Hacker News Reader

Comment by gpm | Hacker News Reader

> Why not associate each patient with a number then log all data against that? Patient names and other identifying information should simply never be attached to trial-related data

Because "patient name" isn't the only way a patient can be identified.

"Male, 27, admitted to Sunnybrook hospital for stitches to his forehead due to knife wound on January 20th 2022" is almost certainly uniquely identifying (actually it's made up so it probably identifies no one), is in the person's medical data for the trial, and clearly needs to either be redacted or in some other way separated from the other line that says "contracted HIV on January 19th 2022". Yet both are relevant when investigating causes of side effects.

View on HN

I think HIPAA is something we should be re-evaluating as a nation. Back in '96 it was certainly a good idea given how devastating things like an HIV diagnosis could be for a family member in a fundamentalist family. Or the impact of said diagnosis on insurance coverage.

With the ACA, the insurance coverage problem is gone. Pre-existing conditions can't be used as a reason to deny or change insurance rates.

The Fundamentalist problem exists, but seems like much less of an issue with LGBT acceptance being so much better now than it was in the 90s.

I just don't think that health information is so valuable that guarding it like a state secret is warranted. I'm ok with the notion of putting in basic safeguards like not attaching a patient name with the information but I don't see it has horrible if some system can infer absolute identity from that stuff.

After all, seems far more scary that my web browsing generates a far clearer picture of who I am than what you could glean from my medical records.

Having health information public and easy to gather would (potentially) be a significant boon to the study of health information. It would also make it a lot easier for us to make health information sharing systems so you don't have to fill out the same 500 forms every time you go to a different hospital or doctor.

six week old pregnancy terminated while her official partner is on tree month long business trip. instant divorce.

Assuming name isn't attached to the data, that'd require the spouse (or someone else) to do the legwork to link up the medical history.

When I say re-evaluate HIPAA, I don't mean "Hey, let's put everyone's name right next to every checkup and list it in a wikipedia like DB and email relatives about the results of every checkup". I mean "Hey, let's consider limiting the scope of the law and the penalties associated with it". It doesn't have to be a black and white thing.

That all seems like a worthy risk if it enables researchers to find that "Hey, looks like people prescribed medication X with medication Y tend to develop cancer Z way more frequently than the general public" or "Hey, looks like people with gene X respond way better to cancer treatment Y than the general public".

Exact dates and exact hospitals should also not be included. Doctors do not manually write their hospital location and the date in each of their notes (instead these are fields added by software like Epic) so this should be easy to just not export those fields.

There will also be some risk that someone has a very unique combination of visits or treatments that does make them identifiable but that should be an incredibly low percentage and we need to weigh the pros/cons. I can also get a good idea of who has cancer by sitting on a bench outside a cancer center and watching who goes in.

Reply on news.ycombinator.com