Hacker News Reader

Comment by robertlagrant | Hacker News Reader

It's true that the UK public sector could save insane amounts of money by working together better (e.g. 150 NHS trusts should not all be procuring their own systems, but they do - or rather, if they do, they shouldn't be complaining about a lack of money).

It's also true that Palantir should be nowhere near this, both from an infosec perspective and a "why do we keep giving money to US companies?" perspective.

I've thought quite a lot about how to establish key software infrastructure in the UK, particularly regarding EHRs. Has anyone else (Louis Mosley no need to respond)? How do we do it? What challenges/benefits did you spot?

View on HN

We should not be giving money to these mega corps because that also implies giving them our most personal health data. For sure they'll say that we can trust them — maybe it's even true right now, but that can change on a dime, and I don't want to have no option but to trust a crook with no way to pull our public money and my personal data out.

We do need to make things more efficient. But it's lazy of us tech types to fall for centralisation in its most naive form — centralisation of personal data storage always comes with huge risks. We overstate the benefits, and we're not around to pay the price when the benefits fail to pass and the hidden costs creep out.

Instead, we should be pushing the health record out to individuals, and away from the centre. We should own our own data — perhaps it should even reside on our own device. Our governments should be pushing to store less data, not more.

> Instead, we should be pushing the health record out to individuals, and away from the centre

One of my observations was that trusts think the opposite. I was in a call with one, and I said at one point, "Of course, the patient is the Data Owner" and I was corrected by a trust staff member who said, "No, the trust is the Data Owner".

Because - as I learned and saw later - trusts will sell data for studies. So they want the data.

Yes, however in the UK and EU the patient is the Data Subject and has legal rights on what processing is done with the data about them.

see "even true right now, but that can change on a dime" above ...

They have legal rights until the data is detached and deidentified.

It rather assumes you could enforce them. Those rights will be great against a responsible outfit. But if the data is exposed in a breach, or if the outfit goes rogue (or if a future government decides to change the law and sell your data, as, by the way, the previous Conservatives tried to do), then you're lost.

What's the selling data you're talking about different to what I just described?

Heh. Perhaps not really that different at all.

I thought you may mean that the legal rights provide protection, so one need not worry until deidentification or detachment. Maybe your emphasis was same.

But for clarity, I think we need to worry long before deidentification and detachment — basically the Trusts are not to be trusted, and our legal rights will vanish in a heartbeat.

My favourite anecdote on health service bureaucracy - a few years ago significant other worked for local NHS trust using software A to record all their interactions with service users. Trust decided to migrate to software B, and spent significant time and money migrating data from one to the other.

Mere months later, the service contract is won by the neighbouring trust. Their standard system is, of course, software A!

Migration happened in reverse, but without budget to move historical records back over. Staff were left scrabbling around manually copying data for current cases from one system to the other…

Why is it up to Palantir to make this suggestion rather than other (local) parties?

I don't think I understand the question - I wouldn't say it's up to them in particular.

Why isn’t anyone else (with a local stake in the issue) coming up with the solutions?

It's not? They just try to sell their wares.

Politics.

Palantir are operating nationally, and have the government’s ear, as does delloitte. They also have the expertise, time and motivation to write out a plan for making things better, rather than local firefighting.

After all, who are you going to listen to? one single admin in a trust somewhere, or a very large data company who you've paid lots of money to do all this stuff?

"Local" parties (tories) split NHS trusts into smaller pieces which heavily impacted efficiency (Scotland IIRC escaped it)

It's not the number of trusts that's the problem - it's the massive trust-based pushback against centralisation. Remember NHS Digital? NHS England? Things keep being established to try and centralise for efficiency, and it's not working. My observation (caveat emptor) is that trusts push back so hard, and aren't necessarily staffed with technical top performers in the first place, and have such misaligned incentives to centralisation from IT to doctors to everything else, that it can't happen.

They way I read it around here, those trusts would love it very much to get a healthcare system similar to the US one. Aren't they already well on the way?

I don't know - what do you mean by "healthcare system"?

