McMillan, Acquanette (Netta)
From:
Sent:
To:
Subject:
Megha Bhasin <[email protected]>
Sunday, March 26, 2023 7:58 AM
Official Records - City Clerk
Proposal: City of Pasedena Wellness Mobile App
ISome people who received this message don't often get email from [email protected]. Learn why this is important CAUTION: This email was delivered from the Internet. Do not click links or open attachments unless you know the content is safe. Report phish using the Phish Alert Button. Learn more....
Hi Pasadena Police Department,
Greetings of the day!
Matellio Inc. (referred to as "Matellio") is pleased to submit our declaration of interest to the Pasadena Police Department for building and maintaining a Wellness mobile app for the department members, their spouses, or others. Matellio is confident that we are qualified to assist and guide you through a custom-developed application.
We are a CMMI-certified, San Francisco Bay Area-based software engineering services company specializing in building digital transformation solutions using the web, mobile, AI/ML, loT, and Cloud computing technologies.
Our engineering teams take a product-focused approach that is backed by cross-functional high-quality engineering teams with specialization in UI/UX, DevOps, Database Architecture, Software Architecture, project management, front-end and back-end engineering, manual and automated QA, digital marketing, and more. We have decade-tong experience building custom software that matches our customer's unique business needs from various industries.
We request your kind consideration.
Best,
«^
•
&
Megha Sethi
Sr. Business Analyst
matellio
NAVIGATING IDEAS
^ +1 408 560 1922
[email protected]
[g www.matellio.com
[p 675, North First Street, Suite 1240, San Jose, California 3/27/2023
Item 6
1 RECEIVED
Pasadena Police Department Wellness Related Programs and 2ItS^ti^s27 PH 3: 3^t Wellness App Privacy Concerns and Mitigation
•:;LL,;:<
HfT'
As part of Pasadena Police Department's Wellness Related Programs and Afcti^itieg,'ttie' 'i f£-' Pasadena PD has issued an RFP (2023-RFP-055) for a Wellness Mobile App - "Pasadena Police Department is seeking a mobile wellness app that will provide a variety of mental health services to include but not limited to mental health services, emotional health, emotional support, financial wellness tips and peer support services. The mobile app will be assessible to all police department employees of all ranks and positions."'1
Below, I highlight potential privacy issues and brief recommendations to mitigate potential harms that should be addressed in the procurement process for PPD's Wellness App.
Privacy concerns of digital health & wellness products and services While it is empowering to have the aid of modern tools for better health and wellness, using these tools should not come at the expense of giving up precious privacy and being compelled to surrender sensitive health information. Health and wellness digital products and services collect and share a lot of sensitive information about individuals, who oftentimes don't know and can't control who is accessing this sensitive data. Numerous research has identified concerning practices with the collection, storage, selling and sharing of this sensitive health data.2
In addition, some entities have been found to use misleading privacy claims and predatory advertising practices. Privacy policies and requests for consent fall short, and consumers are not adequately informed of how their information will be used, and therefore cannot make informed consent about the privacy and security of their data. Further compounding this problem is the ever-increasing risk of sensitive health data being exposed in a data breach.
Earlier this month, the sensitive personal data of Congress members, staff and their families was compromised in a data breach of health care group DC Health Link insurance marketplace.3 As a result, people are left with a false sense of security that their data is private, safe and secure-when it is not.
