ILI Student Blog

Year: 2012

  • New GAO report on medical device security

    In response to congressional requests, the GAO produced a new report on medical device security (http://www.gao.gov/assets/650/647767.pdf).  Unlike agencies like NIST, the GAO provided a number of specific recommendations for the FDA (apparently the oversight of medical device security falls to the FDA). And by “specific” I mean very general, almost cliché recommendations:

    1) The FDA should increase its focus on manufacturers’ identification of potential unintentional and intentional computer security threats and vulnerabilities and strategies to mitigate these risks during its pre-market approval review process;
    2) Utilize available resources, including those from other entities, such as other federal agencies;
    3) Leverage its post-market efforts to identify and investigate information security problems; and
    4) Establish a specific schedule for completing this review and implementing these changes.

    I really have no idea what any of that is really supposed to do. However, despite that, the GAO report is extensive in its detail and description of medical threats and risks.

  • Do Fair Information Practices (FIPs) really create better outcomes?

    http://www.markleweeklydigest.org/2012/09/eu-and-us-eye-privacy-in-parallel.html

    The article linked above adds to the comparative discussion between EU and US privacy regimes. In every conversation I can recall, Americans consider both the European and Canadian models of FIPs and Privacy by Design to be much superior to the sectoral approach here in the US. And on their face, I think this makes a lot of sense: keep the focus on the use, collection, and storage of *all forms* of personal data, rather than trying to chase down, and apply rules governing, singular instances of data abuse (e.g. mobile device IDs, GPS location, drone surveillance, etc, etc).

    During a conversation the other day with a colleague, we wondered: is there actually any evidence to support the claim that the European model leads to better consumer or industry outcomes? This isn’t meant to be a normative question, but an empirical one. Are there fewer cases of medical identity theft in Europe? Are there fewer privacy intrusions? Is there less cyberstalking, tax or government fraud, or forged identification documents? Is there any evidence at all that FIPs create better outcomes?

    One paper I can think of compares the effect of US and EU privacy regimes on consumer credit and debt (http://userpage.fu-berlin.de/~jentzsch/eu-vs-us.pdf). The paper finds that the EU has stronger data protection and credit reporting laws (i.e. allows less information exchange), but also less consumer debt than the US. In addition, the US, having a weaker privacy regime (i.e. allowing more information flow), has fewer national credit bureaus and that US consumers enjoy broad access to credit (which we may feel is good) — but they also suffer from more consumer debt (which we may feel is bad). While it would be unfair to characterize this as a causal model, what might be a possible explanation?: that weaker privacy regimes lead to cheaper credit, but induce more consumer debt. So on net, is this good or bad?

    Of course, this is just one paper. I’d love to hear of any other empirical work on this topic.

  • Roger Ford: White Paper on Mobile Privacy

    location white paper

  • Google negotiating with FTC over Safari cookie bypass

    The FTC may have learned from the backlash over the $25,000 fine the FCC imposed on Google for intercepting wireless traffic with its Street View cars. According to a published report, Google and the FTC are negotiating over how large a fine Google will pay for bypassing default settings in the Safari web browser to install third-party tracking cookies in violation of the browser’s settings. The fine could exceed $10 million, according to Bloomberg — large, but tiny compared to the maximum fine of $16,000 per day per violation under the FTC’s statutory authority.

  • No Asking Sexual Activity: NASA v. Nelson Qualified by Federal District Court

    By: Can Cui

    In December 2011, a Michigan employer’s motion for summary judgment on a job applicant’s right to privacy claim was denied over questions asked in a routine pre-employment medical exam conducted by an independently owned medical clinic.  Garlitz v. Alpena Regional Medical Center, No. 10-13874-BC., 2011 WL 6016498, at *13 (E.D. Mich. Dec. 2, 2011).  See David Goldstein, Hospital’s Post-Offer Medical Questions May Violate ADA, Title VII, and Employee Privacy Rights, Healthcare Employment Counsel (Dec. 12, 2011), http://www.healthcareemploymentcounsel.com/2011/12/12/hospitals_post-offer_medical_questions_may_violate_ada_title_vii_and_employees_privacy_rights/.

