Comment by angersock | Hacker News Reader

Comment by angersock | Hacker News Reader

Parent Full thread

So, here's the thing.

We're going to be letting big data and whatnot into health. Every heartbeat you have, every milliliter of blood drawn, even your base pairs will be cataloged meticulously and shoved into a database. So, that amount of privacy/care is gone, never to return.

There are two things that are really worth asking:

Are patients or practitioners the ones who own collected data?

What is the utility of data leaks of non-billing information, truly?

For the first, I rather think we're doomed if we don't legislate that patients own all of their own data and license it back to care providers--basically, treat labwork and everything as works-for-hire with copyright belonging to the patient.

For the second, I think we're going to continue to treat all the health data as super mission critical, which will in turn only cause "security contsultants" to line their pockets further and justify the miserable busybodies in hospital IT that get in the way of progress under claims of "but but but the terror^H^H^H^H^HHIPAA".

We already give away gigabytes of data every year about everything else, so it's kind of silly/sad that we're so protective about arguably the least harmful/most useful data we have.

>> ..which will in turn only cause "security contsultants" to line their pockets further and justify the miserable busybodies..

You obviously don't understand how utterly appalling the security of a lot of software is. My job title is "security consultant" and the last test I did was on a medical related application that tracks medication administered to patients in care facilities. All the sensitive patient data can be read and updated completely unauthenticated. They implemented ALL of their permission checks in the thick client which simply talked to a webservice - anyone with a decompiler and half a brain could alter patients drug doses with no record. This is a large application used in a large number of places.

Maybe we need more security consultants in the medical industry.

Holy shit

There's a lot of really weird systems design that goes on in hospitals, but that doesn't necessarily mean that it is wrong.

The main problem I see is that the security is going to focus on things which won't matter, at the cost of creating still more barriers to entry for new techniques (I may or may not be fighting this battle at my current company).

If your data can be reached by everyone, completely unsecured, that's not a weird design. That is just plain wrong. Security does matter for these things, because human lives and identities are at stake. Health data is far more important than your facebook profile, but it's woefully undersecured. If fixing security problems is "creating more barriers", then so be it, it has to be done.

It's not available to everyone--for example, a lot of institutions don't have wireless (lol) and have pretty strict controls on devices that plug into the wired networks.

what if I break in to the network through a web server? or happen to find an open network port in my hospital room?

Security is done in layers. Physical access is 1 layer, network security is another, requiring proper authentication/authorization for your software is yet another, etc. Each layer stops a percentage of hackers. If you skip important layers like auth, you're allowing a larger number of people in, simple as that.

It's the equivalent of saying "but ofcourse I leave a large pile of cash in the middle of my dining room, my front door is locked, that's secure, right? Putting it in a safe or even a locked closet is just a burden." It ignores basic security principles.

No it is available to anyone with an internet connection.

What is the utility of data leaks of non-billing information, truly?

Blackmail. Deposit 10BTC at address X, or we'll tell everyone you have $condition.

Far more commonly, well-organized criminals use the info to fraudulently bill medicare or an HMO.

So what?

If the problem is that you have a condition, people should be supportive regardless--that's what we should be fixing.

There are more pressing and more troubling violations of privacy that occur as a matter of habit, so whether or not I've got $TERRIBLE_DISEASE doesn't really matter.

Except it's not about $TERRIBLE, but about $ECONOMICALLY_RISKY.

You know this, I know this--we should be fixing that part of the system.

We have technical solutions to data security problems.

What solution do you have for prejudice?

That some conditions are economically risky is not a prejudice, that's my whole point. Choosing the healthier person for a position is a perfectly rational thing to do, and increasing insurance rates with higher risks due to their health situation also is perfectly rational (and note that that's not just limited to health insurance) - you'd have to turn the whole economic system on its head to fix that.

Actually it's unknown whether it's the rational thing to do. It is only rational given a narrowly defined self interested actor making the choice, but that actor cannot know whether they are participating in a tragedy of the commons situation and undermining the overall environment (of employable people) in which they must grow and function.

The fact that selfish actors can sometimes do more harm than good in the pursuit of their interests is the reason we have regulation.

Thanks for writing it down, I couldn't be bothered ;-)

And not only could the particular actor destroy their own environment of empoyable people in the long term, they also through some bad luck could get into a position where they themselves end up in the role of the (un)employable people, which also might make it "long term rational" to hedge against that by supporting a different culture. So, yeah, I meant only that self-interested actor with a particularly short time horizon.

...teaching people not to be prejudiced?

It's a better solution.

(You could've replaced "data security" with "lawless minority" a few decades ago, and made the same--repugnant--point.)

I am not making a 'repugnant point'. I am in complete agreement that it would be better to fix social problems like prejudice and bigotry.

The point I am making is that we don't know how to fix those problems quickly. In the meantime people are being hurt by the consequences and you are asking us not to protect those people. I think if anything qualifies as a repugnant point, that does.

And no, you can't meaningfully put 'data security' in quotes and compare it to 'lawless minority' and act as though it is some kind of totalitarian repression. We are talking about stopping people's medical records from being hacked so easily. That is a practical and reasonable problem to fix.

Reply on news.ycombinator.com