top | item 17550315

Health Insurers Are Vacuuming Up Details About Customers

193 points| marchenko | 7 years ago |propublica.org

253 comments

order
[+] a_d|7 years ago|reply
Whenever someone says that AI and IoT would automate insurance underwriting, I start to fret — because it very quickly starts to imply more and more data collection. This is like pre-crime but for your health. Meaning, you start paying high premiums right away because later in life you might be at a high risk for a specific condition. (I know this already happens for smoking, but that is declared on a form — not by a company sending a drone to spy on you)

Since this is a startup forum — I believe health insurance to be so dark and morbid (with things like companies haggling with living relatives about ventilator care) — there is got to be a better way! (I realize this is more of a lament than a constructive suggestion)

[+] rsync|7 years ago|reply
"there is(sic) got to be a better way!"

There are two better ways - each at a different end of the spectrum.

You can give up entirely on government intervention in health insurance and social "goods" being pursued - everyone is on their own and "healthcare" is a private, personal matter. You can play these agency/incentive games with insurers for better or for worse and you're on your own.

OR

We declare "healthcare" to be a public, common good and completely socialize it. Like roads and fire departments.

What these two different strategies have in common is that both of them are intelligible, reasonable and give people a framework for planning and making long term decisions.

Anything between these two points on the spectrum is unintelligible and unsustainable. You would probably be better off with (the option above that you like the least) than any option between them.

[+] richrichardsson|7 years ago|reply
There is a better way, it's called single payer universal healthcare!
[+] samfisher83|7 years ago|reply
While its called its called Health Insurance, it should be called health care costs.

The US is the only 1st world country without universal healthcare. The thing is most of us already subsidize the healthcare industry. The hospital has to treat someone in an emergency if they take medicare or medicaid. A lot of times people are using the emergency room as their primary care since they can't afford primary care. The hospital increases the rates it charges everyone else to cover this.

You can use data to predict who is going to be more sick and charge them more. However do you want them to die or suffer. I wouldn't. So why not try to fix the big problem instead of all these little ones about data misuse and just cover everyone since you are paying for them anyway.

[+] chimeracoder|7 years ago|reply
> The thing is most of us already subsidize the healthcare industry. The hospital has to treat someone in an emergency if they take medicare or medicaid.

The "subsidies" run the other way. Medicare reimbursements do not cover COGS, which means that providers cannot sustain themselves solely on Medicare reimbursement rates; they need to take privately-insured patients (whom they charge dramatically more) in order to stay afloat[0].

These costs get passed on to privately-insured patients in the form of higher premiums.

[0] Medicare acknowledges this, and in fact, Medicare even runs multiple stipend programs to essentially pay extra to hospitals who don't see enough privately-insured patients that they can make up the difference. If they didn't, those hospitals would close, because you can't lose money on a per-patient basis and still run a practice, even if you managed to recruit doctors, nurses, and staff who agreed to work for free as volunteers.

[+] FireBeyond|7 years ago|reply
> Insurers contend they use the information to spot health issues in their clients — and flag them so they get services they need.

Horse shit. And I say that as someone who writes claims management software for the healthcare industry.

I challenge ANY health insurer to provide examples of this. Of course, they won't, because they'll cite "patient confidentiality", but that just doesn't happen.

They've wanted to do this for years, though, and try to. Requests to be able mine claim data for familial predispositions to diseases was one that we fended off multiple times.

[+] sidlls|7 years ago|reply
You may have fended it off but I assure you there is a whole industry devoted to using claims and other health data to manage care and costs. Insurers are primary partners of these companies and act as both providers and consumers of the data.

Not just insurers, but big hospitals and provider networks, too.

[+] lvspiff|7 years ago|reply
You'd be surprised - your not seeing the informatics side I'm guessing - they take all the data from the claims system and use it to check if a patient is over 55 and has had a colonoscopy, or female and over 45 and hasn't had her annual breast exam. Things like that are common practice for major insurance carriers (see unitedhealth, blue cross, humana, etc) to notify their customers of opportunities.
[+] Spooky23|7 years ago|reply
They do it in two ways that I have seen.

If you have a prescription for an off-label use of a drug that is commonly used for other diseases with high maintenance costs (say diabetes or asthma), you'll start getting newsletters about early management/intervention.

They also do subrogation. If you have something that is a high likelihood to be somebody else's (Worker's Comp, auto insurance) problem like a back injury, you'll have an investigator call to try to link an earlier incident, ER admission, etc to your current issue.

Most of the other stuff (familial predispositions, etc) are fraught with ethical problems. You can't send a random letter to a random person and suggest that they are predisposed to cancer or something.

