Hacker News Reader

Hacker News

Comment by tcoff91 | Hacker News Reader

Full thread

tcoff91

Digitized therapy notes just seems like a really bad idea.

View on HN

I used to date a therapist. She left her patient notes on a train more than once in a year! YMMV

Still much preferable to an unsecured online database, no?

Not when they get lost.

The likelihood of patient files being found on a train and mass exploited are really low. Most people would either try to do the right thing or just trash them. The average train rider isn’t looking to ruin someone’s day.

The same cannot be said for the average unprotected database scanner.

While unauthorized access to therapy notes is bad, I think there's a difference in scale.

You probably don't bring all of your notes from your whole practice with you on the train to lose. If you do bring some of your notes with you and leave them on the train, there's a good chance they will be returned without being accessed by the returner, or be collected as trash, again with no access. Even if there is some access, it's less likely that they'll be widely distributed, because they'd need to be digitized or otherwise copied first, and that's a lot of effort.

If the person who picks up your notes on the train is nefarious or even maybe just curious and happens to know the people in your notes, there's potential for negative outcomes for your patients, but IMHO, the probability of a negative outcome for patients given an incident of unauthorized access is lower with paper records than digital records. I don't know if I can really opine on the probability of unauthorized access --- digital records open up the possibility of more effective controls on access than a filing cabinet; you can't audit which records were read when an authorized person opens a cabinet to get some records and looks around at others.

And in my city an IT worker left a laptop with the encrypted health records of approximately a quarter million people in a ln unlocked car where it was promptly stolen.

That's a quarter of a million people who never explicitly consented to their records being digitized in the first place given to someone who they've never met for them to just leave it somewhere to be stolen.

That's the difference in scale and consent of a digital record system and non digital.

>encrypted health records

Not a problem then?

damn, It was early when I wrote that. I meant unencrypted.

It gets worse. The latest trend in healthcare is to use AI written patient journals based on the computer listening to the conversation.

I asked a potential MD, politely, to "please remove your iWatch and iPhone, at least during our initial consulation..." and was met with an immediate retort of "being paranoid."

The recent controversies about online (and even genAI) psychotherarpy have largely left many to suffer unaided, out of fear of hacking or selling of their most secret of secrets.

I don't know that it's going to matter too much, in the end? There's a plethora of other "metadata" surrounding a patient's encounter with the therapist that isn't therapy notes, enough such that you can probably infer a good deal of what might be in the notes from the metadata. E.g., things like their reason for even engaging the therapist in the first place is probably basically the thesis for most of the session & notes. Enough to extort the person, I think.

So are automobiles and 120V AC current, but we use both because they are convenient.

I don’t have much sympathy for the inconvenience of therapists charging $300/hr+ per session.

You have a therapist? That must be nice, there's a shortage of them, none of them are taking new patients, and they can charge whatever they want, and use whatever tools they want.

Yes, I had a therapist. I paid $200 per session each week.

What's your rate?

Sure, then pedantry - Digitized therapy notes are a bad idea, while "digitized" generally continues to mean some bucket-of-stomach-fluid EMR vendor's obtuse SaaS (Software Augmented with Arbitrary Surveillance) webapp running on SaaS Google Ads Chrome on top of SaaS Microsoft OG-negligence Windows.

It's like if "automobiles" all had cell modems in them, ran some minimum viable functionality Swiss cheese security embedded software, could be remotely controlled from the Internet, and the only things keeping mass destruction at bay is the lack of documentation and the fact that individual humans generally don't want to hurt one another. uh, maybe I need a different example.

> It's like if "automobiles" all had cell modems in them, ran some minimum viable functionality Swiss cheese security embedded software, could be remotely controlled from the Internet, and the only things keeping mass destruction at bay is the lack of documentation and the fact that individual humans generally don't want to hurt one another. uh, maybe I need a different example.

And nobody outside of Hacker News cares about any of that. All they care about is getting from point A to point B, never mind that ~1,300,000 people are killed by by crashes every year and that we're poisoning our planet with them[1].

It's possible that I chose them as an example deliberately and cynically, as opposed to pedantically.

---

[1] Both of which are far more pressing concerns than some Martian super-hacker pwning my car, but it's all worth the convenience of not having to get into a bus, or on a train.

Reply on news.ycombinator.com