of them have reappeared at some point,
Speaker 1: and six years after her testimony, she says not much
Speaker 1: has changed. The data. Broker dossiers are often described as
Speaker 1: marketing lists, but Pam said that doesn't necessarily mean the
Speaker 1: buyers or marketers, and it also doesn't mean that the
Speaker 1: lists are used as they're intended. For example, employers or
Speaker 1: insurance companies could also be buying and using this data.
Speaker 1: There's no law against this, So all of this points
Speaker 1: to a knee for more protection. The laws we have
Speaker 1: just don't reach far enough. But despite its limits, HIPPA
Speaker 1: does provide a good framework for where to start. Here's
Speaker 1: the good news. When data is covered by HIPPA, the
Speaker 1: law gives people important protections. Healthcare providers and insurance plans
Speaker 1: are barred from disclosing individually identifiable data under HIPPOP and
Speaker 1: it goes further. As you might remember, the law also
Speaker 1: grounds people rights over their data. It gives people seven
Speaker 1: different rights, and the rights are really important because before
Speaker 1: HIPPA there were huge problems. Pam says, it was really
Speaker 1: difficult to get a copy of your own medical records
Speaker 1: before HIPPA. Before HIPPA, good luck getting a consistent copy
Speaker 1: of your health file. It wasn't a legal requirement anywhere,
Speaker 1: so you you can predict what was happening prior to HIPPO.
Speaker 1: It was a disaster trying to get your health information.
Speaker 1: It also gives you the right to know if someone
Speaker 1: has subpoenaed your medical records, which might happen in a
Speaker 1: nasty divorce case, for example. And it gives you the
Speaker 1: right to request an accounting of disclosures that's the list
Speaker 1: of who your doctor or health plan has shared your
Speaker 1: medical records with. The list that I'm trying to get
Speaker 1: from Anthem. HIPPA also sets the rules for what those
Speaker 1: entities can do with your data. They can't just make
Speaker 1: it public. They can't tell a reporter or your employer
Speaker 1: or a family member about your diagnosis, your treatment, or
Speaker 1: any other private information without your permission. HIPPA does allow
Speaker 1: medical providers and health plans to release data if it's
Speaker 1: de identified. That means removing information like your name, address,
Speaker 1: precise zip code, and other details. This d identified data
Speaker 1: can be used for research. It can also be sold.
Speaker 1: For example, when drug companies want to know which doctors
Speaker 1: are writing the most prescriptions for their medications, they pay
Speaker 1: data brokers who collect that information. Then pharmaceutical companies can
Speaker 1: send their salespeople to doctors who are the highest volume prescribers.
Speaker 1: The data they're buying doesn't have your name on it,
Speaker 1: but it does represent you aggregated with other people, and
Speaker 1: once it's de identified, it's no longer bound by hippa's protections.
Speaker 1: Some privacy advocates I talked to described this as a
Speaker 1: violation of privacy. The fact that you can't control de
Speaker 1: identified versions of your data is really troubling to some people.
Speaker 1: It's especially concerning because of the risk that some de
Speaker 1: identified data could be re identified that it could be
Speaker 1: matched back to you as an individual. Most experts I
Speaker 1: talked to said that this risk is real, but small. Still,
Speaker 1: the odds of being reidentified have increased since HIPPA was
Speaker 1: first passed in the Here's PAM. The world has changed.
Speaker 1: So back then, I mean, the statistic chance of reidentifying
Speaker 1: records was enormously low. Now the chance of reidentifying records
Speaker 1: is a little bit easier because computing power has advanced
Speaker 1: so much and there's so many more data sets that
Speaker 1: allow for more identifiability. But there are also benefits to
Speaker 1: making de identified data available. Medical researchers rely on it
Speaker 1: to learn about how to improve care, public health officials
Speaker 1: use it to track epidemics and trends in population health,
Speaker 1: and as a journalist, I often cite research or findings
Speaker 1: based on this kind of data, from how common certain
Speaker 1: medical procedures are to how often a new drug is prescribed.
Speaker 1: I work in privacy and I definitely have an opinion
Speaker 1: on privacy. I'm I'm for privacy and something that was
Speaker 1: very hard for me to learn and it took years.
