Hacker News Reader

Comment by Barrin92 | Hacker News Reader

I always found that case a bit odd. For one he was blogging under his real name and had made his medical practice known, so you could just google him.

It was upending his psychiatry practice because he blogged, albeit in anonymized fashion, about his patients without disclosing it to them which I'd say is unethical but at the very least in the interest of his patients to be made known to them. I would be pretty pissed if I recognized something I told my psychiatrist on an internet blog. Frankly given how strongly one has to consent to even legally process clinical data I've never been sure if that was at all legal.

When someone's identity is in the public interest an investigative journalist isn't doxxing anyone, they're doing their job. Both true for Nakamoto and arguably Scott

View on HN

He was not blogging under his real name. Scott Alexander is not his real name.

It is his real name, and he also used his real surname in early blog posts.

It is not his real name. Once he upended his life, he revealed his real name here[1]. It is not Scott Alexander.

[1]: https://www.astralcodexten.com/p/still-alive

Scott Alexander are his first and middle names, and Siskind his last name, or that's what I've understood.

It's his first and middle name. At least that's what he said in the post about shutting down the blog.

It's most of his name. Long before his full name became common knowledge, you could already Google "Scott Alexander psychiatrist" and find him almost instantly.

Yes, but a patient who googled his real name would not find his blog. That was the point.

That part of things is what really made this entire argument all apart of me.

There are ~50k psychiatrists in the US. Roughly, 1 in 10k people in the US is named Scott. Mathematically, that means knowing "Scott is a psychiatrist" brings you down to ~5 people. Even if we assume there's some outlier clustering of people named Scott who are psychiatrists, we're still talking about some small number.

Surely adding in the middle name essentially makes him uniquely identifiable without an other corroborating information.

> Roughly, 1 in 10k people in the US is named Scott.

Seems to be more like one in 425 per SSA.

Take a moment and apply some common sense to your math. Do you really think there are 5 psychiatrists in the country named Scott? That's off by multiple orders of magnitude.

No, but I doubt there are more than 100.

The magnitude is so small that anonymity is essential broken.

His pre-SSC blogging was, and he’d link those posts directly from time to time.

> I always found that case a bit odd. For one he was blogging under his real name and had made his medical practice known, so you could just google him.

Cade Metz wrote the article under his real name, and his home address is public information, but presumably he wouldn't appreciate it being published on the internet. Why is that any different?

It’s legal to publish anonymous patient data, doctors do it frequently e.g. in “case studies”. As long as it can’t be traced back to the patient I don’t see why they should care (I wouldn’t). And since it increases public knowledge (e.g. how to treat future patients) I think it’s not only ethical, but should be encouraged.

Doxxing also increases public knowledge, but knowing who’s behind some online pseudonym is much less useful than patient anecdotes (what would you do with the former? Satisfy your interest (or what else do you mean by “public interest”)?). Moreover, unlike anonymous patient data, it has a serious downside: risking someone’s job, relationships, or even life.

Case studies are done with consent, typically. That’s pretty different.

I don’t know how typical it is, but HIPAA explicitly doesn’t cover patient data after anonymization, and anecdotally I’ve had an anonymous case study published about me without my consent (although I was notified after).

In principle, anonymized case studies do not require consent and historically, they were often published without. Without personally identifiable information, this is and always has been 100% legal. But in modern practice, many journals acknowledge that making a case fully anonymous in the age of the internet might not even be possible without taking away everything noteworthy, so they require some form of consent nowadays.

Alternatively they can do what Scott Alexander did and change irrelevant details.

That's not so easy, especially for clinical case studies. If any data points are irrelevant, they should not be stated at all, because they actually might not be irrelevant after all and by arbitrarily changing them, you could confound results. On the other hand, it has been shown that three or more indirect data points can already be enough to unmask you in an anonymized report. And most reports usually contain many more than that. So it's not surprising that journals would cover their backs by requiring consent, even if the law does not explicitly demand it.

It’s been known since at least the 90s that it’s really hard to fully anonymize patient records. You can’t be certain but you can infer probabilities from very little information.

For anyone who disagrees with this statement there’s been a lot of research done in the area.

The NYT has no authority to dox people. If they or anyone believed that SSC was acting unethically or illegally, that should be processed through proper legal or ethical channels, which exist for a reason. The solution is not that NYT should abuse their power to skip those channels.

Reply on news.ycombinator.com