Patient Privacy and Social Media

© 2015 ROBINS KAPLAN LLP

SOCIAL MEDIA AND PATIENT PRIVACY: BENEFITS AND RISKS TO PATIENTS IN THE

DIGITAL AGE

Sharon Roberg-PerezKrist ine Tietz


PATIENT PRIVACY AND SOCIAL MEDIA

2

Increase in patient-driven disclosures online

Benefits of social media to patients and other stakeholders

Risks


INCREASE IN SOCIAL MEDIA USE

3

As of January 2015, there were over 2 billion active social media accounts.

On average, people in the U.S. spend more than 1 hour per day with their social networks.

60% of social media access is via smartphone or tablet.We Are Social, Simon Kemp, Digital, Social & Mobile Worldwide in 2015 (Jan. 21, 2015) http://wearesocial.net/blog/2015/01/digital-social-mobile-worldwide-2015/; Social Media Update 2014 Pew Research Center (Jan. 9, 2015) http://www.pewinternet.org/2015/01/09/social-media-update-2014; Social Media Engagement Report, Business Insider Intelligence (Sept. 6, 2014), http://www.businessinsider.com/social-media-engagement-statistics-2013-12.



4

Pew Internet & American Life Project , Aaron Smith, Why Americans use social media (Nov. 14, 2011)http://www.pewinternet.org/Reports/2011/Why-Americans-Use-Social-Media.aspx



5

Primary reasons people share contento To bring valuable and entertaining content to one another.o To define themselves to others (give people a better sense of

who they are).o To grow and nourish relationships (stay connected with

others).o For self-fulfillment (to feel more involved in the world).o To get the word out on causes they care about.

OkDork, Noah Kagan, Why Content Goes Viral: What Analyzing 100 Million Articles Taught Us (April 21, 2014) http://okdork.com/2014/04/21/why-content-goes-viral-what-analyzing-100-millions-articles-taught-us/


INCREASED FOCUS ON HEALTHCARE

6

Consistent increase in healthcare spending

o Estimated $3.27 trillion in the U.S. in 2015

o More people insured, but increase in out-of-pocket expenses and more limited access

Modern Healthcare, Bob Herman, Healthcare spending rises 5.5% while rest of economy sputters (Apr. 29, 2015) http://www.modernhealthcare.com/article/20150429/NEWS/150429882; Dave deBronkart, From patient centred to people powered: autonomy on the rise, British Medical Journal 2015;350:h148 (Feb. 10, 2015) http://www.bmj.com/content/350/bmj.h148Forbes, Robert Pearl, 5 Health Care Megatrends That May Prove Costly In 2015 (Jan. 8, 2015) http://www.forbes.com/sites/robertpearl/2015/01/08/5-health-care-megatrends/;Forbes, Dan Munro, U.S. Healthcare Spending On Track To Hit $10,000 Per Person This Year (Jan. 4, 2015) http://www.forbes.com/sites/danmunro/2015/01/04/u-s-healthcare-spending-on-track-to-hit-10000-per-person-this-year/.



7

Increase in enrollment in private health exchanges

Accenture, Enrollment in Private Health Insurance Exchanges Doubled, to 6 Million in 2015, According to Accenture (April 7, 2015) http://newsroom.accenture.com/news/enrollment-in-private-health-insurance-exchanges-doubled-to-6-million-in-2015-according-to-accenture.htm ; Forbes, Bruce Japsen, More Employers Shifting Health to Private Exchanges (Oct. 8, 2014) http://www.forbes.com/sites/brucejapsen/2014/10/08/more-employers-shifting-health-to-private-exchanges/



8

Increased patient participationo “[W]e have found it as important to have a ‘union of forces’

between providers and the patients who entrust us with their care.”

o “[P]atient-activated social networks” will be one of the most “powerful forces” in driving the acceptance of medicine that is participatory.

Mayo Clinic, Lee Aase, Social Media Health Network, Mayo Chiefs Name a Patient as 2015 Visiting Professor (Oct. 22, 2014) http://network.socialmedia.mayoclinic.org/discussion/mayo-chiefs-name-a-patient-as-2015-visiting-professor/; Genome Medicine, Lee Hood & Charles Auffray, Participatory medicine: a driving force for revolutionizing healthcare (Dec. 23, 2013) http://genomemedicine.com/content/5/12/110