Speaker 1: UM was the value of releasing data. Pam said she's
Speaker 1: come to realize that trade offs between keeping data totally
Speaker 1: private and using some d identified pieces of it. If
Speaker 1: you want to cure diseases, you're going to have to
Speaker 1: study the disease, and you can't do that without information
Speaker 1: about the disease. Information about that disease resides in people's
Speaker 1: experience with that disease as patients. We might also benefit
Speaker 1: directly from having more of our healthcare data digitized to
Speaker 1: learn about these benefits. I paid a visit to the
Speaker 1: Commonwealth Fund. Welcome, Thank you. I was there to see
Speaker 1: a man named David Blumenthal. I'm president of the Commal Fund,
Speaker 1: which is a national health careful anthropy based in New
Speaker 1: York City, and our goal is create hard for regal
Speaker 1: system in the United States. David's office is in a
Speaker 1: landmarked hundred and eleven year old mansion on Manhattan's Upper
Speaker 1: east Side, overlooking Central Park. It used to belong to
Speaker 1: the Harkness family, which endowed the Commonwealth Fund ascend the
Speaker 1: three ago with money they made as investors in John D.
Speaker 1: Rockefeller's Standard Oil Company. David Blumenthal is a big name
Speaker 1: in healthcare. He worked as a primary care doctor at
Speaker 1: Massachusetts General Hospital. He advised Senator Ted Kennedy on healthcare
Speaker 1: and later worked for President Barack Obama as the country's
Speaker 1: top health I T official. He helped implement a lot
Speaker 1: called the High Tech Act, which updated some HIPPA rules.
Speaker 1: It also gave medical providers billions of dollars in federal
Speaker 1: subsidies to digitize paper records. The High Tech Act was
Speaker 1: intended to modernize America's paper based healthcare system. As recently
Speaker 1: as ten years ago, a majority of doctor's offices in
Speaker 1: the United States still used paper records. David's a big
Speaker 1: believer in how the accumulation of digital healthcare data can
Speaker 1: help people. As it grows, it begins to represent the
Speaker 1: healthcare experience of millions, are even billions of people, and
Speaker 1: that is incredibly valuable. He says. Apps that draw on
Speaker 1: patients data could help them take better care of themselves.
Speaker 1: They could prompt people to get flu shots or alert
Speaker 1: diabetics when their bud sugar gets out of whack. David
Speaker 1: says he sees the benefits of greater access to medical
Speaker 1: data as a physician and as a patient. Though he
Speaker 1: works in New York, he lives in Boston, and he
Speaker 1: still sees doctors at Mass General where he used to work,
Speaker 1: and it's affiliated hospitals in the Partners health care system.
Speaker 1: He finds it comforting that he can walk into any
Speaker 1: of the dozens of clinics or hospitals in the system
Speaker 1: and they'll still have his records. I have seen and
Speaker 1: use that that connectiveness with my own care, and it's
Speaker 1: enormously reassure um that you don't have to be you know,
Speaker 1: your medicines will be known, your results of all your
Speaker 1: tests will be known, and all that saving That could
Speaker 1: solve some big problems in the US health care system.
Speaker 1: There's a lot of evidence that patients are harmed all
Speaker 1: the time because their care is fragmented and not coordinated.
Speaker 1: A specialist who doesn't know all the medications you're on
Speaker 1: might prescribe a new drug that has a bad interaction
Speaker 1: with one you're already taking. One study of more than
Speaker 1: half a million patients with chronic illnesses like diabetes or
Speaker 1: heart disease found that people who had more fragmented care
Speaker 1: had higher costs, lower quality care, and more preventable hospital visits.
Speaker 1: This is a real problem that a lot of people
Speaker 1: in healthcare would like to solve. Policymakers are trying to
Speaker 1: make the whole country's health care system work better together.
Speaker 1: They're trying to encourage different electronic medical record systems to
Speaker 1: talk to each other. They're also making it easier for
Speaker 1: patients on government health insurance like medicare to get access
Speaker 1: to their health data. The goal is a health care
Speaker 1: system that seamlessly relays important information that could save your life.
Speaker 1: David gave me a classic example. You live in Austin,
Speaker 1: but you get into a car accident in Chicago. Once
Speaker 1: you get to the emergency room, maybe you're dazed or unconscious,
Speaker 1: or you forget to tell the physician about analergy. But
Speaker 1: if digital records were more widely accessible, that might not
Speaker 1: be an issue. The merger room physician finds your Apple
Speaker 1: phone and everything is on the Apple phone, or it
Speaker 1: can access your record in a cloud because there's an
Speaker 1: agreement to share those informations, and so that increases the
Speaker 1: reliability of your ka, reduces the chance of an error,
Speaker 1: reduces the chance of a of a bad outcome. That's
Speaker 1: the benefit. The risk is most promised, and the sicker
Speaker 1: people are the less concerned they are about price. But
Speaker 1: there are also downsides. Just as with app collected data,
Speaker 1: more traditional medical data sharing has its drawbacks. The risk
Speaker 1: is that nothing is ever truly private. As soon as
Speaker 1: your information is available electron reform, either in a server
Speaker 1: or in the cloud, it is potentially David has experienced
Speaker 1: this firsthand as a federal employee. His data was breached
Speaker 1: in a hack of the government's employee database. I've given
Speaker 1: up on the idea of privacy. It's just not feasible anymore.
