Thank you. I hope I get the answers I need.
Thank you for clarifying.
Sorry, I read until “your doctor uses gmail”. Majority of doctors do not give a damn about patient privacy. Even if you tattoo HIPAA on your forehead). Find a way to deal with it on a personal level. Efforts addressing narrow healthcare privacy are pointless when there is a privacy Gargantua that literally shapes thoughts of masses in a way of nullifying their own values including privacy. 4 out of 5 respond with What do I have to hide? When I point out the issue.
OP is trying to make a positive change in healthcare privacy, and this reads as defeatist. Society won’t change until people like us identify social issues and make them known to the masses. While patient privacy is a requirement for delivering healthcare in a safe and dignified manner, and doctors and the healthcare field have responsibility, in a way it’s our job to make doctors give a damn.
Exactly. Even though we’ve got a long fight ahead of us, and we may not win every battle, it is absolutely worth it to advocate for our privacy in healthcare and elsewhere.
Something I forgot to mention in my response to @mnalis’s last comment and I think is important to remind people is that I have had positive experiences advocating for my privacy.
This was the very first doctor I saw over a year ago. Her receptionist didn’t have the answer, but she did. I had completely forgotten about it because most of my experiences have been negative. But this was a very positive one. As I said, she was thorough. She went into details about how they protect privacy, the type of medical software they use, and under what circumstances data can be shared with third parties. So far she is the only doctor who knew how to answer this question, and her answers were not full of technical IT jargon.
UPDATE:
I have written to my local data protection agency (DPA), and I am waiting to hear back from them.
Perhaps you can create a one- or two-page explainer (text, figures, infographic, etc.) that can be printed and handed to practices?
My original plan was to send an email or WhatsApp message with a link after we have spoken in person. It might be a good ideal to have something printed out, but I don’t know if she’ll read it.
I intend to also mention any new discoveries I recently made that supports my argument.
For example moments ago I made a post about how that same doctor used AI in which she entered personal information about me which is is a huge red flag.
Yesterday I shared Amnesty International’s new research on AI documenting how it violates privacy laws and perpetuates discrimination. I intend to mention and share this to my doctor too.
I could also mention how governments like the US coerce countries into sharing over their data, violating those countries own privacy laws.
There’s a lot of good arguments out there. I just have to be as concise and compelling as possible.
UPDATE:
DPA REFUSES TO ANSWER
So I reached out to my local data protection authority (DPA), and they were a disappointment. I wrote to them via email and asked them point-blank if using Gmail and WhatsApp in healthcare was compliant with our data protection laws. I specified that what I meant by that is if healthcare workers are in violation of the law when they use Gmail and WhatsApp to communicate with or about patients.
The DPA refused to answer my question directly. All they did was quote the law to me. The parts of the law that they quoted implied to me that using Gmail and WhatsApp in healthcare is in violation of the law, but that’s just my interpretation. Their answer was very legalese.
I followed back by asking them to answer my question directly, and again they refused. They just quoted the law. And they told me that their role is not to interpret the law, which makes no sense to me, because if I had to file a complaint, it would be through them, and they would decide if I am right or wrong. So it is totally within their realm to tell me if I am interpreting the law correctly.
PRIVACY WASHING & PRIVACY THEATER
To me, this just goes to show that some DPAs and privacy laws are just doing privacy and security theater. They want to reassure the public, but in practice they’re not doing much.
Suppose I asked them a really stupid question like:
I am a doctor. Can I secretly share my patients’ healthcare information with a pharmaceutical company that will pay me handsomely for doing so?
I suspect that they would not give me a legalese answer and would tell me straight up no, that I cannot do that. My guess is because DPAs know that the use of WhatsApp and Gmail is rampant not just in healthcare but in business in general, they don’t want to condemn it. I also suspect that no one has ever complained about this and that I would be the first.
NEXT STEPS: LAWYERS + GO TO DPA IN PERSON
1) Contact Lawyers
My next step is to contact privacy lawyers to see if they can provide me with an answer. I’ve already reached out to some of them, and none have responded so far. My impression of privacy lawyers is that if they don’t smell money, they are not going to bother.
Also, I have mentioned before that almost all the privacy lawyers I have found advertise protecting the data of companies and helping them be compliant. They do not advertise protecting actual data subjects, i.e., people. To me, this is not a good sign, because your interests and those of a company that holds your data are not the same.
And for the record. I have zero intention to sue. I cannot afford it, and even if I could, I do not want to put my face out there. But I would like to believe that a lawyer can answer a simple question about privacy laws without charging me.
2) Go to DPA’s Office
I am not 100% about this one, but I want to physically go to the DPA’s office and ask them the same question. I suspect that if I speak to an actual person, I will not get a legalese answer, but I can’t be sure.
The challenge is, when I reached out to them via email, I did it anonymously.
If I got there physically, I may have to share my real name, and based on the questions I ask, they could identify me as the person who emailed them under a different name because it was quite recently.
