AXEL.org

Steve Lewis

How Amazon Is Using Your Data To Make You Buy

In 2018 all eyes are on Amazon. Bezos got crowned the wealthiest man in modern history, and Amazon is overtaking Apple as the most valued tech company in America.

Which begs the question, what makes Amazon so successful? I believe their success comes from the ingenious way they use your data.

Today I’m going to talk about three incredibly smart ways Amazon uses your data to empty your wallet. Let’s dive into it.

Recommended For You Section

Go to Amazon right now and log into your account, I’m sure you’re going to see something similar to this.

The ‘recommended for you’ section uses data from your buying habits to recommend items that you’re likely to buy. The psychology here is very intuitive; as human beings, we have a lot of wants. We want things that we don’t even know exists; its Amazon’s job to show us that they do.

As you buy more things on Amazon, you create a profile of your buying habits. From this profile, Amazon’s algorithm can determine what type of products you’re more likely to buy.

For example last week I was buying chia seeds for a kind of snack I wanted to make. Take a look at the picture above, Amazon’s response was, ‘Hey we see you like healthy seed based products, here’s a few more you should check out.’

All of what I’ve mentioned about the ‘recommended for you’ section ties into a proven principle of persuasion called consistency. The principle of consistency states that you are likely to repeat a similar action that you’ve done in the past. Amazon knows this and with the help of your data they can utilize this principle to sell you more stuff.

Amazon Best Seller List

If you’re like me, from time to time you’ve gone to the best seller list out of curiosity. I remember for a time fidget spinners were at the top, and I couldn’t figure out why (maybe they’re just that fun!?). The ‘best seller list’ is a collection of the best-selling products on Amazon across each category based on buying data from users.

But what reason would Amazon have for giving, you, me, and everyone access to this data? If you think about it logically, Amazon should want to protect that data.

Amazon shares this data with us because it helps them sell more products. Yes, the ‘best seller list’ is ingeniously designed to help boost sales and awareness for products. The ‘best seller’ list achieves this goal by using social proof.

The concept of social proof is simple, in our heads it plays out like this – ‘If a lot of people are doing it, then I should be doing it as well.’

Similarly, when we come across a product on the best seller list subconsciously our mind goes – ‘Hey lots of people are buying this, wonder why people are buying it?’ That spark of curiosity is more than enough to cause a sale.

Frequently Bought Together

And who could forget, right before going to the reviews we always run into the dreaded ‘Frequently bought together’ section. I have a confession to make; this section has caused me to buy more things than I would have liked. If my anecdotal evidence doesn’t succeed in convincing you, I’ll go into the genius of this section.

First, it combines the two psychological principles (Social Proof & Consistency) we saw above. Think about it; Amazon has access to data of all transactions for any product. This makes it easy for Amazon to see trends in consumer buying habits for any product. And once Amazon sees a trend which looks financially beneficial they start pushing for it using the ‘Frequently bought together’ section.

Not to mention, if two products are told to be bought frequently together it also gets you wondering why that’s the case. In some cases, it might be enough curiosity for you to buy the product just to try it out.

It’s subtle, but it’s powerful. Using data from buyers (that includes you) Amazon can make compelling recommendations.

Is Your Data Safe?

After learning about all of this, you’re likely wondering if you should be worried about how your data is being used. The answer is yes, anytime your information is being used to manipulate your decisions, you should be concerned.

But is there anything you can do to make sure Amazon doesn’t use your data? Yes and no, let me explain.

If you decide to use Amazon, there’s nothing that you can do. As long as you buy things on Amazon, your purchase history will be available to Amazon. The only way you can stop Amazon from using your data is not to use Amazon. You’ll end your data going to Amazon, but on the other hand, you’ll miss out on the convenience of Amazon.

Also, as long as you use any e-commerce platform, your data is being collected. It’s not just Amazon who’s a culprit; I’ll bet money every platform is doing the same.

Now that you know how your information is being manipulated, you can be more aware of how things work. Your data is important, and you should be cautious of how it’s being used.

Apps That Wreak Havoc On HIPAA

This is the era of multiple devices and millions of apps. Phones, tablets, and smartwatches are filled with apps intended to make our lives easier.  And it seems almost daily we read about how some – or all – of those apps are spying on our lives.

Many people don’t care.  To some extent, I am one of those.  “I don’t do anything so special in life that anyone will want to hack me” is how I feel about most of my internet presence.  I happily share photos of my family, my dogs, and my travels.

But, I do worry about money and health issues; the things that I feel need to be secure.  So when my iPhone asked for access to my health information I was hesitant to share.