Take fertility app Flo who deceptively assured its users that their sensitive reproductive data was kept private, but in fact, was actively collecting and selling their user's information to third party entities like advertisers.4 Flo is far from an outlier, as many other reproductive apps have also been found to leak user data.5
1 https://procurement.opengov.com/portal/pasadena/projects/31294?section=254351 2https://foundation.mozilla.org/en/privacynotincluded/?utm_source=mofo&utm_campaign=23-dpd&utm_medium=e mail&utm_term=en&utm_content=link_1
3https://www.politico.com/news/2023/03/08/house-members-data-breach-health-00086214 "https://www.ftc.gov/news-events/news/press-releases/2021/06/ftc-finalizes-order-flo-health-fertility-tracking-app-sh ared-sensitive-health-data-facebook-google
5 https://doi.org/10.1145/341 1764.3445132
3/27/2023
Item 6
Yet another example is telehealth and prescription drug discount provider GoodRx who failed to report its disclosure of consumer health data to digital advertisers - contrary claims in their privacy policy.6
Privacy protections are limited
While there are laws that provide some privacy protections, there are still large loopholes that permit the selling and sharing of sensitive health data. For example, digital health apps and web services and products are not necessarily covered by HIPAA. At the moment, the FTC has only just begun with issuing a policy statement on the Health Breach Notification Rule to entities not covered by HI PAA.7
In California, several attempts have been made unsuccessfully to comprehensively protect sensitive health data under the Confidentiality of Medical Information Act (CIMA).8 Instead, the expansion of health privacy in the state has been stow and progress limited. Last year AB 2089 expanded CIMA to cover mental health digital services.9 This year AB 254 - if passed - will further expand CIMAto include reproductive and sexual health digital products.10 This still leaves a lot of personal health data vulnerable to sharing, selling, and exposure in a data breach. One way to bypass privacy regulations is through consent. So as long as a health and wellness provider obtains consent from the client/user, their data is up for grabs. And there are many data brokers in the business of selling sensitive health data with little oversight or restrictions on the further use, sale or sharing of the data acquired.11 Lexipol's Cordico Wellness App
Pasadena PD has issued an RFP for a Wellness App as part of its Wellness Related Programs and Activities.12 The vendor has not yet been selected, however Lexipol's Cordico Wellness App is likely a strong contender.
The Cordico Wellness App offers services that include: anger management, depression, substance abuse, parenting, marriage guidance and financial fitness.13 Some of these offerings are not well protected under current privacy laws. On a s/cfe note - Cordico includes financial education services but not reproductive support services? Surely the PPD has people with wombs on the force, and one would hope they are also a priority for wellness services. 6https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consu mers-sensitive-health-info-advertising
7https://www.hklaw.com/en/insights/publications/2021/09/important-ftc-rules-for-health-apps-outside-of-hipaa 8https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202120220AB1436 9https://leginfo.legislature.ca.gov/faces/billTextClientxhtml?bill_id=202120220AB2089 1°https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB254 11https://techpolicy.sanford.duke.edu/wp-content/uploads/sites/4/2023/02/Kim-2023-Data-Brokers-and-the-Sale-of- Americans-Mental-Health-Data.pdf
12https://procurement.opengov.com/portal/pasadena/projects/31294?section=254351 13 https://www.cordico.com/
Lexipol's Cordico app privacy protections and data security assurances are not readily apparent.
Furthermore, PPD's requirements in the RFP only ask for security compliance and identity theft prevention. Neither of those are the same and neither of them specifically address data privacy of the very sensitive information PPD employees will be divulging through the use of this or any other wellness app. Given the sensitivity of the information being collected about PPD employees, this is a very crucial omission that needs to be addressed in the procurement process.
Protecting sensitive wellness data of PPD employees
PPD users of this or another wellness app should have robust privacy and data security protections. Users should be adequately informed about the information the service will collect, how that information will be used and options to control their data.
The Pasadena PD is in a strong position as a government client to require robust privacy and data security protections from its wellness app vendor. Pasadena PD should require the following:
Provide privacy notice(s) in plain and easy to understand language Provide users with valid and transparent consent mechanisms • Provide the ability to opt out of target advertisements wherever possible Provide the ability to customize privacy settings
Provide information about the eligibility to exercise their right to have their data deleted under the California Consumer Privacy Act (CCPA/CPRA)14 • Require data minimization practices
Restrict the sale or sharing of data with third parties Restrict the use of tracking pixels on anyweb-based platforms15 Yadi
Pasadena City Council Meeting
March 27, 2023
6. Wellness Programs and Activities
14 https://www.oag.ca.gov/privacy/ccpa
15 hltps://www.jdsupra.com/legalnews/ftc-focuses-on-pixe]-tracking-and-not-1645069/