Should I go through with it?
I think they also have a phone number, so I could also call them anonymously first.
Up to you.
You can have safe communication via user using @gmail.com e-mail address – but you both have to both use some end2end encryption (like PGP or S/MIME), and they cannot use regular gmail.com webmail interface (but either add web extensions, or download messages via IMAP or POP-3 to their local computers and decrypt there).
Whether they’re educated enough and/or willing to do that is another matter.
Sure, no worries. Life would be awfully boring if we all agreed on all things 
Which is a problem. Privacy is huge moving minefield in today’s world, that even when you’re an expert you’re going to have a hard time surviving it without major losses. The more you know about how stuff works, the more worried you’ll be and more time you’ll be using in trying to defend, with no guarantees it would help. 
You mention the jargon, and I agree. But you used some it yourself - “E2EE” is jargon too, and yet we expect doctors to know answer to that. But the problem is, that one acronym is just a tip of the iceberg, and nowadays it won’t help much by itself.
Even with E2EE, many thing could (and does) go wrong:
- encryption used may be obsolete (easily broken). At least in EU, there is mess, where GDPR requires stuff to be encrypted, but does not state standards. So, you have to know what standards they use, and if they are “state of the art”. So you need more jargon like “ISO/IEC 27001” or “FIPS 140-3” etc.
- even if they use proper encryption protocol, its implementation might be (and horrifyingly often is) flawed (e.g. reusing nonce parameters or similar). You need your doctor’s office to have full source security audit performed on all their software (and be able to read it) to have any insight into it.
- even if they use encryption protocols which are fine for today, and use it in proper manner, is it future-proof, i.e. does it employ perfect forward secrecy? Does it employ post-quantum crypto? Because, it is not really privacy for medical data if all encrypted data collected today can be easily decrypted in 5 years.
- software might have bugs. Shocking, I know.
But there are even worse things for privacy then encryption when transferring data between doctor and the patient (which you could BTW easily ensure by minor inconvenience of not leaving any e-communication contacts and insisting on exchanging information exclusively by coming in person and getting diagnosis in dead-tree or other physical format only).
For example:
- what is the “end” in that E2EE? Let’s say they use Office365, “End” is not really at their local computer, but more at Microsoft servers. So guess who can see the data except you and your doctor?
- how about if they do store data locally, but use, say, Microsoft Windows 11? Heard about that snoopy thing called “Recall”? It’s disaster for privacy. Yet what is the chance your doctor is using for example GNU/Linux or FreeBSD? Slim at best.
- where is patient data stored? Likely, in some completely unencrypted database on some “cloud”. Or at best, it is “encrypted at rest” (which won’t help you one bit as it is basically never at rest), and/or encrypted with hardcoded key in app (which is just security-through-obscurity, so won’t really help either). That whole database of all patients is more likely to leak then not given enough time. And this is not hypothetical, it happens all the time. What is most infuriating, when it happens, companies at best get a slight slap on the wrist, if even that. They just publish “we are so sorry that happened, we care about your privacy”, and then continue their sloppy practices unabated.
- How about “Agentic AI”? Heard about those yet? If not, no worry, “regular” AIs are bad enough, and people will gullibly copy/paste your private patient data into them in 2026, not to mention few years down the road. “Agentic” stuff is just 100x times worse, as it will do all of that without any input of human operator. But it’s “more efficient” so some collateral casualties (like, last remains of your privacy) is already accepted sacrifice to the Gods of Profit. Even if operators are careful not to do that, almost every OS and app maker in the world is trying hard to give you AI you can’t disable which by definition needs to scrape all your devices for all your data, and has horrible security track record.
- what is their operational security? If not good, their communications are going to get compromised, and all that data is going to be stolen and resold. Do they have at least ISO/IEC 27001:2022 certificate (more jargon I know)? It is not be-all-end-all by any stretch of imagination, but it does show they are at least trying to show the bare minimum of caring.
And I could go for dozens more points…
But my point is that (while it is commendable that you go to extra effort to ask those things!), unless you become expert yourself you won’t be able to tell exactly how bad their specific situation is (well, theoretically it could be good too I guess. It is just that the reality haven’t been giving me much cause for optimism last two decades).
Problem is that when enough people ask them such questions, they’ll learn what are the “correct” words they need to say to appease the people asking (even if they don’t reflect the reality). And, unless you can independently confirm their claims, just believing those words is not much improvement over just believing their generic words that “they take all the appropriate measures to protect your privacy”.
I don’t know how lawyers (any kind) work in your country, but over here, you usually pay them per consultation, so they’re likely to take your case regardless of the chances of winning (should you continue to sue).
I don’t know it if would even be legal. In jurisdictions I’m aware of, you need to become their client before they can give you legal advice; otherwise they can be disbarred.
And becoming their client usually involves giving them money (unless in rare cases when they smell the blood and agree to work “pro bono”, expecting much bigger payout from certain-to-win case. But unless you’re going to sue, it is unlikely they’d agree to work pro bono. Doesn’t hurt asking, though).