PATIENT PRIVACY AND SOCIAL MEDIA

9

Proliferation of online patient communities

Reliance on the internet for education about health and disease

Impact of high-tech giants on healthcare


ONLINE PATIENT COMMUNITIES

10

Dedicated sites



11

Dedicated siteso PatientsLikeMe

• 325,000 members with 2,400+ conditionso Patient Power

• Community for cancer patients, survivors and their families

• Health “centers” focused on specific types of cancers

PatientsLikeMe (last accessed April 30, 2015) https://www.patientslikeme.com/#



12

Mainstream social media

o Facebook’s Meniere’s Disease Team page• 15,000 fans, 35,000 visitors/week

o Twitter• #BCSM– scheduled weekly chats

Medical Global, Meniere’s Disease Team on Facebook Becomes the Largest Online Patient Community Committed to Advancing New Medical Treatments(Feb. 11, 2015) http://mediciglobal.com/about/press/meniere-s-disease-team-on-facebook-becomes-the-largest-online-patient-community-committed-to-advancing-new-medical-treatments; Symplur, Audun Utengen, The Flattening of Healthcare: Breaking Down Barriers in Healthcare Social Media (Jan. 7, 2013) http://www.symplur.com/shorts/the-flattening-of-healthcare-twitter-visualized/


RELIANCE ON THE INTERNET

13

Patients, families and friendso 72% of internet users look for health informationo At least 79% of internet users are also social media users

Physicianso Rely on online resources more than print sources for informationo Spend on average 3 hrs./week watching online videos, primarily

available through Medscape, YouTube and drug companies

Pew Research Internet Project, Health Fact Sheet (last accessed April. 29, 2015) http://www.pewinternet.org/fact-sheets/health-fact-sheet/; IMS Institute for Healthcare Informatics, Engaging Patients through Social Media: Is Healthcare Ready for Empowered and Digitally Demanding Patients? (Jan. 2014) http://www.imshealth.com/deployedfiles/imshealth/Global/Content/Corporate/IMS%20Health%20Institute/Reports/Secure/IIHI_Social_Media_Report_2014.pdf; Social Media Update 2014,” Pew Research Center (Jan. 9, 2015) http://www.pewinternet.org/2015/01/09/social-media-update-2014.


TECH GIANTS

14

Googleo 1/20 searches are for health information. Partnering with the

Mayo Clinic to curate results.

Facebooko Dramatic increase in organ donor registration when ‘organ

donor’ became an option on a drop down status menu.

iMedicalApps, Satish Misra Google working with Mayo Clinic to make googling health information more useful (Feb. 12, 2015) http://www.imedicalapps.com/2015/02/google-working-mayo-clinic-make-googling-health-information-useful/; Johns Hopkins Medicine, The Facebook Effect: Social Media Dramatically Boosts Organ Donor Registration. Johns Hopkins researchers see 21-fold increase in a single day (June 18, 2013) http://www.hopkinsmedicine.org/news/media/releases/the_facebook_effect_social_media_dramatically_boosts_organ_donor_registration


TECH GIANTS?

15

Appleo ResearchKit™

• With user permission, data can be accessed from the Health app (e.g. weight, blood pressure, glucose levels and asthma inhaler use)

o Partnering with IBM on cloud-based platform with data mining and analytic capabilities

Apple Press Info, Apple Introduces ResearchKit, Giving Medical Researchers the Tools to Revolutionise Medical Studies (Mar. 9, 2015) https://www.apple.com/eg/pr/library/2015/03/09Apple-Introduces-ResearchKit-Giving-Medical-Researchers-the-Tools-to-Revolutionize-Medical-Studies.html; CNET, Steven Musil, Apple partners with IBM on new health data analysis (April 13, 2015) http://www.cnet.com/news/apple-partners-with-ibm-on-new-health-data-analysis/


BENEFITS TO PATIENTS AND OTHER STAKEHOLDERS

16

Patient health and well-being

Caregiver support

Unique source of information for providers and companies developing therapies


PATIENT HEALTH AND WELL ‐BEING

17

Access to health information

o Eight in ten online health inquiries start at a search engine

Pew Research Center, Health Online 2013, available at http://pewinternet.org/Reports/2013/Health-online.aspx



18

Impact of online health informationo 45% of adults say they or someone they know has been

helped by following medical advice or health information found on the internet

o 36% percent of adults living with chronic disease say they or someone they know has been helped by following medical advice or health information found on the internet

Pew Research Center, E-Patients with a Disability or Chronic Disease, March 24, 2010 available at http://pewinternet.org/Reports/2010/Chronic-Disease.aspx



19

Greater patient autonomyo Study of individuals who were active in online groups for

patients with breast cancer, fibromyalgia and arthritis.o Respondents felt empowered by their participation, including

reporting that they were “better informed” and had an “enhanced social well-being.”