The iPhone comes standard with the “Health” app (Fitbit and other devices also take, store, and share health information). In the app, you can enter your health record data and share it with other health related apps on your device.  It can also pull such data from your other apps too.

You can enter vitals, lab test results, and even track your reproductive health – where it asks for everything from your menstruation history, to sexual activity.

Wow.  To say I was surprised to see this information on an app is an understatement.

Maybe I am old fashioned, but I cannot imagine grabbing my iPhone after sex and entering the event in; it’s akin to grabbing a cigarette in the old movies.  And if you did enter it, if you ask Siri about the last time you had sex… would she answer?   I will leave that alone for now.

Is your phone secure?

Naturally, I thought that if my phone wanted to hold my very private health information, it must be secure.  So to play off the old movie reference, it’s For Your Eyes Only.  But the app is not secured by any authentication.  Well, once your phone is unlocked that is.

So, if anyone gains access to your phone, guess what…they would quickly be able to learn your sexual activity, recent blood alcohol content, and anything else you happened to trust your handy-dandy iPhone with.

Of course, if that information is on your phone…. guess who else has it?  Apple, Google, Amazon, or whomever you have your back-up account with.

As I look at my phone, I realize that I have access to all my information but so does Apple.  Certainly the type of information Apple Health is seeking from me is my private health information; HIPAA calls it Protected Health Information (PHI).

Thus, it could be subject to HIPAA regulations. If so it’s safe and secure under federal law.  But, is Apple is an entity that would be subject to the privacy and security rules of HIPAA? Are they a Covered Entity (CE)?  The answer is no.

HIPAA applies to doctors, hospitals, medical insurers, and other health care providers.  They are what’s classified as CEs under HIPAA.  So the people that normally treat you and deal with your medical records and billings have to comply with HIPAA.  But, just having medical records does not create a HIPAA obligation.

Further, other companies which support CE’s can be subject to HIPAA as well – they are the Business Associates (BAs).  An example might be a medical device manufacturer; a hospital’s cleaning service or vendor that supports medical care in some way.

Tech companies aren’t restricted by HIPAA

Apple is none of these things.  So Apple has no requirement of privacy or security over my medical data.  Likewise Fitbit, Sprint, or whoever is similarly NOT restricted by HIPAA.  But they will have all my PHI… which is a scary thought.

As I read more and more about the medical profession and IT, it occurs to me that doctors and patients are using their smartphones to communicate.  And we should ALL encourage more communication.  But what if I use an app to share with my physician?

In that case the data gathered by the physician would likely come under the purview of HIPAA.  But what if the app we are using, itself, is not secure (e.g. the Health App, or simply iMessage)?

Does the doctor need to comply with HIPAA privacy and security standards, even though we all know the data is already compromised by the patient’s method of delivery?  I don’t know the answer to this one.

It would appear similar to a waiver of the attorney-client privilege when the information is shared in the presence of a third party.  But, HIPAA has express provisions for when HIPAA can be waived; not a single word exists about an unintentional waiver.

Thus it would seem that a doctor would have to abide by HIPAA, even knowing that the patient has exposed the very records to others. Certainly you don’t want your doctor to send your records to anyone willy-nilly and have the defense be that you texted them to him/her.  Once the doctor has the PHI, it’s protected.

But I have not seen anyone litigate this question.

HIPAA and the emerging tech world

Do we have HIPAA issues with our new-fangled “wearables”?  The answer is… maybe.  HIPAA does not apply to everyone.  You can give your health records to whomever you want; after all HIPAA was created to protect “you” from unauthorized acts of “others”.

But HIPAA also has clear limiting applications to what they call Covered Entities and Business Associates of those entities.

So you may want to think twice about entering any personal heath data into your new device; it’s not secure as it sits on your device and your cloud provider has no obligations to make it secure.

But if you provide any of that information to your health care provider, they will have an obligation to meet HIPAA’s requirements for privacy and security for the data they receive.

A HIPAA Breach

A HIPAA breach can cripple your medical practice

Over the last few months we have discussed HIPAA in very general terms.  I have tried to impart some of the basics of its security and privacy obligations upon each of you, while ignoring the rest of the Act.

Certainly, it is a massive undertaking to fully grasp all of HIPAAs ins-and-outs, and I will not ever try to bore you with the entire 5 sections of HIPAA.  So if you need to know about Insurance Portability, Tax Matters, Group Plans, or Revenue Offsets, please feel free to read the other four Titles.

Now that we have discussed what information is subject to HIPAA and who is responsible to keep and control electronic protected health information (ePHI), it’s a good time to learn what I like to call the “so what?” of HIPAA.  As I travel, meet, speak with, and interact with doctors, I am often presented with the “so what?” response.