[+] duxup|7 years ago|reply
I have read a few stories about some small insurers who were using health data to address ongoing issues and help people get more consistent care.

The catch was for it to work it was a very labor intensive task to have someone work with the customer.

Granted it was more of a story about how things should work than how they do.

[+] pishpash|7 years ago|reply
And people voluntarily spend money to send their DNA to some random websites. Sure, they don't use it in this way now, but for how long can they hold off on the temptation?
[+] turc1656|7 years ago|reply
"The companies are tracking your race, education level, TV habits, marital status, net worth. They’re collecting what you post on social media, whether you’re behind on your bills, what you order online."

The only way they can do this and link it to you as an individual is if we have all been lied to about how everything is "anonymized" data being sent between the data brokers and sold to corporations. I've always assumed that the whole narrative about all this data being anonymized was complete and utter bullshit.

Now we know with certainty.

[+] staticautomatic|7 years ago|reply
The companies that sell your data non-anonymously to brokers have always (unless they're shady af) said somewhere in their T&C that they will or may do so, and the brokers themselves have never said the data are anonymous (unless you're talking about the ad targeting space).
[+] 1996|7 years ago|reply
> The company, owned by the massive UnitedHealth Group, has collected the medical diagnoses, tests, prescriptions, costs and socioeconomic data of 150 million Americans going back to 1993

I think they just use their point of sales (primary care, etc) to collect data from the client and use it against the client. I know because I used to be in a very similar line of business.

It is easy because clients give you a permanent unique id for payment purposes (ssn), or other unique id (phone numbers) that varies with time (now less with people porting their number). Of course, the point of sale has a list of previous items, even from competitors (medical history) but that has become harder to use, due to laws. Still, most places ask for "emergency contact", which you can use to build a social network. Sick people cluster together. I don't know why, it just happens, and it is a good workaround.

Of course, you need enough data, but it is then a matter of scale (if you have 75% of the market, you have seen everyone in a county at least once) and trade (buy the same data from your competitors).

Personally, due to experience, I prefer to forego insurance and get my healthcare abroad. Better prices than paying deductibles, better services. But I can not recommend that for everyone.

Still this is a dirty business, and I strongly recommend to adopt basic opsec precautions if you get healthcare in the US: never give your ssn, give a phone number that is not used for anything else even better if it is prepaid so not linked to a ssn, never ever give an emergency contact, only list medical conditions that will not cause you legal issues.

[+] 394549|7 years ago|reply
> Personally, due to experienck, I prefer to forego insurance and get my healthcare abroad. Better prices than paying deductibles, better services. But I can not recommend that for everyone.

If you're in the US, that choice could bankrupt you if you ever need major emergency medical care, because of an accident or some condition requiring emergency surgery, like a brain hemorrhage.

https://www.nytimes.com/2017/03/29/magazine/those-indecipher...

[+] dhimes|7 years ago|reply
Exactly why I won't do those genetic-sample tests for "ancestry" or anything else. Eventually, those data will be sold, even if the entire company is sold with it. Eventually, we will be much better at decoding the DNA for predispositions to medical problems like heart disease, diabetes, alzheimers, and so on.

That information will also be used against our kids and maybe our other relatives even if they don't undergo the testing.

[+] supertrope|7 years ago|reply
Data is forever. The Genetic Information Non-Discrimination Act could be repealed in the future. Even governments can change.
[+] jesseryoung|7 years ago|reply
Heard about this article on NPR this morning. Thought the concern was valid but a little on the alarmist end of things.

Most of the data they need to know if you are going to be an expensive subscriber or a cheap one you're required to give them directly: Your age, your gender, your home address and the list of services you received at your doctor's visits that they were billed for.

Both healthcare providers and insurance providers know that the most efficient way to lower your healthcare costs is to get the patient to go to preventive care visits and keep them out of the ER. It doesn't matter how much money you give them each month, if they can prevent you from going to the doctor all together it's 100% (roughly) profit.

[+] lvspiff|7 years ago|reply
I work alongside healthcare informatics and I got to say this is entirely the case from what I have experienced - the less you go to the ER the more the insurance profits. All of our research and data collection revolves around people getting tests and treatment PRIOR to something major happening. Regular bloods tests, proactive bp and a1c monitoring, etc lead to better heart disease and diabetes treatments so you don't go into a crisis. The collection of data allows treatment to be better for the population not to charge a higher rate to specific people. Keeping you out of the hospital is monumentally cheaper than a couple doc visits a year for a couple lab tests.
[+] hirundo|7 years ago|reply
> But patient advocates are skeptical health insurers have altruistic designs on people’s personal information.