Participation in Online Patient Support Groups Endorses Patients’ Empowerment, available at http://www.pec-journal.com/article/S0738-3991(08)00394-7/abstract



20

Sense of communityo Living with a chronic disease increases the likelihood of

participation in online communitieso PatientsLikeMe

• Study of patients with epilepsy. One in three did not know a single other person with their condition.

• Patients reported benefits including gaining a better understanding of seizures and learning more about treatments.

• The more friends with epilepsy that users had in the online community, the more benefits they experienced from using the site.

Wicks, Paul et al., Epilepsy & Behavior , Perceived Benefits of Sharing Health Data Between People with Epilepsy on an Online Platform, Volume 23, Issue 1, 16 – 23, available at http://www.epilepsybehavior.com/article/S1525-5050(11)00560-9/fulltext


CAREGIVER SUPPORT

21

Four in ten adults in the U.S. are caring for an adult or child with significant health issues, up from 30% in 2010.

Caregivers are highly engaged in the pursuit of health information, support, and advice online

o 72% gather health information onlineo 52% participated in an online social activity related to health

in the past yearo 24% consult online reviews of drugs

Pew Research Center, Family Caregivers are Wired for Health, June 20, 2013, available at http://pewinternet.org/Reports/2013/Family-Caregivers.aspx


CAREGIVER SUPPORT

22

59% of caregivers with internet access say that online resources have been helpful to their ability to provide care and support for the person in their care.

52% of caregivers with internet access say that online resources have been helpful in their ability to cope with the stress of being a caregiver.

Pew Research Center, Family Caregivers are Wired for Health, June 20, 2013, available at http://pewinternet.org/Reports/2013/Family-Caregivers.aspx


INFORMATION SOURCE

23

65% of internet users report their internet and cell phone use has made them more informed about their own health and fitness than they were 5 years ago

Pew Research Center, Americans Feel Better Informed Thanks to the Internet, December 8, 2014, available at http://www.pewinternet.org/2014/12/08/better-informed/


INFORMATION SOURCE

24

Social media gives health care providers tools to share information, promote healthy behaviors, and to educate and interact with patients, caregivers, students and colleagues.

Nearly one-third of physicians use professional physician communities, with the highest enthusiasm around using them to learn from experts and peers.

Clinicians see the potential in online interactions with patients to improve access to and quality of care, but concerns around patient privacy, liability and their compensation for such activities must be addressed.

Sermo, http://www.sermo.com/who-we-are/press-releases-view/52


INFORMATION SOURCE

25

“Medical crowdsourcing”o Sermoo Physician-only online community.o As of April 2015, 305,000 verified US physicians from 93 specialties.o Physicians discuss treatment options and query peers for advice on

message boards. Media-sharing sites can also be important resources for health care

provider educationo The Doctors’ Channel hosts videos featuring medical news, continuing

medical education, and health care-related entertainment.The Doctors’ Channel, http://www.thedoctorschannel.com


INFORMATION SOURCE

26

Organizations are using keyword content from social media sites like Twitter and other location-based technologies to track health and welfare, rapidly disseminate information, and respond to disasters.

CDC tracks tweets for information pertaining to flu outbreaks. Emerging venue for health research recruitment.

o Facebook offers the ability to recruit participants via advertisements posted on the pages of users who fit the desired demographic.

o Potentially cost-effective method to recruit young adults and populations with rare health conditions.



27

94% of social media users willing to share their health data to help physicians improve care.

o their own, or other patients like them

92% supported sharing their health data anonymously to assist researchers to learn more about their disease.

Francisco Grajales et al., Social Networking Sites and the Continuously Learning Health System: A Survey (Jan. 23, 2014) Institute of Medicine of the National Academy of Sciences http://iom.edu/Global/Perspectives/2014/SharingHealthData.aspx



28

84% of social media users indicate they would be willing to share their information with drug companies to make products safer.

78% said they would share information to let drug companies learn about their disease.

Francisco Grajales et al., Social Networking Sites and the Continuously Learning Health System: A Survey (Jan. 23, 2014) Institute of Medicine of the National Academy of Sciences http://iom.edu/Global/Perspectives/2014/SharingHealthData.aspx


RISKS

29

Use by the social media providero Disputes over scope of Terms of Use

Data breaches

Data scraping


TERMS OF USE

30

Typically a condition of using a social media site. Providers reserve the right to change the terms over

time.


