7 ms·

Having worked at a large company that cares a great deal about COPPA, I've seen how regulation really can work for consumer benefit. I'm not sure if people appr

• econochoice 8y ago
  Agreed. Rare instance of corporate and personal interests aligning and what not.
• alkonaut 8y ago
  Agree. And anyone who sees a business opportunity in a shady area where basically “regulation hasn’t kept up with tech” just deserves to have the rug pulled from underneath by regulators. The message to the next company should be “if it seems shady, it’s probably not worth trying”.
• maxsilver 8y ago
  > I've seen how regulation really can work for consumer benefit. I'm not sure if people appreciate how much COPPA cleaned up in child privacy Yes absolutely! Similarly, HIPAA has been incredibly useful in forcing hospitals and other for-profit companies to at least kind of care about medical data security. It's not perfect, but without HIPAA that data privacy/security would be in a far worse state.
  • bovermyer 8y ago
    Addendum to this: HIPAA told us (engineers who work in the health space) what to do, and HITECH told us how to do it. Both are useful.
  • Nuzzerino 8y ago
    To play devil's advocate: Without HIPAA, health care costs in the US might also not be multiple times higher than in other developed countries. I have worked multiple jobs in the health sector, and it seemed as if the vast majority of the overhead and time spent was for the sake of complying with HIPAA.
    • vkou 8y ago
      The reason health care costs in the US are ballooning is not HIPPA. It's the Byzantine system of who pays for what, how much, and why, where nobody has an incentive to make care cheaper. See: * Why nobody can itemize a medical bill. * Why a bag of saline may cost the patient $100. * Why an in-network hospital will bring in an out-of-network independent contractor nurse to assist an in-network surgeon, leaving you with a $200 bill for the surgery + a $5,000 bill for the out-of-network assistant. * Why nobody will tell you how much a procedure will cost, with, or without complications. * Why nobody knows how much your insurance will pay for, until the bill is due. Often months after the procedure. Compared to all of these problems and abuses, HIPAA seems the least of America's problems. I'd like to contribute to reducing the cost of care, by shopping around for more efficient/more affordable/better dollar for value doctors/hospitals, but I haven't the foggiest idea of where to start. It's like going to a car dealer, saying that you want a Prius, and not knowing what the age of the car, its condition, or how much you will be billed for until after the title is irrevocably transferred to you. Oh, and the dealer across the street will happily sell you one for half what you paid for. Or double. You really have no idea.
      • devmunchies 8y ago
        > nobody has an incentive to make care cheaper. Companies who act as the insurance company and the care provider have an interest in cheaper care. E.g. Kaiser Permanente
        • vkou 8y ago
          Well, they are essentially a single-payer system for their customers. That's not really surprising. They also have an incentive to err on the side of providing less care. Since you still can't meaningfully comparison shop between them and their competitors, I suppose it is exactly like a national single-payer system.
  • TheCoreh 8y ago
    Here in Brazil, where something like HIPAA doesn't exist, doctors routinely send patient records over WhatsApp, 'because it's more convenient'. I feel like despite making some some things more cumbersome, strict rules for sensitive data are usually a good idea.
    • opportune 8y ago
      Conversely, in the US a lot of medical data still needs to be sent by Fax... so it's still not perfect by any means
      • dragonwriter 8y ago
        > Conversely, in the US a lot of medical data still needs to be sent by Fax... That's actually largely because fax is exempt from security requirement applicable to electronic communication under HIPAAit's a loophole organizations exploit to avoid the cost of secure comms.
      • paulie_a 8y ago
        I get my records via an app. I honestly have no faith that it is secure, but if someone really wants to know what my creatinine value is, im sadly not concerned.
        • dest 8y ago
          One day, your health insurance will be more expensive. One day, your might be denied a bank loan.
          • paulie_a 8y ago
            That's fine I wouldn't want to do business with that type of bank.
            • acct1771 8y ago
              Clearly you haven't observed the trend of corporate consolidation in this country, especially in the financial sector. What happens when there's only two, and they both deny you? Seems shortsighted to not care about your privacy.
  • closeparen 8y ago
    Which specific HIPAA IT security requirements would you not have met otherwise? As I recall, it’s super basic controls like disk encryption, backups, system updates, and screensaver locks. Not, like, certified crypto hardware and static analysis. I appreciate that we can punish people for failing to meet table stakes, but if you weren’t going to do that stuff anyway, something is deeply wrong.
    • ATsch 8y ago
      If the number of breaches happening every week is an indication, something is deeply wrong not with individual companies, but most of the industry.
      • closeparen 8y ago
        HIPAA doesn't really begin to address APTs with 0-days. The controls it specifies are necessary, not sufficient.
• white-flame 8y ago
  > The sudden commodification of facial recognition means most of the companies racing to fill business needs are startups. I know it's a common phrase, but to be rhetorical, when is facial recognition actually a "business need"?
  • woah 8y ago
    Facial recognition is not a business need in and of itself, but it can be used to fulfill business needs
• nostrademons 8y ago
  Being a teenager when COPPA went into effect and having a number of netfriends under 13 (at the time) - I'm not sure that employees at big companies really understand all the unintended consequences of it. By far the most common consequence amongst my friends was to teach us to lie. (The second most common consequence was to shut us out of smaller websites that didn't want to deal with regulation - at least until we learned to lie.) "Are you under 13?" - duh, no. "Are you under 18?" - better answer no on that one too, to be safe. "How old are you?" - 20 is a good number. "What's your birthdate?" - how about Jan 1, 1970? I had one friend who forgot her password to her Yahoo Mail account. "Why can't you just use the password reset functionality?" "I forgot which birthday I entered." "Why don't you call them up and have them reset it?" "I registered under a fake name too, and forgot what I put." And she was one of the savvier ones. I saw a number of people post their street addresses, pictures of their house, vacations they were taking on the public Internet, but when it came to their ages, "I'm, uh, 24" (adding a decade and change). People wonder why Millenials aren't more up-in-arms about data breaches and identity theft, and why they prefer pseudononymous currencies like Bitcoin or Ethereum over the real banking system with its KYC requirements. Maybe it's because we've been trained to see identity as temporary, reputation as something that can only be used against you, and information as something you give out to get what you want at the moment.
  • sangnoir 8y ago
    > I'm not sure that employees at big companies really understand all the unintended consequences of it. They knew - just like they know people don't read EULAs. They didn't care because it was CYA action that took the bullseye off their collective backs. Those that pretended to care requested "credit card age verification" to improve their funnel conversion.
    • nostrademons 8y ago
      That's what I'd always assumed, but taking madrox's comment at face value, it seems like the employees in question thought they were actually cleaning up the Internet. COPPA did no such thing; it just gave the appearance of cleaning up the Internet by making all children magically appear to be over 18 to those asking the question.
• OnlyRepliesToBS 8y ago
  Microsoft cares.