     

    Acknowledging that “[w]hen acting as an employer rather than as a sovereign, the government enjoys greater latitude to inquire into personal matters of its employees,” Garlitz, 2011 WL 6016498, at *15 (citing NASA v. Nelson, 131 S. Ct. 746, 757-58 (2011)), the District Court is not willing to let “public employees surrender their constitutional rights when they accept a position with the government,” Id. at *15, and held that “the information sought [by the government employer] regarding Plaintiff’s sexual life [must be] relevant to Plaintiff’s job performance or related to her job functions.”  Id. at *16.

     

    This case distinguishes itself from Nelson because, unlike in Nelson, where the information seeking was reasonably aimed at identifying capable employees who would faithfully conduct the Government’s business, the “inquiry into . . . ‘private sexual life’ is [not] ‘related’ to the job.”  Id. at *16.  Therefore, although the government does not have to show its questions were necessary or the least restrictive means of furthering its interests, as established in Nelson, a minimum level of “relatedness” is required.

     

    One may argue that Norman-Bloodsaw v. Lawrence Berkeley Laboratory, 135 F.3d 1260 (9th Cir. 1998) has made a comeback in this case, at least in the government employer context.  This case is different from Norman-Bloodsaw in at least two significant ways.  In Norman-Bloodsaw, blood and urine samples were taken and tested for various conditions without the plaintiffs’ knowledge and consent, while in this case, only questions about pregnancy, abortion, sexual activity, birth control and similar subjects were asked in a written form.  Indeed, although the 9th Circuit recognized both the right to information privacy and the Fourth Amendment right in Norman-Bloodsaw, it felt that “it would not make sense to examine the collection of medical information under two different approaches,” and analyzed “under the rubric of [the Fourth] Amendment.”  Id.  Here, a Fourth Amendment argument may not be as strong unless one believes that questioning should be considered a “search” under the Fourth Amendment.

     

    To the extent that some commentators may think that Nelson could be decided merely by concluding that questionnaires to collect information, without any evidence of disclosure, do not implicate the constitutional right to privacy, e.g., Daniel J. Solove & Paul M. Schwartz, Information Privacy Law 1025 (4th ed. 2011), this case seems to have answered that question in the negative.

     

    So the takeaway message for human resources is: HR staff are well advised to review and/or revise their pre-employment medical screening process to make sure that the subject matter of not only tests conducted but also questions asked is related to the job, because courts may be looking more closely at routine policies and procedures concerning screening and hiring.  If you cannot find relatedness between a screening question and a specific job function, you’d better leave the question out of the hiring process.

     

    Eastern District of Michigan’s opinion in Garlitz is available here: http://www.healthcareemploymentcounsel.com/examining-room/GarlitzVsAlpena.pdf.

  • New Telecommunications Provider Aims to Enforce Privacy Rights against Government Surveillance through Consumer Autonomy

    New Telecommunications Provider Aims to Enforce Privacy Rights against Government Surveillance through Consumer Autonomy

    By Sofia Rahman

    CNET reports that the first ISP executive to challenge the government’s demands for consumer information via national security letters is now in the process of creating what could be the most serious and consistent pushback to government surveillance: “a telecommunications provider designed from its inception to shield its customers from surveillance.”

    http://news.cnet.com/8301-31921_3-57412225-281/this-internet-provider-pledges-to-put-your-privacy-first-always/

    Nicholas Merrill’s proposed telecommunications provider will provide budget-friendly national mobile and internet service which places consumers first by giving them substantial control over their data and collaborating with public interest organizations like the ACLU and EFF to presumptively challenge seemingly unconstitutional government demands for consumer records. The ISP would be run by Merrill’s non-profit, the Calyx Institute, whose primary goal is to “use every legal and technical means available to protect the privacy of customer data.” The key to Merrill’s approach is making it impossible for the ISP to comply with the FBI’s requests for data, such as stored communications, by allowing consumers to encrypt their information from Calyx itself:

