[childofhedgehog]

Why would anyone think that a non-HIPPA compliant app would keep medical information private to the level of security needed for medical data? Flo has definitely breached user trust, but that trust seems misplaced from the get-go.

[gizmo686]

People are used to living in highly regulated markets. When they go to a grocery store to buy lettuce, people don't stop to ask "what regulatory regime is this lettuce being sold under?". They just trust that food being sold in a food store will meet our societal standards for food. I can go to Amazon and order a raw steak for delivery, and still trust it will meet standards.

The situation with wellness apps is that they are a product that are designed specifically to exist outside of the regulatory regime that people associate with them.

[john_strinlai]

>Why would anyone think that a non-HIPPA compliant app would keep medical information private to the level of security needed for medical data?

because lots of people dont know what HIPPA is, and (naively to us more familiar with tech) assume that a medical-related app on a curated app store would be safe for medical-related stuff.

[ceejayoz]

> lots of people dont know what HIPPA is

Ironically, it's HIPAA.

You're right, though; it's much more limited than people think. During COVID people claimed everything violated HIPAA (masks, vaccine requirements, testing), but it only applies in a very narrow subset of patient/provider relationships.

[FireBeyond]

Very much so. Also ironically, as a healthcare provider (paramedic), HIPAA expressly allows me to get your healthcare information without your consent (as needed for your care). A lot of facilities have you sign paperwork to explicitly authorize sharing, but that's really just a CYA.

"Does the HIPAA Privacy Rule permit doctors, nurses, and other health care providers to share patient health information for treatment purposes without the patient’s authorization? Answer: Yes. The Privacy Rule allows those doctors, nurses, hospitals, laboratory technicians, and other health care providers that are covered entities to use or disclose protected health information, such as X-rays, laboratory and pathology reports, diagnoses, and other medical information for treatment purposes without the patient’s authorization."

Source: https://www.hhs.gov/hipaa/for-professionals/faq/481/does-hip...

[haldujai]

The bigger gap is for healthcare and business operations which is very broad and includes datasets for AI training as one example.

[ceejayoz]

That seems entirely unironic and reasonable, though?

[FireBeyond]

100% reasonable (and often necessary - pill shopping, psychiatric concerns, etc. And not irony in the Act itself, more people's perception of its intent.

[pseudalopex]

It is not reasonable to disregard patients' consent so generally. Specific purposes could have specific exceptions.

[elAhmo]

People just wanna track stuff, they don't really look into is something HIPPA compliant or read the ToS. App store push, recommendation, word of mouth are what makes the app like this spread, not really details HIPPA compliance.

[xbar]

"Because Apple and Google said my data was safe, so it must be safe in the apps. What's hippa?," said more than 50% of the population.