Roundtable: An Orrick Conversation on Health Data Privacy

Samir: Hi, I’m Samir Bakhru, Global Head of Orrick’s Technology Companies Group, and today I’m joined by Thora Johnson, who’s a leader in our health data and health tech practice, and most importantly, Arpan Parikh, co-founder and CEO of Kin Health. Arpan, you’re a long-time physician, you are a founder, and you speak to tech leaders every single day in your job. What’s the biggest misconception you hear about HIPAA and consumer health data?

Arpan: So, I’ll start us off with a couple of common misconceptions. Number one is that HIPAA applies to all health data, and that’s just not true, and the two lawyers in the room, you can speak to that in much more detail than me, but HIPAA applies to a subset of healthcare data in very specific situations. And number two is that HIPAA protects the physician or the clinician. And that’s just not true, right? HIPAA was actually built to protect the patient.

Thora: I’ll jump in here. I see it all the time from the regulatory perspective and I think HIPAA is used as a shorthand for all health information. So HIPAA applies to, as Arpan said, a subset of health data. It’s health data in the hands of health plans, so think UHC, Aetna, large health insurance companies, and then it applies to providers. But we see this big mushrooming of consumer health data and that’s being captured by consumer-owned wearables and AI scribes and just outside of the four corners of a hospital and a health plan.

Samir: So Arpan, transitioning a bit, tell us what Kin is, how it works, how you’re helping patients and how you are advancing the medical field.

Arpan: So we built Kin to be the first patient-and-caregiver-facing understanding and action layer. So what does that mean? It means Kin today is a really great note-taker for patients. It’s an ambient AI scribe, but in a way that’s kind of orthogonal to the ambient scribes that clinicians use. The point of Kin is actually to simplify and distill and create an output that a fifth grader could understand. And what we’re finding is that this is the missing link in our healthcare system. Physicians in this country are very well trained and they deliver excellent clinical care, but if the patient doesn’t understand the recommendations the doctor is making, it doesn’t matter how good the doctor is, the patient’s not going to get better.

Samir: And is that data covered by HIPAA?

Arpan: So the short answer is no. The note that the clinician writes in their EHR is protected health information, PHI. That is governed by HIPAA. However, when a patient walks into their appointment and uses the Kin app, that is no different from a regulatory perspective than the patient scribbling notes on the back of an envelope.

Thora: That’s a really important point that I just want to underscore for a second, which is, for HIPAA to apply, an AI scribe like Kin would have to be for the benefit of the hospital system, the provider, and in the Kin scenario, you are providing that service to the consumer. So sitting outside the traditional HIPAA covered entity business associate relationship there.

Samir: Should consumers be worried about this?

Arpan: I would say actually generally yes, and when it comes to Kin, no. I say generally yes because these tools sit outside the construct of HIPAA, there is actually no overarching federal framework around what privacy, protection, security provisions, et cetera, should be put into place. So what does that mean? It means the burden is on the business, on the company, on the founders, to decide the security posture. What we’ve decided is that we want to build to the highest standard. So as opposed to having a patchwork of policies around our data and privacy regulations, we’ve actually built the entire thing to the strictest standards that would apply from a state perspective.

Thora: We have more state consumer privacy laws that do put some bells and whistles around health data, but we really only have Washington, Nevada, and Connecticut that are laser-focused on consumer data that sits outside HIPAA. And so it really is a patchwork. And so hearing industry voluntarily building to a higher standard will get us and consumers much more comfortable quicker than I think we will under government regulation.

Arpan: Absolutely.

Samir: Arpan, let’s zoom out a little bit. There’s a much bigger conversation happening around patient ownership and control of health data. What does patient ownership actually mean to you at Kin?

Arpan: Yeah, so to me at Kin and to me as a patient myself, ownership means it’s mine. I get to take it, I get to see it, I get to share it with whoever I want, I get to revoke it from whomever I’ve shared it with whenever I want, and I get to delete it whenever I want. At the end of the day, I think the technical ownership, and again the two lawyers can debate what ownership actually means from a legal perspective, matters less as long as I have control over those five domains of my healthcare information and data.

Thora: I’d love to just bring it back to HIPAA. So HIPAA is not about ownership. For the patient, it’s about access. There’s a real tension there though, right now, when so much of the medical record is locked up with the health care provider.

Arpan: Totally.

Thora: And so what do you do, Arpan, when you’re talking with a medical institution that is more cautious with the health data than potentially the patient is?

Arpan: Yeah, it’s a great question. And I think it’s something we’re actively trying to figure out, right? Part of that is the fundamental misunderstanding of what HIPAA is. And oftentimes, the first question I get about Kin is, so, is it HIPAA compliant. No. And you’re laughing, and I laugh too when I hear that question, because it’s fundamentally the wrong question.