TERMS OF USE

31

Typically a condition of using the site. Providers reserve the right to change the terms over

time.


TERMS OF USE

32

What if a patient disagrees with a social media provider’s use of her information and/or posted content?

Social media providers may enforce their Terms of Use.


TERMS OF USE

33

Terms may dictate where disputes must be resolved.o E.K.D. v. Facebook, Inc. (S.D. Ill. March 8, 2012)

o “You will resolve any claim, cause of action or dispute . . . exclusively in the U.S. District Court for the Northern District of California or a state court located in San Mateo County . . .”

o Class action was brought on behalf of minors in Illinois based on Facebook’s targeted advertising practices.


TERMS OF USE

34

Terms may dictate where disputes must be resolved.o E.K.D. v. Facebook, Inc. (S.D. Ill. March 8, 2012)

o Plaintiffs opposed transfer, arguing that—as minors—they should not be held to the venue selection clause.

o Even minors cannot enjoy the benefits of a contract without its obligations. Plaintiffs had continued to use their Facebook accounts throughout the litigation. Case was transferred.


TERMS OF USE

35

Providers generally have broad access to user content and information.

LinkedIn has access to: your profile information; your LinkedIn contacts; synched, non-LinkedIn content (address books, calendar); your use of LinkedIn (including access to, or from, third-party sites); any publicly-posted content.

Facebook has access to: registration information; content you share; content others share; your network; device information; your use of Facebook (including access to third-party sites).


TERMS OF USE

36

Providers claim a license to user content and information.

LinkedIn ̶ “you grant[] LinkedIn the following non-exclusive license: A worldwide, transferable and sublicensable right to use, copy, modify, distribute, publish, and process, information and content that you provide through our Services, without any further consent, notice and/or compensation to you or others . . .”

Facebook ̶ “subject to your privacy and application settings: you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License).”


TERMS OF USE

37

Can social media sites use their members’ names and images?


TERMS OF USE

38

Fraley et al. v. Facebook, Inc., 3:11-cv-01726 (N.D. Cal.)

o Class action based on Facebook’s targeted advertising. (D.I. 22).

o If a user “liked” an advertiser’s profile page, her name and profile picture would appear on her friends’ pages in a “Sponsored Story” advertisement. (D.I. 74).


TERMS OF USE

39


o Claims include violation of the Right of Publicity• A newer form of IP

o Cause of action that prevents the unauthorized use of an individual's name, likeness, or other recognizable aspects of one's persona for commercial purposes.

See e.g. Right of Publicity.Com, Brief History of ROP (last accessed April 30, 2015) http://rightofpublicity.com/brief-history-of-rop (summarizing Zacchini v. Scripps-Howard Broadcasting , 433 U.S. 562 (1977).)


TERMS OF USE

40


o Motion to dismiss Right of Publicity claim denied. Plaintiffs had sufficiently pled an economic injury.

o A tangible property interest was claimed in plaintiffs’ personal endorsements of Facebook advertisers, as they appeared on their friends’ pages. (D.I. 74.)


TERMS OF USE

41


o Mark Zuckerberg: “[N]othing influences people more than a recommendation from a trusted friend” and “[a] trusted referral is the Holy Grail of advertising.” (D.I. 22 at ¶ 43).

o Sheryl Sandberg : “[M]aking your customers your marketers” is “the illusive goal we’ve been searching for.” (D.I. 22 at ¶ 45).


TERMS OF USE

42


o Facebook’s Terms of Use not a proper ground for dismissal on a Rule 12(b)(6) motion. (D.I. 74). (December 2011).

• Despite Facebook’s explicit claim to a license to use any IP content.

o Court approved a settlement in 2013 that included a $20 million payment to class members, and an increase in the amount of control that Facebook users have over their content.


TERMS OF USE

43

Cohen v. Facebook, Inc., 2011 WL 5117164 (N.D. Cal. Oct. 27, 2011)

o Class action based on Facebook’s use of plaintiffs’ names and photographs to promote its “Friend Finder” feature.

o Motion to dismiss based on plaintiffs’ lack of cognizable injury. o There was no allegation that Facebook had publicized

plaintiffs’ images and names anywhere that they did not already appear.

o Case dismissed, but not based on Terms of Use.


TERMS OF USE

44

Can social media sites use their members’ information about their contacts?