Speaker 1: It hasn't that I know, have happened to my health,
Speaker 1: but it could um and I expected mine. Once data
Speaker 1: is digitized and stored, there's a risk it might end
Speaker 1: up somewhere you don't want it to. HIPPA requires medical
Speaker 1: providers and health plans to tell you when your data
Speaker 1: has been breached, and under the High Tech Act, if
Speaker 1: a breach affects more than five people, the companies have
Speaker 1: to report it to the federal government, which publishes a list.
Speaker 1: Since two tho nine, when the reporting requirement into effect,
Speaker 1: HIPPO covered entities have reported more than two thousand, five
Speaker 1: hundred breaches that affected almost two hundred million individuals health records.
Speaker 1: Health data breaches happen so frequently now that they rarely
Speaker 1: make the news their routine. On average, there's a breach
Speaker 1: of HIPPO protected health data every thirty one hours, and
Speaker 1: that's only the data breaches that companies have detected and
Speaker 1: that we know about. We know about them because the
Speaker 1: law requires entities covered by HIPPA to tell us, but
Speaker 1: under federal law, entities not covered by HIPPA generally don't
Speaker 1: have to tell us when a data breach happens. The
Speaker 1: state laws may require them to report breaches. They also
Speaker 1: aren't bound by any of the other requirements of HIPPA.
Speaker 1: They're mostly bound by the promises they make to you
Speaker 1: in their terms of service, those long passages of legal
Speaker 1: ease that you click through after you download an app
Speaker 1: or sign up for a new service, and that's where
Speaker 1: a lot of the privacy concerns about health data are growing.
Speaker 1: There's not only the risk that your data might get
Speaker 1: breached in an illegal hacking operation or stolen by a
Speaker 1: crooked employee. There's also the risk that it might get
Speaker 1: shared or sold in a way that's not necessarily illegal
Speaker 1: but isn't completely transparent. Either. Facebook and Amazon can do
Speaker 1: anything they want with your data or any other any
Speaker 1: company that's not a covered can do anything they want
Speaker 1: unless they have assured you in that fine print that
Speaker 1: they won't. But since none of us need that fine print,
Speaker 1: will never get around suing. So under HIPPA, we have
Speaker 1: certain rights, the right to get a copy of our data,
Speaker 1: the right to know how it's being shared and when
Speaker 1: it is shared improperly, and it requires healthcare providers to
Speaker 1: keep our identifying data close to not disclose it without
Speaker 1: our permission. We don't have those rights over the data
Speaker 1: we give to some app we download, or a new
Speaker 1: fitness device or a social media service. We don't have
Speaker 1: those rights over what with our credit card purchasing data
Speaker 1: or our online searches. Partly because we don't have those rights,
Speaker 1: sometimes our names and contact details wind up for sale
Speaker 1: on data brokers lists labeling us as diabetics or dementia
Speaker 1: sufferers or victims of domestic violence. Right now, the law
Speaker 1: doesn't do a very good job of making companies be
Speaker 1: really clear about what they're doing with our data and
Speaker 1: making sure customers are okay with it. So what should
Speaker 1: we do? I think it's a really good question, and
Speaker 1: it's a tough question. Here's Ileana Peters the attorney and
Speaker 1: former HIPPO official. Trying to decide what's best for all
Speaker 1: industries with regard to the privacy and security of data
Speaker 1: is extremely difficult. I think, certainly there are some things
Speaker 1: we can all agree on, and maybe that's where we
Speaker 1: need to start. Certainly, I think individual rights is one
Speaker 1: of those things, you know. I think everybody should have
Speaker 1: rights to their own data and should be able to
Speaker 1: be at least participatory and how they're data maybe um
Speaker 1: used or disclosed, why it should be deleted, how that
Speaker 1: should happen? Um, you know, when they can get copies
Speaker 1: of it, how that should happen. One possible model for
Speaker 1: people looking to improve privacy policy in the United States
Speaker 1: is a new law that recently took effect in the
Speaker 1: European Union. It's called the General Data Protection Regulation, and
Speaker 1: its strengthens privacy protections for consumers. It covers all sorts
Speaker 1: of personal data, not just healthcare. The law mix companies
Speaker 1: get more explicit consent from people about the data they
Speaker 1: want to collect. It also gives people a right to
Speaker 1: get a copy of their data, and it's supposed to
Speaker 1: give them more control over what happens to it. The
Speaker 1: United States doesn't have anything like it yet, and there's
Speaker 1: no clear path to passing a new umbrella privacy law
Speaker 1: in the US anytime soon. That means that even companies
Speaker 1: trying to do the right thing don't have good standards
Speaker 1: to follow. Pam Dixon, the privacy advocate, said, we've start
Speaker 1: by creating a set of standards that companies adhere to
Speaker 1: voluntarily that would give consumers more trust and how their
Speaker 1: data is being used. So ideally, what I'd like to
Speaker 1: see at a minimum, is some kind of structure that
Speaker 1: allows for um privacy standards to be built. Is there
Speaker 1: a privacy standard we could write for health data outside
Speaker 1: of HIPPA. I think there is, and I think we
Speaker 1: could find a lot of agreement amongst the stakeholders. As
Speaker 1: I said, I think there's a lot of people who
Speaker 1: want to do the right thing. It's just there's not
Speaker 1: a standard yet. In the meantime, what can we do
Speaker 1: as individuals to have more control over our data? First,
Speaker 1: you can exercise the rights you already have under HIPPA.
