Hacker News Reader

Comment by striking | Hacker News Reader

I would really prefer my health information not be exposed in any way, "anonymized" or otherwise, thanks.

I don't think you realize this already happens. It is already available to hundreds of organizations, both domestic and foreign. Any organization can license it really at a price. What I said would only democratize it, also mandating an appropriate level of anonymization which is currently inconsistent or missing. Also, think of the bigger picture, of the clues such data will yield for advances in healthcare.

Can you link where I can license this information?

If you offer to give $10+ million to any health insurance company or hospital IT company, they will gladly give it to you, plus more fees for updated batches. In practice it will cost much less if you negotiate well. There also are commercial data aggregators that specialize in it, that GPT can probably name for you. (I don't want to name names here.) At multiple employers, I have worked with this data from various vendors.

Which specific vendors?

Not sure if you can license it, but its possible to tap into HIEs for a lot of patient information. Or, if you have a deal with a PBM, you could literally see 100% of all prescriptions issues to americans using the PBM.

Again, i don't think you can license it, but its a data feed that is accesible incident-to providing other services.

You can build on top of that, of course, anyway you want.

I think this is plainly untrue in any of the situations relevant to what we're discussing.

Some "de-identified" health information can be used or disclosed without restriction under HIPAA, but it needs to genuinely not be possible to correlate back to an individual, which I don't think is something that's possible with what you're describing (at least if prior medical history and decisions factor into the execution of the program). Some health information can be released in the public interest (like for research) or for bettering healthcare operations, but that's not this either.

It might be worth taking a look at https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg....

This is excluding stuff like 23AndMe genome sharing / Ancestry.com law enforcement collaboration, which might be what you're alluding to, but I believe it to be irrelevant in this case.

> it needs to genuinely not be possible to correlate back to an individual

What you say is a theoretical goal. In practice, despite good efforts, there is no hard rule imposed by reality that 100% of records will totally remain anonymized.

Maybe it's unclear why I've brought this up. I understand it's not possible to keep everything locked down in a way that prevents my information from leaking.

And as unfortunate as that is, that's not my concern with your original comment.

I do not want that problem made worse. I don't care if it's already kind of bad. I have no idea why the problem already being bad would justify making it worse.

I guess you forgot the part where you're a mortal human, and where biomedical data helps discover patterns to solve problems. Just you wait until you get old. Also forgot the part about exposing statewide corruption wrt claims.

I'm not interested in your snark. I'm aware of my mortality and of statewide corruption. Those are not good reasons to publish my health data publicly even in an anonymized form. The people who might be able to fix my mortality are already allowed to have my data (whether I'm happy or not about that is moot as you've made clear yourself). That does not change my belief that the scheme you propose for "exposing statewide corruption" is a bad idea.

> are already allowed to have my data

You mean the ones that license it commercially? Their interest is not in fixing you; it is in exploiting you and your wallet, so please remember the distinction.

To really fix it (you), access to that data needs to be democratized. But since people (you) don't want that to happen, I guess mortality will remain in the cards. In the end, people (you) get what you deserve.

Yet somehow data brokers know every medical condition you've ever had and they sell it to anyone who will pay them.

https://www.scientificamerican.com/article/how-data-brokers-...

https://arstechnica.com/science/2019/11/would-you-trust-goog...

https://slate.com/technology/2022/06/health-data-brokers-pri...

If this is supposed to be some sort of "own", you're missing my point. I do not want my HIPAA-protected information going any further than it needs to, I do not want these practices to be encouraged. I understand HIPAA etc. are leaky, that people are inventing new ways to leak my information to people who want to buy it, and so on.

That is different from taking the pipeline of information directly from my insurance provider and firing it off into the public eye in a way that prevents it from being deleted or forgotten, even if it may be anonymized to some extent.

I understand the situation is not good. I want it to not be made worse. I'm not sure if you ignored the sibling thread where I felt I made myself clear.

I promise that I wasn't attacking you. More just commiserating over the sad state of the situation we find ourselves in as of right now.

I don't know what the solution to this problem will look like, but (like so many other solutions) I'm also pretty sure that it won't involve a blockchain.

I think way he meant a hashed chain: one where the history is tamper proof. The important part is that the data and logic used to process claim is digitally documented and sealed by hash. You get a copy of the hash in your claims. The hash chain is public or has to be given to an independent third-party. If you get into a kicking contest in court, the company they have to reproduce documentation with the hash. The hashing prevents forging the original documents in the process.

Reply on news.ycombinator.com