    “Through other partnerships, we are poised to offer Internet service in 70 markets in the US using wireless spectrum which we will bundle with end-to-end encrypted Virtual Private Network (VPN) technology in order to keep the customer’s data as private as possible. The next products on the roadmap include hosted email and cloud storage/sync systems that utilize public key cryptography so that only the user possesses the key required to decrypt their email or files. This means that the provider (Calyx) will not be able to read your email or files even if it wanted to. And if Calyx can’t read it, it can’t be targeted by unconstitutional surveillance tactics.”

    Calyx would be able to avoid compliance with FBI demands this way because the Communications Assistance for Law Enforcement Act of 1994 (CALEA) states that ISPs cannot be forced to decrypt communications if they don’t actually possess the necessary information. While the FBI has expressed concern about this type of “Going Dark” obstacle inherent to an ISP, the ACLU has embraced Calyx as the rare exception to the major telecommunications providers like Verizon and AT&T which have been unwilling to publicly challenge the government’s demands and have instead handed over billions of consumer records.

    Although the government could still evade Calyx’s encryption-based protections by other surveillance methods such as remote installation of spyware or keyloggers, Calyx could still address the government’s controversial ability to prohibit ISPs from providing notice to consumers whose information the government has requested, which renders it near impossible for consumers’ to establish standing in court to assert their privacy rights.  With consumers in charge of their own data, the government may be unable to avoid notifying or alerting consumers in the course of surveillance.

    Merrill was motivated by his unique experience as a former ISP-executive to confront the government’s ability to restructure the power dynamics of privacy, including the government’s ironic ability to force anonymity in order to acquire confidential information.

    In 2004, the FBI sent Merrill a secret NSL (which at the time required no prior judicial review though Congress narrowly addressed this in 2005) demanding that he provide them with confidential customer data and forbidding him from disclosing the FBI’s demand to anyone. Merrill refused to comply and instead sued the FBI and Department of Justice.  In order to file suit, Merrill violated the non-disclosure order by hiring the ACLU but litigated the case anonymously and the Washington Post made its first exception to its prohibition on anonymous op-eds in order to publish his piece decrying government secrecy and the usurpation and repression of his identity: “I resent being conscripted as a secret informer for the government and being made to mislead those who are close to me, especially because I have doubts about the legitimacy of the underlying investigation.”

    Merrill was prohibited from revealing his identity for six years as the case (known in its most recent form as Doe v. Holder) made its way through the courts and various changes in the Bush and Obama administrations. But Merrill’s persistence led to the first legal victory against the gag orders, with the courts twice finding that they were unconstitutional under the First Amendment: in 2004, because they constituted prior restraints on content-based speech, and in 2008, because they wrongly burdened recipients with challenging the gag orders in the first instance rather than requiring the government to bear the burden of demonstrating the need for non-disclosure. In a 2010 settlement, the FBI allowed Merrill to reveal his identity but kept in place the gag order on the redacted contents of the NSL. In a follow-up Washington Post op-ed, Merrill wrote that the forced anonymity took a debilitating toll on his personal life because he was prohibited from confiding in family and friends.

    Calyx may have the potential not only to restore agency of the right of anonymity to recipients of government surveillance demands, but also to assuage consumers who have resorted to anonymous remailers like Hushmail and Mailinator because they lack confidence in the privacy of their standard communications accounts. Calyx has received popular support in forums like Reddit and has a $2 million fundraising goal to start operating later this year.

  • New York Moves To Protect Health Data Privacy

    Emily Millner

    As New York Builds Its Health Information Exchange, New And Complex Privacy Issues Arise.