Many doctors have told me: “Steve I understand that HIPAA exists, but we have always done it this way.  I think we are compliant.  Or we don’t know how to fully comply.”  And almost all those conversations end with “so what if we are not compliant, no one will even look at my little office to audit us.”

So, I realized that I needed to do a little more in this blog. Let’s discuss what a breach is, what you have to do if you are in breach and finally the “so what?”, namely what are the fines?

Let’s first learn what a “breach” is and is not.  A breach can be defined as the acquisition, access, use, or disclosure of protected health information in a manner not permitted, which compromises the security or privacy of the protected health information.

This means that if protected health information is in the possession of the wrong person and they can read it, a breach exists.  If you give Jan Smith’s records to Jane Smith, there is a breach.  Or if you fax medical records to (702) 555-1234, but the patient’s number was (712) 555-1234, you have a breach.

It’s these little mistakes that plague offices at times.  Most certainly, if your patient charts are on your laptop and it’s stolen, that’s a breach.  Should your server be accessed due to a hacking incident, or if you email a patient’s records to Kinkos as opposed to Dr. Kinko (the physician you intended to refer your patient to), you have a breach event.

Simply put, records must be seen only by those authorized to see them, and Covered Entities (CE) and Business Associates (BA) in possession of the records hold the responsibility to ensure no breaches take place.

“But what if my PHI is encrypted?” you ask. If the PHI is encrypted when the breach took place, you are probably covered.  The unauthorized use or disclosure of PHI is presumed to be a breach, unless there is a low probability that the information was compromised.

So when the PHI ends up in the wrong hands, but all they see is 0s and 1s due to your encryption, you may be protected. If you realize an email went to joesmith@mail.org as opposed to josmith@mail.org, but the email was sent with encryption, you are probably ok not reporting a breach.

However, a breach notification is necessary in all situations except those in which the CE demonstrates through a risk assessment that there is a low probability that the PHI has been compromised. We will discuss what a “risk assessment” is in the next blog.

But today’s blog is addressing a breach.  So, assuming a reportable breach took place, now what?  Once a CE or BA is made aware of a possible breach, they must report the breach to the Department of Health & Human Services.

The report must be made without “unreasonable delay”.  While it is not 100% certain what constitutes an “unreasonable delay”, 60 days appears to be the outer limit for reporting, and waiting until the 60th day could be unreasonable as well.

Some state laws provide stricter reporting rules such as California’s mandate that you have 5 days to report a breach.   We will discuss the notice details in a later blog

And now the “So what?”  Here are the federal breach penalties.  But please take note that some states allow separate penalties.  Additionally, some states allow private causes of action against the CE by the harmed patients.  So these charts present only the tip of the iceberg in some cases.

Looking through the charts it is easy to see the risks you’re taking by not making sure your office is HIPAA compliant. In 2016, the Office for Civil Rights (OCR) collected over $20 million in fines, and in 2017 they have already disclosed over $17 million in fines collected.

Finally, don’t think that just because you are only an employee for a company, that you are immune from these fines and prison sentences. If an executive is aware of a violation, delegating the responsibility to someone else (the company’s “Security Officer”, perhaps) DOES NOT protect the executive from a personal penalty.

So now that you know what the ramifications are for a HIPAA breach, it is crucial that you take the necessary steps to ensure you don’t end up as one of OCR’s statistics.

Take the painful (but important) measures to be compliant now to save yourself a lot of stress, heartache, and money in the future. Otherwise the question you’ll be asking isn’t “so what?” but rather “does anyone know a good attorney?”

Who’s Covered by HIPAA?

Our previous HIPAA entry exposed you to some of the basics of HIPAA.   One of the things we did was to identify who was covered by the HIPAA rules.  Entities or individuals that are Covered Entities (remember: Health Care Plans, Health Care Clearinghouses, or Health Care Providers) are certainly subject to HIPAA.

But, effective February 17, 2010 under the HITECH Act, Business Associates (BA) became subject to HIPAA privacy and security rules as well.  What this means is that a company that is not in the healthcare industry, per se, but deals with medical records as part of their job duties, COULD be subject to HIPAA rules.

A BA is a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information (PHI) on behalf of, or provides services to, a Covered Entity; attorneys, accountants, consultants, and others are some possible examples.  But there is not a list in HIPAA which defines who is a BA by trade.  Thus, the following test is used:

  • a party who is performing a function for a Covered Entity;
  • that has access to PHI;
  • but is not an employee of the Covered Entity.

Now that you have had a chance to determine if you are or are not a BA, what are your HIPAA requirements?  Well, you must comply with HIPAA of course.  But generally you must secure the PHI, and use it only for the same purpose it was given to the Covered Entity.