TERMS OF USE

45

Perkins, et al. v. LinkedIn Corp., Case No. 5:13-cv-04303 (N.D. Cal.)

o LinkedIn alleged to have “harvested” email addresses from contact lists.

o Multiple invitations were sent– to members’ contacts—to join. (D.I. 47). The solicitations come via LinkedIn, but include members’ names.

o Internal LinkedIn documents reflect value of viral marketing


TERMS OF USE

46


o Plaintiffs consented to initial emails to their contacts as part of the registration process. (D.I. 47 at 5-6, 29-30).

o BUT, there was no consent to repeated, follow-up emails. To the contrary, LinkedIn’s express explanation--elsewhere on their site-- that it would not email anyone without a user’s permission suggests the opposite.


TERMS OF USE

47


o Harm?• By definition, any contact receiving multiple emails is one who

chose NOT to join LinkedIn. Repeated requests are likely to annoy recipients, causing potential professional or personal harm to the “senders.”

o Feb. 2015. Parties tell court they are in the process of settling.

Top Class Actions, Karina Basso, LinkedIn Soon to Settle Email Harvesting Class Action Lawsuit http://topclassactions.com/lawsuit-settlements/lawsuit-news/49315-linkedin-soon-settle-email-harvesting-class-action-suit/ (Feb. 10, 2015)


TERMS OF USE

48

Can a social media provider read private messages?


TERMS OF USE

49

Campbell v. Facebook, No. C 13-5996 PJH (N.D. Cal. Dec. 23, 2014)

o Class action based on Facebook’s scanning of private messages for transmitted links. One user sending a link to another user via private message counted as a “like” for that article on the article’s “like” counter.

o The court found that the users stated a cause of action for violation of the federal Wiretap Act, 18 U.S.C. § 2511(1)(a), based on Facebook’s scanning of their messages. (D.I. 43).


TERMS OF USE

50


o Facebook unsuccessfully argued there was no “interception” of messages. It already had access to them because it had to deliver them. (D.I. 43 at 4-5).

o “Interception” also includes redirection of a message.


TERMS OF USE

51


o The record at the pleading stage was insufficient to determine whether private messages are redirected before they are scanned.

o Consent to processing and sending a message is not the same as consent to scan the message for content, which is then used in targeted advertising.


TERMS OF USE

52

What uses did a site’s members consent to? Courts may parse this carefully.


INJURY

53

Case Injury? Case dismissed at the pleading stage

Cohen v. Facebook Right of Publicity. But images and names only appeared in context to which Plaintiffs consented.

Yes

Fraley v. Facebook Right of Publicity. Images and names appeared juxtaposed with specific advertisers. Economic value in the endorsement.

No

Perkins v. LinkedIn Reputational harm as to sequential emails. No

Campbell v. Facebook Violation of wiretap statute. No


INJURY

54

Is there recourse for an individual simply based on a provider’s violation of a federal statute?

Or, must a plaintiff show “actual harm?”


INJURY

55

Robins v. Spokeo, 742 F.3d 409 (9th Cir. 2014)

o Robins sued Spokeo alleging violation of the Fair Credit Reporting Act.

o Spokeo is a content aggregator of publicly available content that provides users with contact information, marital status, age, occupation, economic status, wealth, etc. (unless someone has opted out).


INJURY

56


o Spokeo described Robins as holding a graduate degree and being wealthy, which he was not.

o He was unemployed, and alleged the incorrect information harmed his employment prospects.


INJURY

57


o The district court found that Robins failed to allege an injury-in-fact because he had not alleged any actual or imminent harm, and so did not have Article III standing.

o The Ninth Circuit reversed, finding that Robins had alleged injury by the very nature of the statutory violation.


INJURY

58


o Where a statutory cause of action does not require proof of actual damages, a plaintiff may suffer violation of the statutory right without suffering actual damages.


INJURY

59


o Has plaintiff alleged violation of her statutory rights? Does the statutory right at issue protect against “individual, rather than collective, harm [?]”

o If so, the interests at issue are “sufficiently concrete and particularized,” and plaintiff has standing to sue.


INJURY

60

Robins v. Spokeo (June 2014) (Cert petition)

o Circuit split regarding whether a statutory “injury-in-law” is equivalent to the “injury-in-fact” required for Article III standing in federal court.

o Variety of federal statues with statutory damages provisions.o E.g. Video Piracy Protection Act, Lanham Act’s false advertising

provision


INJURY

61

Robins v. Spokeo (2014)

o Tech companies including Facebook, Google and Yahoo filed an amici brief in support of Spokeo.

o Amici provide internet-based services to hundreds of millions daily. Decision would open the floodgates for litigants who have suffered no real injury.