Yeah, I don’t think asking anonymously is going to work. I wouldn’t “ask them a question”, that sounds like a wrong approach.
You’d need to file a case with them by enumerating how exactly a doctor violated your privacy rights, and require them to take action to force doctor to compliance. You’d need good knowledge of law (or preferably privacy lawyer) to draft that. And you would need to reveal your identity and exact circumstances, with exact timing, copies of unencrypted email etc.
Thus DPA would (should) then be forced to either:
-
take action (if in their own interpretation the law has been broken), or
-
answer you that the doctor hasn’t broken the law (again with their own interpretation) and that they aren’t going to take action.
That being said, I personally would change a doctor after that. Unless you’re confident that their upholding of Hippocratic Oath is not going to be budged by financial loss and other trouble your complaint has made them.
As you’ve elaborately demonstrated, there are definitely levels to getting privacy right in an organization. I could see how this could easily overwhelm someone. That being said, there are many services that help businesses be compliant to privacy laws.
Maybe every business should have an IT department, or at least an IT service they use regularly. This is probably a terrible reference, but I remember that in the legal drama Suits, they had an IT guy in the law firm.
Now that I think about I have a software engineer friend who works for a major newspaper and he doesn’t even live in the city of where the newspaper is based. He works completely remotely.
Given the complexity that you articulated I wonder if regular privacy audits should be mandatory for every organization big and small, the same way all restaurants have to get certified and regularly audited. At the same time, I could see many IT and legal services using this as an opportunity to make money, and hence being more motivated by profit than by offering sound security and privacy services.
Yes, I get that. But at the same time I find it ridiculous that I should pay a lawyer to find out if murder is legal. I should be able to get an answer without having to sign-on. I wish the information was easily available online, but it’s not.
Many times, if you search if Gmail is compliant to a specific country’s privacy laws, you’ll get an AI answer that says no, but then you look at the AI’s source, and it’s from an American website talking about American privacy laws.
This is another reason why I don’t trust AI. For any question, many times they quote American sources, referring to American laws, when the question was specifically about another country.
I would hate to pay hundreds of dollars just to know if the law is on my side or not. I have a few friends who know lawyers, but those lawyers are not privacy / IT lawyers. But I’ve asked those friends to ask their lawyer friends if they know lawyers who are specialized in privacy and privacy law compliance.
In the past, I have had to deal with lawyers for other unrelated issues. And usually, we speak on the phone first and I get a lot answers to my questions before making any decision on whether I will hire them. I’ve had this experience with 2 lawyers that I never hired, but seriously considered to, as we were in talks, and our conversations were very fruitful despite not me hiring them.
Just as a reminder, I was talking about the data protection authority (DPA) here. Not lawyers. If I intend to file a case with the DPA, I could understand the need to disclose my identity. But I don’t think I should have to just for asking a simple general question. If I go into a store and ask what the price of an item is, I don’t expect to be asked for ID first or even my name.
I hear you on this. But in my opinion, I should be able to file a complaint with any business or health organization even if I was never their client and they never violated my privacy.
What I mean by this is that the moment a doctor’s Gmail and WhatsApp are visible on their website and business card, that should be grounds enough for a complaint, since they are likely, already breaking privacy and healthcare confidentiality laws. My doctor did not have a privacy policy section in her medical forms, which to my understanding is a requirement.
UPDATE #2:
One privacy lawyer got back to me and told me that the law is likely on my side, especially if the healthcare worker/organization did not ask for my explicit consent to use Gmail or WhatsApp.
I would imagine that some patients may not realize that by signing the medical forms they consented to the terms, but IMO, that could still be challenged, especially if the terms are not clear.
Be that as it may, I have already mentioned that when I read the forms, I specifically looked for any mention of privacy policy, and there were none. It was my first time filling a medical form where there wasn’t any mention of it. And when I inquired about it to the receptionist, she just gave me an oral guarantee of confidentiality even though they openly use Gmail and WhatsApp.
LAWYERS ARE EXPENSIVE!
The response from the first lawyer who responded to me and actually answered my question was very brief. They also told me that they would have to look into it more thoroughly if I wished for a full consultation and quote me their hourly rate. If I could afford it, I would totally pay for it, but I can’t, so I guess that’s the end of that. I do find it silly to have to pay someone to find out where a privacy law stands because the answer is not readily available online.
MAKE FRIENDS WITH LAWYERS
It’s in times like these when it’s really useful to have lawyer friends, and unfortunately, I don’t have any. But even if you do, if your lawyer friend is not an expert in the issue you are trying to investigate, they might have taken the time to investigate, which could cost you money, depending on how good your relationship is with that person.
I am still waiting to hear back from more lawyers and have not exhausted the list of privacy attorneys I am planning to contact. Let’s hope more are kind enough to give me a straight answer.