Hacker News Reader

Comment by jeremyt | Hacker News Reader

I actually think that medical records are basically public. It's only a matter of time before the various doctors offices or government agencies or private companies that hold these records are hacked and the records released on the Internet.

That said, I would definitely trust a private entity with specialized knowledge over the government or individual doctors offices, so I wish you the best of luck.

For example, I just had my medical records sent from an old doctor's office, and the only thing they required was a fax with my signature on it and an address to send the records to. Could have been sent by anybody to anywhere, and there were no checks whatsoever.

View on HN

The difference is that the old manual system is not so prone to mass data breaches.

My employer used a service called NoMoreClipBoard. They enrolled everyone enrolled in a health plan, not just those who requested it.

When the inevitable data breach happened, everyone was affected not just those who had specifically enrolled for this service.

I don't ever want my medical records in any internet-facing system. I realize that's a fantasy but I'd never voluntarily help make that happen.

FTA: We use another YC company called Aptible. They’re experts in securing protected health information, and we follow best practices to make sure our servers are safe.

It's not just the security of the servers. Many data breaches are the result of careless handling of data (USB flash drives, laptops, email attachments) and social engineering attacks.

Hi ams6110 - we also use Aptible! It is definitely true that the old, fax-based system is not so prone to mass data breaches. That is one of the reasons why hospitals still use fax to transfer medical information.

But, at PatientBank, security and privacy of our patients are our top priorities. So, we go above and beyond what HIPAA recommends in terms of security best practices. You can read more about that here: https://www.patientbank.us/legal/hipaa

The concern, I think, is that all the leaf nodes outside of your direct control also need to be secure. All the nurses, doctors, and other caregivers with access to the system need to be prevented from exposing that data. Is it possible for that data to end up on USB drive? A laptop? Sent in plaintext anywhere? etc.

The protection needs to be automatic. Training people is a "good intentions" solution, and will always result in failures. It should be mechanically impossible for the data to escape in a way you do not approve of.

This data is worth too much to be fully secure ever imho.

And it's not like it expires. You can change your credit card number, you can change all your leaked passwords, but you can't change your past. Once it's breached it's out there until the end of tech.

> I don't ever want my medical records in any internet-facing system. I realize that's a fantasy but I'd never voluntarily help make that happen.

This! I would pay even a premium for non-digitalization.

Reply on news.ycombinator.com