INJURY

62

Robins v. Spokeo (2014)

o Amicus brief for the United States. Deny cert petition. Decision of the 9th Circuit answered specific question about standing to bring a suit for violation of the Fair Credit Reporting Act.

o Decision did not state that Congress has unlimited power to define a class of plaintiffs who may sue in federal court.


INJURY

63

Robins v. Spokeo, 742 F.3d 409 (9th Cir. 2014) (cert granted April 27, 2015).

o Whether Congress may confer Article III standing upon a plaintiff who suffers no concrete harm, and who therefore could not otherwise invoke the jurisdiction of a federal court, by authorizing a private right of action based on a bare violation of a federal statute.


TERMS OF USE

64

PatientsLikeMe - - - User Agreement


TERMS OF USE

65

PatientsLikeMe - - - Privacy Policy


TERMS OF USE

66



TERMS OF USE

67

PatientsLikeMe - - - Partners

o 23 companies, including Abbott, AstaZeneca, Biogen, Boehringer Ingelheim, Bristol-Myers Squibb, Celgene, Genentech, Janssen Pharmaceuticals, Merck, Novartis, Sanofi, UCB

PatientsLikeMe


TERMS OF USE

68

PatientsLikeMe

o Biogen’s study on MS patients using wearable devices to track activity. Expands the data available to physicians regarding patient mobility.

PatientsLikeMe Newsroom, PatientsLikeMe Study Monitors Walking Activity in People with MS, http://news.patientslikeme.com/press-release/patientslikeme-study-monitors-walking-activity-people-ms (April 15, 2015)


TERMS OF USE

69

PatientsLikeMe

o AstraZeneca, Genentech sign multi-year agreements to use patient network to research real world experiences with therapies.

AstraZeneca, AstraZeneca and PatientsLikeMe announce global research collaboration, http://www.astrazeneca.com/Media/Press-releases/Article/20150413--astrazeneca-and-patientslikeme(April 13, 2015); PatientsLikeMe News Room, Genentech and PatientsLikeMe Enter Patient-Centric Research Collaboration (April 7, 2014) http://news.patientslikeme.com/press-release/genentech-and-patientslikeme-enter-patient-centric-research-collaboration


TERMS OF USE

70



BIG DATA AND RE ‐ IDENTIFICATION

71

PatientsLikeMeo May share: biographical information including a photograph;

information shared in free text fields; connections to other people. (Privacy Policy)

Other sources of informationo Reverse image search by Google

PatientsLikeMe Privacy Agreement, http://www.forbes.com/sites/chriswright/2015/03/12/why-is-alibaba-investing-in-snapchat/ (March 12, 2015); See e.g. TechVerse How to Identify an Unknown Person using a Photograph http://www.techverse.net/identify-person-using-photograph/ (last accessed April 30, 2015).



72

Other sources of information

o Correlation with public sources of information• White pages, property records, political donations

o Data aggregators (e.g. Spokeo)

o Correlation with other social media data from other platforms

Social Media Update 2014,” Pew Research Center (Jan. 9, 2015) http://www.pewinternet.org/2015/01/09/social-media-update-2014.



73

Social media information from other platformso Content from pages maintained by patients on other siteso More than half of people who use social media use more than 1

platform.• Different types of content on different sites• Attention to privacy settings• Third-party Apps (e.g. quizzes, games)

Social Media Update 2014,” Pew Research Center (Jan. 9, 2015) http://www.pewinternet.org/2015/01/09/social-media-update-2014.



74

Study of credit card metadatao Stripped of identifying informationo Three months of credit card records for 1.1 million people

• Time, date, location of purchase, purchase priceo 4 data points enough to identify 90% of individuals

See e.g. Tom’s Guide, Jesse Emspak, How “Anonymous” Shopping Data Reveals Your Identity (Jan. 29, 2015) http://www.tomsguide.com/us/shopping-data-not-anonymous,news-20377.html



75

Wealth of information from location datao Explicit posting on Facebook, LinkedIn, Foursquare, etc.o Uniqueness of “home/work” pairs of addresses, as publicly

accessibleo Data uploaded from Fitbits, smartphones

Arvind Narayanan and Edward Felten, No silver bullet: De-identification still doesn’t work (July 9, 2014) http://randomwalker.info/publications/no-silver-bullet-de-identification.pdf ; The Huffington Post, Alexis Kleinman 200,000 Snapchat Photos Leaked On 4Chan, http://www.huffingtonpost.com/2014/10/10/snapchat-leak_n_5965590.html (Oct. 10, 2014).


