Go after UnitedHealth, not us, 100+ medical groups urge Uncle Sam

More than 100 medical industry groups have asked the Feds to make UnitedHealth Group, not them, go through the rigmarole of notifying everyone about the Change Healthcare ransomware infection. In a letter to the US Department of Health and Human Services, 102 national and state medical associations – whose members relied on …

[Doctor Syntax]

I think the govt has a point here. The public dealt with the health care providers and entrusted them with their data. It was the providers who chose to offload work to a third party. It should be those providers who are directly responsible to their customers. I regard that as an important point of principle*.

The providers certainly have a complain against their agent who let them down and may well be entitled to demand the agent do the work on their behalf and do it for free as it was their failure.

* It may be of less significance here but its disregard in the way transatlantic GDPR responsibilities are hidden is a real problem.

If an EU data subject is failed by the US service provider for the EU company with whom the subject is dealing they're expected to take it up in a US court with the service provider which is going to raise a substantial barrier compared with taking a court action in the jurisdiction, probably their own, in which the original transaction was made.

[VicMortimer]

To an extent that's true, but the providers don't really get a choice.

I had no idea who Change Healthcare was until my pharmacist mentioned the problems he was having with some insurance. Mine wasn't affected, but lots of people weren't getting prescriptions.

Now, everything to do with United Healthcare needs to be destroyed, of course. But this is also the fault of other insurance companies that use the same processing system.

Individual doctors? Not so much their fault. They have to use whatever system the patient's insurance uses, and the patient often has no choice of insurance, it's picked by their employer.

US Healthcare is a huge dysfunctional mess.

[NATTtrash]

The public dealt with the health care providers and entrusted them with their data.

Looking at this from my own professional perspective: do/ did they really? From the EU countries I work(ed) in as MD, Germany is the only one where patients are asked specifically, every time, to note, and to approve/ decline consult data stored/ transferred. And even there the situation is changing rapidly. Even though the basic concept is different there (long term, patient is physical holder of medical data, not MD nor institute) that too is changing as far as possible under the stricter German data protection laws, the latest "digital medicine" plans of the German Health minister being an illustration of that. In the end, patient consent becomes/ is a side note, a box to tick off, because other criteria are rated more important, e.g. cost, health care system/ providers convenience, throughput efficiency, cost again, additional revenue opportunities. So, if we think this was a, as it says in law, dependent on patient consent, physician is just adviser (heard Sir Brian Langstaffs very correct speech this week?) active contemplation and (free) decision by patient, I think another look might be good...

[Sparkus]

eggs, meet basket

too big to fail, too big to investigate, too big to trust.

[SVD_NL]

Re: eggs, meet basket

It's always been absolutely baffling to me how the US government has allowed this to happen. At what point does anti-trust kick in?

[Sherrie Ludwig]

Re: eggs, meet basket

At what point does anti-trust kick in?

Never. The answer is never. Ever since the Supreme Court decided the Citizens United case and made big money the only thing that counts in US politics, the individual voters became little more than serfs

[Alumoi]

Re: eggs, meet basket

When the donations stop comming. Duh!

[OllieJones]

These medical groups are right!

A few years ago a health care IT place I worked suffered a breach involving 47 patients. (Notice how that number is burned into my soul.) The root cause was a third party vendor that misdelivered, well, 47 fax messages.

Notification was a huge job. For 47 patients. We did it, because the breach happened on our watch. It’s a job that should be done by the agency that suffered the breach, not the case managers and office staff of beleaguered doc offices. United Health may complain this will hit their bottom line. Tough noogies. They’re lucky to have any shareholder equity left after their breach, attributable to sloppy authentication.