I see it as a case of forced decentralisation leading to bad incentives. When you had few NHS trusts covering entire UK, you could easily handle common issues because their scale matched close enough to cover entire vertical slice.

Now you have trusts cut in size creating incentives against cooperation if only because of how funding is going to be arranged, and even if there's centralised service like NHS Digital... it's not the entity that is going to fight for budget for trust-local employee training and support needs.

> Why is it up to Palantir to make this suggestion

It isn't but also people have been saying this kind of thing for years and it just doesn't get anywhere or make the news.

e.g. https://publications.parliament.uk/pa/cm200607/cmselect/cmpu... from 2006 is all about « The National Programme for IT in the NHS (“the Programme” or NPfIT) was set up to provide such services, using centrally managed procurement to provide impetus to the uptake of IT and to secure economies of scale." »

> The National Programme for IT in the NHS (“the Programme” or NPfIT)

That programme definitely made the news because it was a ludicrously expensive disaster. Some useful things came out of it (e.g. better hardware and bandwidth for trusts) but so much money was wasted. It's one of the UK's most famous failures.

It's good you bring it up, though.

IIRC there was talk of that being a disaster because they wanted to avoid giving the contract to one single company and mandated it was split up with different companies doing different bits.

So they deliberately sharded the contract and so there was endless bureaucracy and politics and blame-gaming between the companies who are normally competing against each other for work and so on.

It's kinda interesting really. I don't think it would have gone much better if a single company did everything as the often seems to be a clusterfuck regardless (example: post office horizon system)... Then you look at a big company like meta or Google and they're churning out systems that pretty much work and at huge scale.. are the people incompetent at consulting companies? Are the customers incompetent? Perhaps there are a million legacy dependencies that needs to be dealt with (but that is true with meta etc al too).

Interesting interesting. I know freelancers whose line of work is basically to get contracted in while Fujitsu or Accenture or IBM or whoever is there doing work, and basically just try to stop them pulling the wool over the eyes of the clients. Their whole careers have basically been calling bullshit on consultants.

> Then you look at a big company like meta or Google and they're churning out systems that pretty much work and at huge scale..

They are but they also have a margin for breakage that, e.g., the NHS doesn't really have. If your Facebook or Instagram feed is missing everything from the last 3 days because a node went down, they can fill that in with other stuff and you might not even notice. Same with stuff missing from Google Search, etc. If stuff is missing from your medical notes because a node went down, that could be fatal if you're just about to have a procedure done. Same with, e.g., tax records, police records, etc.

I guess financial institutions are the better option (but again they still have a bunch of "reconcile stuff at the end of the day" options that don't necessarily translate to the NHS et al.)

I think if you saw the volumes of emails sent inside a trust from IT saying that things were down or back up, you might be surprised. Google and Meta have insanely better track records and standards for themselves, because they have more money and more of an incentive to be working. Meta created a planet-scale messaging service which just went live and worked straight away under full load. They have insane testing ability and desire.

> "why do we keep giving money to US companies?"

What is a US company, and what is the disadvantage for UK people that money is paid to a US company rather than a UK company?

Are you arguing for protectionist tariffs to support local wages?

As a UK citizen, my concerns are that U.S. companies are difficult to trust with PII data as they're not really covered by a sane equivalent of GDPR that I know of. If they do break UK law about how they treat our data, then there's a good chance that the U.S. administration may step in and tell the UK to get lost and start imposing punitive measures against us.

There's a remarkable lack of trust over here now with regards to U.S. companies.

This is a bit of recency bias, I think. Privacy Shield, the regulation governing US<->EU (and then, UK) data transfer, was struck down in 2020.

Its replacement is on the table between US<->EU, and, hilariously, here is Nick Clegg (yes, that Nick Clegg) from Meta talking about it:

> the deal “will provide invaluable certainty for American & European companies of all sizes, including Meta, who rely on transferring data quickly and safely.”

I don't know of any news for US<->UK data agreements, but I haven't been keeping track.

Reply on news.ycombinator.com