DATA SCRAPING

76

Large amounts of data copied from web sites, whether manually or via a script or program.

Data that is gathered may be re-distributed to make a profit.

Sentor, Scraping Threat Report (2014) https://www.scrapesentry.com/wp-content/uploads/2014/04/ScrapeSentry_Scraping_Threat_Report_2014.pdf


DATA SCRAPING

77

Practice has been increasing in frequency and severityo 23% of web traffic due to scraperso 90% of scrapers are professional or advanced

o Use of scripts or programso Distributed IP addresses to disguise who is searching o Will spend resources to evade anti-scraping tactics

Sentor, Scraping Threat Report (2014) https://www.scrapesentry.com/wp-content/uploads/2014/04/ScrapeSentry_Scraping_Threat_Report_2014.pdf


DATA SCRAPING

78

Nielsen Co. o Used an automatic data collection tool to gather data from

PatientsLikeMeo Created fictitious member accounts to access site. Same system is

used to scrape 130 million blogs, 8,000+ message boards, Twitter and other social media sites.

o PatientsLikeMe sent a cease and desist letter. Nielsen no longer “scrapes” from sites that require an individual account for access, without permission.

American Medical News, Pamela Lewis Dolan, Online "data scraping" sparks debate about patient privacy (Oct. 25, 2010) http://www.amednews.com/article/20101025/business/310259971/6/; The Wall Street Journal, Julia Angwin & Steve Stecklow, “Scrapers” Dig Deep for Data on Web (Oct. 12, 2010) http://www.wsj.com/articles/SB10001424052748703358504575544381288117888


DATA BREACHES

79

Last year, healthcare organizations accounted for 42% of all major data breaches.

o Community Health Systems--- information on 4.5 million patients stolen in cyber attack (Aug. 2014)

o Anthem---information on 80 million customers (Feb. 2015)

Potential costs annually? $5.6 billionReuters, Elizabeth Weise, Massive breach at health care company (Feb. 2, 2015) http://www.usatoday.com/story/tech/2015/02/04/health-care-anthem-hacked/22900925/; Forbes, Bill Hardekopf, The Big Data Breaches of 2014 (Jan. 13, 2015) http://www.forbes.com/sites/moneybuilder/2015/01/13/the-big-data-breaches-of-2014/; Experian, Data Breach Industry Forecast (2015)http://www.securityinfowatch.com/article/12024859/experians-second-annual-data-breach-industry-forecasts-highlights-trends-to-watch-in-2015; Health Data Management, Greg Slabodkin, Data Breaches to Continue to Plague Healthcare in 2015 (Dec. 8, 2014) http://www.healthdatamanagement.com/news/Data-Breaches-to-Continue-to-Plague-Healthcare-in-2015-49395-1.html


DATA BREACHES

80

Inadvertent disclosure

Hackingo Jan. 2015. U.S. military social media accounts hacked.o Nov. 2013. Hackers obtain passwords for nearly 2 million

accounts. (Facebook, Google, Yahoo, LinkedIn, Twitter).

Social media sites may be used to identify very specific information that can then be used to make an illegal request seem plausible.

Forbes, Sue Poremba, Why hackers love companies who use social media (Feb. 24, 2015) http://www.forbes.com/sites/sungardas/2015/02/24/why-hackers-love-companies-who-use-social-media ; Washington Post, Dan Lamothe, U.S. military social media accounts apparently hacked by Islamic State sympathizers (Jan. 12, 2015) http://www.washingtonpost.com/news/checkpoint/wp/2015/01/12/centcom-twitter-account-apparently-hacked-by-islamic-state-sympathizers/ ; Think Progress, Lauren C. Williams, The 9 Biggest Privacy and Security Breaches that Rocked 2013 (Dec. 31, 2013) http://thinkprogress.org/security/2013/12/31/3108661/10-biggest-privacy-security-breaches-rocked-2013/


DATA BREACHES

81

Inadvertent disclosures of HIPAA-protected information

o Rhode Island emergency room physician who posted details of an injury. Sufficient detail was provided so that an unauthorized third party could identify the patient

o Physician in St. Louis who posted details of a patient who was consistently late for prenatal appointments and an induction, including a prior still birth

The Rheumatologist, Steven M. Harris, Avoid Data Breaches, HIPAA Violations When Posting Patients’ Protected Information Online (July 2014) http://www.the-rheumatologist.org/details/article/6351481/Avoid_Data_Breaches_HIPAA_Violations_When_Posting_Patients_Protected_Health_Info.html


DATA BREACHES

82

Inadvertent disclosure by patient’s own networko Friends’ privacy settings?o Friends’ use of third-party Apps

• E.g. Facebook’s games and quizzes• E.g. Snapchat

o An app that allows users to send quick video and photo clips that are intended to “disappear” after several seconds.

o 200,000 “private” photos leaked in 2014. Unauthorized third-party Apps used to send and receive “snaps.”


