Hacker News Reader

Comment by specialist | Hacker News Reader

I've worked on both election integrity and electronic medical record exchanges. I care very much about privacy.

Your conclusion is correct.

Medical records cannot be encrypted so long as demographic data must be stored in plaintext. Otherwise how would we do record matching (linking) across heterogenous systems?

The fix is to use universal identifiers. Once you moot the record matching problem, you can use translucent database techniques to anonymize patient data.

I don't expect the USA to adopt an official centralized universal identifier for people any time soon. And none of the 3rd party solutions (NSA, LexisNexus, ChoicePoint, Facebook, etc) are acceptable, for various reasons.

View on HN

Homomorphic encryption, anonomized data coupled with metadata, searching via k-Anonymity models.

I mean, sure it has a cost, some of this stuff is new, but to say "cannot be encrypted"... that's where the fun is- working out how to do it.

Hold on, even if you keep the demographic data in plaintext, surely you can encrypt the actual HIPAA-protected data?

If you figure out how to do that, please let me know. Maybe there's some new math or tricks since I worked in this domain.

You can meet an at-rest encryption requirements in a lot of environments by flipping on disk-level, filesystem-level, or database-level encryption where the encryption keys aren't stored on that disk.

Exactly. Google has a nice internal solution where data at rest is encrypted with a record-unique (or bucket-unique) key and a separate system decides whether to give you that key based on whether you give it auth tokens that entitle you to access to that record. That way, having direct access to the datastore doesn't give you automatic access to everybody's data, and all access is auditable. (And data can be "deleted" wherever it has been replicated just by deleting that key for good at the centralized key store).

Obviously, some admins/sres still need to have full access to the key store, but that can be a very small group, as compared to a situation where "every Gmail engineer can read every user's email".

Edit: on reading the summary blurb from the "translucent databases" book link that @specialist posted, what I described above is very much along those lines.

Reply on news.ycombinator.com