Hacker News Reader

Comment by ferros | Hacker News Reader

I wonder what it will take for data security to ever be taken seriously.

I'm reposting a dead comment by photon12 which was probably killed for using too many profanities. I agree with this part:

> It's a collective action problem that needs collective action. Individual incentive changes aren't going to cut it. Unfortunately many thought leaders in the industry have tried to build a culture of suggesting that the solution to collective action problems is individual iteration.

Well somehow PCI compliance seems to work well enough for credit card payment processing. But what happens is, the payment handling is passed off to a vendor, so not every company has to get things right in house.. I wonder if that can be a solution here.. medical data is handled by external vendors.

PCI compliance works because of the aligned financial interests of the actors.

Most kinds of compliance are linked to legal costs as the ultimate source of consequences, not so for PCI.

The ultimate costs for failing to comply with PCI are the actual costs of card fraud which don’t depend on anything in the legal system. When your regulations are designed and enforced by the entity that actually loses money when they aren’t followed, motivation lines up and they work better.

Good point. It seems like it might be hard for regulations to be designed and enforced by the losers of personal medical data leaks.

Credit card data is relatively small cardinality and easy to predict the form of.

Medical data is... not that

This is the other side of the coin of "everyone can be a coder after a few months of self-study". We eschew the idea of licensing and the result is the general public suffers under technical incompetence.

Even well-trained engineers engage in brazen acts of insecurity and data-harvesting because a lot of money can be made doing it. Just look at Facebook’s business model and breaches. They probably have more Stanford grads than boot campers.

That's a strawman. You can have competent people working on these systems and still have breaches occur.

Of course you can have data breaches even if you do everything right. But it takes incompetence to do everything wrong, especially when it involves medical records. The fact that this low hanging fruit of data leaks keeps happening is telling.

Enforcement of monetary penalties.

In this instance the company can declare bankruptcy and the founders and investors can move on to their next gig - perhaps even throw a hapless developer to the authorities. Unless hippa somehow has special provisions. They need to go after the personal wealth of founders and investors to make this a serious crime.

That's the thing.

If HIPAA could pierce the corporate veil, this could no longer occur. Wanna dick around and not do your job as a founder / investor? Your personal assets are on the line.

I don't think this is the case. Last I read up you are personally liable for HIPAA violations. If you do something, knew it wasn't something you should do, and refused to fix it, stuff gets really bad.

To stay safe with medical data, however, you basically just need to hit whatever standard you think is reasonable. There's no established standards other than:

    1. "PII" encrypted during storage/transfer.
    2. Customers can request a download of their data.
    3. Customers can request you delete ALL their data.
    4. Fast track sec fixes above all other company goals.

Someone with a medical license and the legal ability to collect and secure data gave it to these clowns who clearly had no idea what they were doing.

My guess is the blame lies with insurers, probably keen to automate detection of "fraudulent whiplash claims" based on "the data". They'd get access to the records via their claims. This incident should show why sharing of data needs to be on a "need-to-share" basis by default if we want to have any hope of trying to stop this kind of thing in future.

Reply on news.ycombinator.com