Speaker 1: Pam recommends everyone get a copy of their medical records
Speaker 1: from their providers. If someone tries to steal your identity
Speaker 1: later on, it will be important to have your original files.
Speaker 1: If you have kids, get copies for your kids too.
Speaker 1: You can also pay attention to what you're agreeing to
Speaker 1: when you start using a new app or service. Here's Alana.
Speaker 1: I read everything before I click I accept, but I
Speaker 1: realized that I may not be the typical user. PAM
Speaker 1: also recommends simply asking companies what data they're collecting and
Speaker 1: what they're doing with it. You know, sending an email
Speaker 1: to um an app developer and asking what happens is
Speaker 1: always a great idea. I do that all the time.
Speaker 1: If they don't email me back, I delete the app.
Speaker 1: I'm a reporter, so maybe I'm biased about this, but
Speaker 1: I think asking questions is a good way to show
Speaker 1: the people were trusting with our data, that we're paying attention,
Speaker 1: that we care about what happens to it, and that
Speaker 1: we want some control. I spent about twenty minutes on
Speaker 1: the phone with my insurance company. Most of the time
Speaker 1: I was on hold, Hello, Yes, thank you so much
Speaker 1: for patiently waiting. I can clearly apoll eventually. I just
Speaker 1: wanted to make sure that she was really friendly, and
Speaker 1: eventually she gave me the address of the privacy office
Speaker 1: where I could send an email to request an accounting
Speaker 1: of disclosures, one of my rights under HIPPA. I wrote
Speaker 1: to them in April. At the end of May, they
Speaker 1: sent me a letter that described how my health information
Speaker 1: was released. Anthem said they're required by law to send
Speaker 1: my claims records to a database run by the state
Speaker 1: Health Department. The letter also said that my name, date
Speaker 1: of birth, and contact information were exposed in a cyber
Speaker 1: attack in t Anthem was hacked in a breach that
Speaker 1: compromised data on seventy nine million people. It was the
Speaker 1: largest recorded health data theft in US history. Anthem paid
Speaker 1: a sixteen million dollars settlement last year over potential HIPPO
Speaker 1: violations related to the breach. The company did not admit
Speaker 1: liability as part of the settlement, and justin May, two
Speaker 1: Chinese nationals were indicted in the crime. The Justice Department
Speaker 1: called them part of an extremely sophisticated hacking group operating
Speaker 1: in China that targeted US businesses. We got in touch
Speaker 1: with Anthem about this. A spokeswoman there said the company
Speaker 1: is committed to safeguarding customer data and there's no evidence
Speaker 1: that the information stolen in the cyber attack resulted in
Speaker 1: fraud against customers. So I know my data is out there,
Speaker 1: along with millions of other people's. I don't feel great
Speaker 1: about it, but at least I know. I'm more worried
Speaker 1: about what I don't know. And that's it for this
Speaker 1: week's prognosis. Thanks for listening. Do you have a story
Speaker 1: about healthcare in the US or around the world we
Speaker 1: want to hear from you. Find me on Twitter at
Speaker 1: the Cortes or email m Cortes at bloomberg dot net.
Speaker 1: If you were a fan of this episode, please take
Speaker 1: a moment to rate and review us and really helps
Speaker 1: new listeners find the show and don't forget to subscribe.
Speaker 1: This episode was produced by Lindsay Cratterwell. Our story editor
Speaker 1: was Rick Shine. Special thanks to Drew Armstrong. Francesco Levie
Speaker 1: is head of Bloomberg Podcasts. We'll be back on June
Speaker 1: with our next episode. See you then,