Thora: Yes, I agree.

Arpan: So part of it is actually helping the institution understand, like, what does the regulatory landscape look like? What are the right questions you should be asking? Because at the end of the day, it’s not about the institution deciding to share the patient’s data. It’s more about the institution making sure if they’re going to recommend a tool to a patient or make something available to a patient that the patient should trust it. Two fundamentally different questions.

Samir: Arpan, let’s put you in the room with the health system leader. They’re interested in their patients having better tools, you know, more access to information, but they’re also responsible for security and regulatory compliance. What would you say to a health system leader that’s nervous about navigating this landscape around patient ownership of data?

Arpan: What I say to that hospital CEO or CIO is, guess what? Your patients are already doing this, right? I would bet my home that every minute in this country there are patients in exam rooms with their health care professional who have a very advanced recording device in their pocket, i.e. their smartphone, right? Smartphones have incredible microphones. And it doesn’t take much to start a voice memo before the doctor walks in and slip your iPhone in your purse. So today, patients are already recording their doctors visits. And let’s be very clear, they’re not doing it for nefarious purposes, right? Like this is the patient just trying to hold it together and make sure they remember the complex instructions their amazingly smart clinician gives them when they get back to the kitchen table to tell their daughter what the doctor said.

When does a healthcare professional get sued? When something goes wrong. And when do things go wrong? When the patient doesn’t do what the doctor says. So if you empower your patients as a health system to actually remember what the doctor said and then do those things when they go home, guess what? You’re going to have fewer bad outcomes and fundamentally you will have actually fewer medical legal issues.

Thora: So Arpan, we’ve decided that the right question isn’t, is Kin or the AI scribe HIPAA compliant. What are the right questions for the CEO to be asking?

Arpan: Totally. The right questions are, what is your stance on privacy as a consumer health tool? Do you retain the data, and if so, for how long and where? Do you de-identify the data? Do you use your user or consumer’s data to train models, to do machine learning? Do your users have the right to delete their information, and what does deletion actually mean? These are the smart questions. When a hospital CEO or CIO asks me those questions, I am like, they get it. They are in full understanding of where HIPAA stops and then where consumer health rights pick up.

Samir: Let’s add AI to this entire conversation. Has AI fundamentally changed the discussion around HIPAA, or has it just sort of highlighted and pushed the envelope on the questions and issues that were already there?

Thora: So I think it’s really important to note that so far, at least, the regulators, OCR, that regulates HIPAA, hasn’t come up with a new regime or thinking that there needs to be a new regime to deal with health data and AI. Rather, we see proposed regulations under the security rule focused on what data is actually being used to train AI and how are you incorporating that into your risk assessment. I think it’s very notable that they haven’t said, we need to create a whole new bucket of laws. Along those lines though, Arpan, is there something that founders should be careful about when they’re thinking about new technologies?

Arpan: So one is around promises made around de-identification, right? I think that’s a term that gets thrown around a lot these days and it has actually very specific meanings and to do it right it has to be done very intentionally. So I would say to founders out there, if you’re going to make that claim, make sure you know what that means and that you’re doing it well. And number two is around the claim that information is not shared. When anyone is building a business, a technology company that uses AI to help a user manipulate their health information, generally speaking that information is shared with a number of entities. So in making that claim, again, be careful and make sure you know what’s going on in the background. And then the third one, which is also a big one I see in the consumer health space, is folks claiming that they’re HIPAA compliant or HIPAA certified as a marketing tool and a marketing badge, which—

Thora: Speaking my language.

Arpan: Yes, it is obviously problematic and can be very troublesome and risky for business.

Samir: Arpan, in this evolving landscape, if you could write one new rule for consumer health data tomorrow, what would it be?

Arpan: Great question. It would be a national framework that is a single page disclosure that helps the user, the patient, understand what happens…

Thora: The lawyers are laughing.

Arpan: Of course, of course. We can all dream, right? That tells the user what’s going to happen with their data, how it’s retained, who it’s shared with, for how long it gets stored, and a simple and standardized way to delete it. If we get to that place, it levels the playing field for all companies and businesses building in this space. It makes life easier for us on the founder side to have a national single framework to adhere to, and it also makes it really easy and simple for consumers.

Samir: If we just fast forward a year or even 18 months, what does success look like, both with respect to consumer health laws, but also for Kin, its patients, the healthcare industry?

Arpan: I dream of a world in which every American is empowered to actually understand what happened during the doctor’s appointment. They walk out of the appointment with their own record, right, that is theirs to do with what they please and to share with whom they like. That we as a healthcare system, and again, me putting my physician hat on, we as physicians get out of the way of our patients. Our patients are smart and empowered and have incredible technology available to them. We can’t keep trying to stop them in the name of trying to protect them from themselves.