     

    The move towards implementation of health information exchange (HIE) introduces new concerns regarding patient privacy. New York State is building a health information exchange that uploads the entire history of a patient’s medical records to a centralized network. The New York eHealth Collaborative together with the New York State Department of Health have established the Statewide Health Information Network of New York Policy Committee.

    The committee’s primary task will be to create and update policies that protect personal health information while expanding the state’s ability to share electronic health records between healthcare providers as well as consumers and other health-related community organizations. The committee was established after The New York Civil Liberties Union issued a report criticizing New York State’s current privacy and security policies and procedures governing computer networks that share electronic medical records.

    The committee aims to make health information both accessible and secure. One area of concern, which the committee hopes to address, is the technological infrastructure of the state’s HEI, which has been described as “an all or nothing” approach. Once a patient gives the provider consent to access his or her medical records, the provider can see everything about the patient that was ever entered into the network, regardless of whether the information is relevant to the current treatment. The committee hopes to implement a policy requiring HIEs to have the capacity to sort and segregate information so that both patients and providers have the ability to restrict access to certain portions of a medical record.

    The committee works with stakeholders form across the state and from a wide variety of interest groups to develop common policies, procedures and technical approaches through an open and transparent process. The committee will continue to work towards developing a system that strikes the proper balance between accessibility and security of health information.

     

    http://www.informationweek.com/news/healthcare/security-privacy/232800368

    OR

    http://www.ihealthbeat.org/articles/2012/4/6/ny-forms-health-data-exchange-policy-panel-after-recent-criticism.aspx

     

  • Genomic Testing and the Affordable Health Care Act

    By: Fahd Reyaz

    Genomic testing is becoming cheaper and companies are able to provide better assessments of risk for complex diseases based on an individual’s genome. As more individual’s purchase these services and have asymmetric information about their own lifestyle, environment, etc. they may consider themselves “genetically healthy” and opt into less comprehensive or lower premium insurance. On the other hand, “genetically unhealthy” individuals would opt into more comprehensive or higher premium insurance. Insurance companies would be unable to raise premiums for the “genetically unhealthy” group as a larger percentage of those “genetically unhealthy” individuals become sick relative to “genetically healthy” individuals.

    An example of this is the APOE  e4 variant for Alzheimer’s disease – a, from the health insurer’s perspective, expensive disease due to the need for long-term care and nursing – individuals who find out they have the  e4 variant, which increases the likelihood of having Alzheimer’s disease later in life, would likely opt into more comprehensive health insurance. Insurance companies would be unable to raise those individuals’ premiums since GINA prohibits insurers from raising health insurance premiums based on genetic risk; one commentator referred to this as an “adverse-selection death spiral“.

    The Affordable Health Care Act’s Individual Mandate would solve this issue since individuals, regardless of their prospective genetic health, would purchase insurance side by side. Recently the Supreme Court questioned the constitutionality of not only the Individual Mandate, but also the Affordable Health Care Act.

    If the Individual Mandate is struck down while GINA is still enforceable, it seems likely to me that the health insurance industry will have to rethink how they price insurance.

     

    Washington Post – How a $1000 test could destroy the Health insurance Industry

  • Scary Description of New Hungarian Secret Police

    In Paul Krugman’s blog at the NYT, his colleague Kim Lane Scheppele has been periodically writing about the recent radical changes in Hungarian government. Today she wrote about the TEK, the new Hungarian Secret Police. The description of their police is everything you would expect from a new secret police, and worth reading in it’s entirety, but here’s a (somewhat long) excerpt:

    TEK can engage in secret surveillance without having to give reasons or having to get permission from anyone outside the cabinet. In an amendment to the police law passed in December 2010, TEK was made an official police agency and was given this jurisdiction to spy on anyone. TEK now has the legal power to secretly enter and search homes, engage in secret wiretapping, make audio and video recordings of people without their knowledge, secretly search mail and packages, and surreptitiously confiscate electronic data (for example, the content of computers and email). The searches never have to be disclosed to the person who is the target of the search – or to anyone else for that matter. In fact, as national security information, it may not be disclosed to anyone. There are no legal limits on how long this data can be kept.