It's funny that the article felt this needed to be said. Just how would an altruistic insurance company have survived in such a competitive market?

I think I learned the insurance business model early in life. I lived near a horse race track, and used to collect the programs and assemble giant (paper) spreadsheets with various data on horses and their win/loss records. Does the jockey make a big difference? Does the wetness of the track? I would have used any measure that gave me an edge in betting, with zero "altruistic" regard for the horse, its owners, or anyone else but me. You know, like an insurance company.

It turned out that there was a datum that significantly improved my odds, and converted me from a regular loser to an irregular net winner. And it didn't come from a program. I figured out that I could just watch the horses as they paraded to the starting gate, pick the one that I thought looked like it wanted to win, and could, and ran to place a bet on it before the race started. Far from perfect obviously, and I didn't win big, but I started winning more than losing.

I'd bet that insurance companies wish they could do something similar: Have experienced medical underwriters examine and interview potential customers and then make gut level decisions, then judge more by underwriter stats than patient stats.

But that approach seems to be increasingly prohibited, so they make do with what data they can get. It's hard to find that surprising, unless somehow you've confused "insurance" and "altruism" to be related terms.

[+] stakhanov|7 years ago|reply
I think there's something to be said IN FAVOR of the notion that person A's health risks don't trade off against person B's health risks at a 1:1 rate.

The crucial thing however, in a data protection sense, is that there are too many people who don't realize the implications of giving away data about themselves. A shopper signing up for a loyalty card scheme in a grocery store might sign a blanket waiver allowing the scheme operator to pass the data on to whoever they please to be used in whatever way they want, without thinking about the possibility that it may end up in places where it won't serve their best interests.

So there should be something similar here to health warning on cigarettes. Kind of like "Warning: Signing up for this loyalty card may make you uninsurable."

Also, I think there should be legal infrastructure in place to ensure that there are certain rights that you can't sign away as part of a contract that, in practice, you don't have the option not to sign (like Google's general terms & conditions).

[+] koolba|7 years ago|reply
Which is also why you should use a fake phone number, name, etc for those loyalty cards.

Also a neat trick is to just (XYZ)-867-5309 as someone already signed up with the number from that song and it’s not a real number.

[+] ohazi|7 years ago|reply
Isn't this super illegal? Who are the lawyers at these companies who are signing off on these projects?
[+] throwaway5752|7 years ago|reply
No. Using that data might be. In any case, it's only illegal if the Supreme Court interprets it to be illegal. If you have been following the recent years of Supreme Court decisions/dissents it will not be comforting.
[+] kevin_b_er|7 years ago|reply
What would be illegal? As long as corporate profit is viewed as more important than human health and safety, there will be no laws against such things. The Republican-controlled supreme court likes to rule that corporate "rights", due to corporate personhood, cannot be contained or curtailed in favor of human ones.
[+] mnm1|7 years ago|reply
I wouldn't be surprised if people are denied care and left to die due to exorbitant prices based on random, undoubtedly wrong algorithms. Here's where the cost of personal data really becomes huge, at in life or death. Insurers have played god like this since their inception and nothing is going stop them from making more money by shutting out anyone who is a threat to their bottom line. We've only had a law that prevents discrimination on pre-existing conditions for a few years. I'm sure the insurance companies will lobby hard to get rid of it so they can let the very sick suffer and die rather than be forced to pay for their healthcare. This is an end run to that goal in case lobbying to murder people legally fails.
[+] staticautomatic|7 years ago|reply
I buy data from LexisNexis. AMA.
[+] mindslight|7 years ago|reply
What is the pricing model? (eg per request?) Roughly what is that cost?

Is there an "all-you-can-eat" access level that other organizations have?

How granular are the data fields per record (/person) ?

Do requesters generally cache the retrieved data on their own stores, continually re-retrieve it, do analysis in large batches, or what? Would we expect to see big caches of this data sitting around outside of Lexis's vaults?

[+] 1996|7 years ago|reply
What do you have from the healthcare part now? Drugs, diagnosis, lab test (from the like of labcorps), or just point of sale addresses because hipaa?

How is the data linked? ssn, phone numbers? (just a best guess, in case you spotted some linking anomalies)

Is the primary key still a number internal to lexis nexis?

How detailed is the social network now? (just people living together and neighbours, or does it includes relatives and family members)

[+] 394549|7 years ago|reply
What kind of bulk data products do they sell?

I'm almost certain they are one of the companies that does the legwork to directly ingest public records information from government sources, but I'm unsure if they sell that bulk data on to other companies.