DATA BREACHES

83

Clapper v. Amnesty Int’l., 133 S. Ct. 1138 (2013)

o Various attorneys at public interest and media organizations whose work required them to communicate with individuals outside of the United States argued that they were likely to be the subject of surveillance by the government under the Foreign Intelligence Surveillance Act (FISA).

o They claimed to have suffered injury based on “an objectively reasonable likelihood” that their communications would be acquired under FISA at some point in the future.


DATA BREACHES

84


o Court found that claiming a reasonable likelihood that their communications would be intercepted under FISA was not enough to show future injury for standing purposes.

o Court also refused to acknowledge a present injury stemming from the respondents’ choice to take costly measures to protect their confidential communications.

o No Article III standing.


DATA BREACHES

85


o Standard used in data breach cases to determine whether there is injury-in-fact in the context of data breaches.

o Courts citing Clapper have held that increased risk that Plaintiffs will be victims of identity theft, identity fraud, medical fraud, or phishing at some indeterminate point in the future does not constitute injury sufficient to confer standing where the occurrence of such future injury rests on the criminal actions of independent decision makers and where there are insufficient factual allegations to show such future injury is imminent or certainly impending.


DATA BREACHES

86

In re LinkedIn User Privacy Litig., Case No. 12-cv-3088 (N.D. Cal.)

o LinkedIn hacked, and passwords for over 6.5 million accounts posted on a website. (D.I. 100 at 2).

o 43% of social media users re-use passwords between sites.

o Three days later, LinkedIn announces that it switched to a different password encryption system for better security.

Anupam Das et al., The Tangled Web of Password Reuse, DSS ’14, 23-26 February 2014, San Diego, CA, USA, Copyright 2014 Internet Society, ISBN 1-891562-35-5


DATA BREACHES

87


o Premium subscribers displeased. Argued that LinkedIn’s Privacy Policy stated that it employed “industry standard protocols and technologies” to protect its users’ PII, but LinkedIn failed to do so and its outdated security led to the June 2012 data breach.


DATA BREACHES

88


o Court found Article III standing and allowed claim for fraud based on allegations that Plaintiff read and relied on LinkedIn’s statements regarding data security in its Privacy Policy when deciding to purchase a premium subscription.


DATA BREACHES

89


o Fraudulent business practices claim survives a motion to dismiss. (D.I. 100).

o Four months later, LinkedIn settles for $1.25 million. Class includes potentially 800,000 premium subscribers.


DATA BREACHES

90

In re Adobe Systems Inc. Privacy Litigation, No. 13-CV-05226-LHK (N.D. Cal. Sept. 4, 2014)

o Class action for damages as a result of a data breach in which hackers gained unauthorized access to Adobe’s servers, including their “Creative Cloud” platform, a subscription-based program where customers pay a monthly fee to access Adobe’s products and services.

o Hackers obtained credit card and other personal information of up to 38 million Adobe customers.

http://www.mondaq.com/unitedstates/x/342728/Class+Actions/Adobe+Data+Breach+Ruling+Gives+New+Hope+To+Plaintiffs


DATA BREACHES

91

In re Adobe Systems Inc. Privacy Litigation, No. 13-CV-05226-LHK (N.D. Cal. Sept. 4, 2014)

o Court found Plaintiffs had standing to bring claims against Adobe even though they could not allege actual misuse of their stolen personal information.

o Significant case, as most other courts since the U.S. Supreme Court’s decision in Clapper have dismissed similar actions for lack of standing where data breach plaintiffs have not alleged actual misuse of their data.

http://www.mondaq.com/unitedstates/x/342728/Class+Actions/Adobe+Data+Breach+Ruling+Gives+New+Hope+To+Plaintiffs


PRESENTERS

92

Sharon E. Roberg-PerezMinneapolis | BostonDirect 612.349.0882 | Fax [email protected]

Kristine TietzMinneapolis Direct 612.349.8492 | Fax [email protected]

© 2015 ROBINS KAPLAN LLP 93

Date post:	14-Aug-2015
Category:	Documents
Upload:	sherry-roberg-perez
View:	21 times
Download:	2 times

Patient Privacy and Social Media

Documents