    …

    [R]equests for secret surveillance are never reviewed by an independent branch of government. The justice minister approves the requests made by a secret police unit operated by the interior minister. Since both are in the same cabinet of the same government, they are both on the same political team.

    …

    TEK now has had the legal authority to collect personal data about anyone by making requests to financial companies (like banks and brokerage firms), insurance companies, communications companies (like cell phone and internet service providers) – as well as state agencies. Data held by state agencies include not only criminal and tax records but also educational and medical records – and much more. Once asked, no private company or state agency may refuse to provide data to TEK….[TEK’s] data requests no longer [have[ to be tied to criminal investigations…. In fact, they have virtually no limits on what data they can collect and require no permission from anyone.

    If an organization (like an internet service provider, a bank or state agency) is asked to turn over personally identifiable information, the organization may not tell anyone about the request. People whose data have been turned over to TEK are deliberately kept in the dark.

    These powers are shocking, not just because of their scope, but also because most Hungarians knowledgeable about constitutional law would probably have thought they were illegal. After the changes of 1989, the new Hungarian Constitutional Court was quick to dismantle the old system in which the state could compile in one place huge amounts of personal information about individuals. In its “PIN number” decision of 1991, the Constitutional Court ruled that the state had to get rid of the single “personal identifier number” (PIN) so that personally identifiable data could no longer be linked across state agencies. The Court found that “everyone has the right to decide about the disclosure and use of his/her personal data” and that approval by the person concerned is generally required before personal data can be collected. It was the essence of totalitarianism, the Court found, for personal information about someone to be collected and amassed into a personal profile without the person’s knowledge.

    Does this not also violate the EU Data Protection Directive, or does that only apply to private companies rather than the member governments? It seems clear from the other posts about this that the Fidesz government isn’t particularly concerned about that sort of thing, but at what point does the EU just kick them out?

  • Online Privacy

    Julia Angwin & Jeremy Singer-Vine, Selling You on Facebook, Wall St. J. (Apr. 10, 2012), http://online.wsj.com/article/SB10001424052702303302504577327744009046230.html.

    By: Randall Norman

    Online privacy is a hotly debated topic right now.  Some of this attention stems from the recent release of the Obama Administration’s Consumer Privacy Bill of Rights and the other issuances of proposed methods to regulate Internet privacy by various groups.  Hopefully, at least part of the current interest in online privacy can be attributed to the awareness and concern of Internet users about the collection of their data.  Different websites and applications utilize an impressive array of techniques to monitor the online behavior and collect the personal information of users.

    While the extent to which companies engage in the collection of user data varies greatly, some websites are notorious for gathering the personal information of its users.  One such infamous collector is Facebook.  Both the social networking website itself and many of the applications offered on the website are attractive to users because of the seemingly free status.  However, such websites and applications that do not charge a monetary fee are profiting from the popularity of their products by collecting the personal information of users and selling this data to online advertising companies.

    Although many sites track the behavior of users, Facebook is particularly tailored to collect personal information as a social networking website.  On Facebook, users voluntarily choose to share all kinds of details about themselves, allowing the website to cater to the $28 billion online advertising industry.  Additionally, Facebook boasts over 800-million users, who provide massive amounts of personal data for collection.

    Facebook largely derives its revenues either directly, or indirectly through the quizzes, games, and other applications offered, from the advertising services that use the collected data to target users with customized ads based on profile and online behavior.  In May 2012, when the company plans to go public, Facebook could potentially boast an initial public offering of more than $100 billion on the Nasdaq Stock Market.  This value illustrates the substantial demand for collected user data and underscores the extensive effect that new regulations for online privacy will have, regardless of the form adopted.