Where it sometimes gets tricky is, you must make the PHI “accessible” to the individual to whom the PHI belongs; most often the patient.  So you cannot just lock it up and throw away the key.  You must also perform risk assessments of your security and mitigate determined risks.  Finally, you have notice obligations should there be a breach.

Next we will talk about what a breach is, your reporting requirements, and the related fines and penalties for a breach.

What is HIPAA?

Since our previous HIPAA entry exposed you to some of the shock value of the recent HIPAA violations, I assume you are checking back because you’re interested in how HIPAA may apply to your company.  With this article, I wanted to provide a little foundation for HIPAA.

HIPAA is the acronym for The Health Insurance Portability and Accountability Act which was legislation passed in 1996.  For you legislative purists, HIPAA was initially known as the Kennedy–Kassebaum Bill.   But, yes, HIPAA has been around since 1996!  I bet that, if polled, most medical or insurance privacy officers would tell you that HIPAA was enacted in the last few years.

Not only is HIPAA not new, it was also not written solely to provide punishment to medical practices that get lazy with their record keeping.   It’s made up of five sections, of which only one, Title II, addresses items such as patient’s access, security, and privacy.  Perhaps another day I will talk about the coding, automation, coverage, and standardization requirements of HIPAA, but not today.

The Department of Health and Human Services (HHS) enforces HIPAA, and its Office for Civil Rights (OCR) performs all the audits.   Interestingly, in 2009 then-President Obama signed the American Recovery and Reinvestment Act of 2009.  Contained therein, was the HITECH Act, which enabled the OCR to be funded by the very fines it levies and collects.  Thus, there is little doubt that HIPAA investigations, enforcement, and fines are here to stay.

Understanding that HIPAA and its enforcement is here to stay, the next question is:  “does it apply to us?”  Most certainly, HIPAA does not apply to anyone who holds a medical record in their hand.  But it does apply to Covered Entities such as:  Health Care Plans and Clearinghouses (some may just call them the insurance side) and Health Care Providers (doctors, nurses, hospitals, those trained and licensed to provide medical care, etc.).  And finally HIPAA applies to Business Associates (BA) (a party who is performing a function for a covered entity that has access to PHI, but is not their employee).  So, if you are one of those folks, the HIPAA rules apply to you.

Who is, or may be, a BA will be the subject of the next HIPAA blog.

Keeping Up in Court

It’s the day before the big hearing.  The Motion was perfect; Opposition just ok – no surprises, and your Reply crushed it.  This is the second time you will be arguing your Summary Judgment Motion.  A Rule 56(f) Opposition carried the day six months ago; but it’s more than ripe this time around.

You sit down to download all three pleadings to your iPad; with exhibits they total about a foot-thick of paper.  But, in PDF format, the files are too big for the storage left on the device.  To make matters worse, you wanted to download a few other things for the hearing as well – their Opposition from the last hearing (since it makes a few arguments that help you this time around), the latest round of discovery responses (a perfect Interrogatory answer from their CIO exists), and a bunch of photos of your client’s product and their infringing product that your expert just testified to at his deposition last week.

The next two hours are spent deciding if you really need all the exhibits to the pleadings, what else you really need, and considering what you could take off your iPad.  WASTED TIME and ADDED STRESS.   As if you need either of those on the day before the hearing.  Finally, you decide to leave the Opposition exhibits and the new expert photos off the download, and remove a few unrelated things from the iPad and off you go.

Let’s take the worst-case scenario, and play it out.  During argument opposing counsel brings up a document from her exhibits – that you did not think was important enough to address in your outline – and it’s not on your iPad.  She also talks for a while about your expert’s deposition and two of his photos – which you don’t have either.

As prepared and articulate as you may be, you simply cannot address the nuances of her arguments on those three pieces of evidence since they are not right in front of you.  Motion DENIED.

I understand that in this hypothetical you could have hand-carried the documents to court.  But the point is, even when we carry twelve inches of material to court and/or download all the related pleadings, every now-and-then a question is asked or argument made related to a document we just did not have.  Sure, sometimes the judge will give us more time to address the evidence, but would it not be better to just have access to your entire case file – no matter how big?

This scenario happened to me a few times in my 18 years of litigation.  Sure, there was more than one time where I simply forgot to grab part of the file on the way to court.  But far more often, opposing counsel would bring up something completely unrelated to the issue, or from a prior hearing or long-ago completed discovery.  Every now and then, a judge would ask for something very specific or something silly like a date of service on Interrogatory packet #3.  In these instances the ability to access all your documents can be the difference between winning or losing your case. It’s important for any attorney to do their research on finding the best file management tools to ensure they have the important information on hand at all times.