[+] kyrieeschaton|7 years ago|reply
This is complete nonsense and entirely speculative. They admit as much when they inform you they can find no evidence of any individual underwriting decision being made based on this data, which the companies strongly deny, and would be illegal. Insurance is highly regulated, both on a state and federal level. Pricing algorithms and variables are public in most states (albeit obfuscated).

What does seem to be happening is the companies are using third party data providers for marketing and market analysis, as literally every other company from your local HVAC guy to McDonald's does.

[+] stakhanov|7 years ago|reply
There are certain dimensions that it makes a lot of sense to discriminate around: For example, if you're a roofing contractor, I really think you SHOULD be paying higher health insurance rates than I do, as an office worker. You'll just price it into whatever you charge to make roofs, which means the price of a house will start getting closer to what it actually costs the economy. Since I rent, I would otherwise end up subsidizing other people to build or buy houses for themselves, and I don't think that's how an economy should work.
[+] ceejayoz|7 years ago|reply
> For example, if you're a roofing contractor, I really think you SHOULD be paying higher health insurance rates than I do, as an office worker.

Why? Your sitting eight hours a day is remarkably unhealthy, and roofers (at least where I'm located) are typically separately insured for on-the-job injuries.

[+] jschwartzi|7 years ago|reply
Considering how inaccurate some of Fitbit's measurements are( resting heart rate, for example ), I would sue my insurer if I found out they were using that data. My doctor shouldn't be using it either.

RHR is normally measured within the first 30 minutes of waking while lying in bed, which is something Fitbit can determine. What I've noticed is that on days when my RHR that I've measured using their monitor after waking is 54 BPM, they report up to 61 BPM. There's a very long chain on their forum about how inaccurate the measurement is.

[+] brlewis|7 years ago|reply
I work for Fitbit but am speaking only for myself.

I'm guessing that this is the chain you're referring to since it echoes the "30 minutes after waking while lying in bed" claim: https://community.fitbit.com/t5/Charge-HR/Resting-Heart-Rate...

Other sources I checked did not echo that claim. As one commenter in the chain pointed out, RHR is not minimum HR.

http://www.heart.org/HEARTORG/Conditions/HighBloodPressure/G...

https://www.mayoclinic.org/healthy-lifestyle/fitness/expert-...

https://www.health.harvard.edu/blog/resting-heart-rate-can-r...

Also, one of the critics in the chain thinks Fitbit must be inaccurate after his RHR rose from 68 to 71 after "hiking at altitudes up to 14,200 feet" then fell back to 68. I think this criticism stems from a misunderstanding about how altitude affects oxygen levels and how oxygen levels affect heart rate.

All that being said, even if the devices are generally accurate, there are defects and they aren't designed as medical devices. To the extent you voluntarily share your data with a doctor or insurer (which is the only way they'd get your data), your doctor or insurer should treat it the same way they treat other useful but potentially inaccurate information.

[+] dawhizkid|7 years ago|reply
Most people who work for medium or large sized companies in the US are working for companies that are self-insured, meaning your company is taking on all the risk, so if anything your own employer is incentivized to do this and not the insurance company itself.

When I first heard of the Amazon/JP Morgan/BH heathcare initiative my thought on what that company would actually do is surveillance on their collective millions of employees to better predict if they are prone to disease and use predictive analytics to lower their own claims cost.

[+] Spooky23|7 years ago|reply
> When I first heard of the Amazon/JP Morgan/BH heathcare initiative my thought on what that company would actually do is surveillance on their collective millions of employees to better predict if they are prone to disease and use predictive analytics to lower their own claims cost.

...or avoid claims in the hiring process.

[+] shiburizu|7 years ago|reply
As a college student I work taking phone calls for a biz that attends entirely US customer base, my colleague asked why our clients were often leery about sharing things like their photo ID with us, despite being customers with us for many years.

As one of the few who lived in the US amongst us I'd have to say it might have to do with how much companies involved in risk assessment really know about you and how much of it goes to the government -- they have no interest in having us show up in their credit or what have you.

[+] exabrial|7 years ago|reply
That's ok with me? I wish it were like life insurance where they can ask you anything and then you get that rate locked down for the term.

I also actually liked the proposal in Congress that got rejected: allow people to make their own groups. So if you are a person who likes to work out and get your fat levels tested once a year, you could join a group of like minded individuals and insurance companies would bid to insure your group.

[+] u801e|7 years ago|reply
My employer used to provide additional funding in employees' HSAs (Health Savings Accounts) if they participated in a health screening. The health screening involved measuring height, weight, blood sugar, cholesterol and other lipids. There was also a questionnaire about lifestyle choices related to health in terms of how physically active you were, smoking, drinking, etc.