5 ms·

> I've seen how regulation really can work for consumer benefit. I'm not sure if people appreciate how much COPPA cleaned up in child privacy Yes absolutely!

> I've seen how regulation really can work for consumer benefit. I'm not sure if people appreciate how much COPPA cleaned up in child privacy Yes absolutely! Similarly, HIPAA has been incredibly useful in forcing hospitals and other for-profit companies to at least kind of care about medical data security. It's not perfect, but without HIPAA that data privacy/security would be in a far worse state.

bovermyer 8y ago
Addendum to this: HIPAA told us (engineers who work in the health space) what to do, and HITECH told us how to do it. Both are useful.
Nuzzerino 8y ago
To play devil's advocate: Without HIPAA, health care costs in the US might also not be multiple times higher than in other developed countries. I have worked multiple jobs in the health sector, and it seemed as if the vast majority of the overhead and time spent was for the sake of complying with HIPAA.
- vkou 8y ago
  The reason health care costs in the US are ballooning is not HIPPA. It's the Byzantine system of who pays for what, how much, and why, where nobody has an incentive to make care cheaper. See: * Why nobody can itemize a medical bill. * Why a bag of saline may cost the patient $100. * Why an in-network hospital will bring in an out-of-network independent contractor nurse to assist an in-network surgeon, leaving you with a $200 bill for the surgery + a $5,000 bill for the out-of-network assistant. * Why nobody will tell you how much a procedure will cost, with, or without complications. * Why nobody knows how much your insurance will pay for, until the bill is due. Often months after the procedure. Compared to all of these problems and abuses, HIPAA seems the least of America's problems. I'd like to contribute to reducing the cost of care, by shopping around for more efficient/more affordable/better dollar for value doctors/hospitals, but I haven't the foggiest idea of where to start. It's like going to a car dealer, saying that you want a Prius, and not knowing what the age of the car, its condition, or how much you will be billed for until after the title is irrevocably transferred to you. Oh, and the dealer across the street will happily sell you one for half what you paid for. Or double. You really have no idea.
  - devmunchies 8y ago
    > nobody has an incentive to make care cheaper. Companies who act as the insurance company and the care provider have an interest in cheaper care. E.g. Kaiser Permanente
    - vkou 8y ago
      Well, they are essentially a single-payer system for their customers. That's not really surprising. They also have an incentive to err on the side of providing less care. Since you still can't meaningfully comparison shop between them and their competitors, I suppose it is exactly like a national single-payer system.
      - ggg9990 8y ago
        > They also have an incentive to err on the side of providing less care. This is only true at the end of a person's life. Before then, ignoring problems does not make them go away, it in fact makes it more expensive for them.
        mjevans 8y ago
        Not quite; there's also the chance you might switch providers before discovering a condition.
      - jonny_eh 8y ago
        And sometimes less care produces better outcomes. You can run too many diagnostics leading to more false positives.
  - sli 8y ago
    > I'd like to contribute to reducing the cost of care, by shopping around for more efficient/more affordable/better dollar for value doctors/hospitals, but I haven't the foggiest idea of where to start. Not to mention that this is almost completely out of your hands if you're unconscious or otherwise not able-bodied. If you get in a car accident and are unconscious, you're likely to go to whichever hospital the ambulance takes you to, and you're on the hook for that ambulance ride now, too. Before you even get to the hospital, your bill can already be over $1000.
- blattimwind 8y ago
  AIUI HIPAA really isn't that much different from European regulations regarding medical data, so no, that argument does not seem to hold any water.
- ashelmire 8y ago
  > I have worked multiple jobs in the health sector, and it seemed as if the vast majority of the overhead and time spent was for the sake of complying with HIPAA. It is pretty easy to comply with HIPAA, and other countries also have privacy laws governing medical records. I suspect you've worked for incompetent organizations - some organizations intentionally drag out compliance and make things more difficult in order to complain or justify increased costs. This is the lamest excuse I've heard in a long time. All user/customer data should always be protected and compartmentalized to the greatest extent possible in any industry.
- tzs 8y ago
  Why US spends 2-3x in dollars per capita, and almost as much more in percent of GDP, on healthcare than Germany and France and similar countries is an interesting question...but is at actually an important question? The thing that is causing most of the problems for people when it comes to affording healthcare is that the costs keep going up. We think we've finally got something we can afford...and then in a few short years we can no longer afford it. It has outstripped our pay and our investments. This is not just a US problem, either. Costs are going up at roughly the same rate in those other countries. E.g., US to Germany dollars per capita ratio in 2017 for healthcare was 1.8. In 2010, it was 1.8. In 2000, it was 1.7. In 1990, it was 1.5. I'd happily for the US continuing to pay the high amount we are now paying if we could just curb the growth so that whenever I manage to get coverage I can afford I can keep it for a long time. Here's a site with all the data available for download, and explorable interactively on the site [1]. Uncheck "latest data available" and use the year range slider to select a range, and it will show you the growth in several countries over that range. You can use the filters to narrow it to specific countries or groups like G7, G20, OECD, etc. [1] https://data.oecd.org/healthres/health-spending.htm https://data.oecd.org/healthres/health-spending.htm
  - woolvalley 8y ago
    It's not really HIPPA. I think it's more things like a lack of price transparency, the 'customers' of health care being disconnected from the users of health care and so on. Kind of like how B2B software is often horrible because the customers are disconnected execs and the users (employees) pay the price. This goes into more detail: http://abovethecrowd.com/2017/12/18/customer-first-healthcare/ http://abovethecrowd.com/2017/12/18/customer-first-healthcar...
TheCoreh 8y ago
Here in Brazil, where something like HIPAA doesn't exist, doctors routinely send patient records over WhatsApp, 'because it's more convenient'. I feel like despite making some some things more cumbersome, strict rules for sensitive data are usually a good idea.
- opportune 8y ago
  Conversely, in the US a lot of medical data still needs to be sent by Fax... so it's still not perfect by any means
  - dragonwriter 8y ago
    > Conversely, in the US a lot of medical data still needs to be sent by Fax... That's actually largely because fax is exempt from security requirement applicable to electronic communication under HIPAAit's a loophole organizations exploit to avoid the cost of secure comms.
  - paulie_a 8y ago
    I get my records via an app. I honestly have no faith that it is secure, but if someone really wants to know what my creatinine value is, im sadly not concerned.
    - dest 8y ago
      One day, your health insurance will be more expensive. One day, your might be denied a bank loan.
      - paulie_a 8y ago
        That's fine I wouldn't want to do business with that type of bank.
        acct1771 8y ago
        Clearly you haven't observed the trend of corporate consolidation in this country, especially in the financial sector. What happens when there's only two, and they both deny you? Seems shortsighted to not care about your privacy.
closeparen 8y ago
Which specific HIPAA IT security requirements would you not have met otherwise? As I recall, it’s super basic controls like disk encryption, backups, system updates, and screensaver locks. Not, like, certified crypto hardware and static analysis. I appreciate that we can punish people for failing to meet table stakes, but if you weren’t going to do that stuff anyway, something is deeply wrong.
- ATsch 8y ago
  If the number of breaches happening every week is an indication, something is deeply wrong not with individual companies, but most of the industry.
  - closeparen 8y ago
    HIPAA doesn't really begin to address APTs with 0-days. The controls it specifies are necessary, not sufficient.

bovermyer 8y ago

Addendum to this: HIPAA told us (engineers who work in the health space) what to do, and HITECH told us how to do it. Both are useful.

Nuzzerino 8y ago

To play devil's advocate: Without HIPAA, health care costs in the US might also not be multiple times higher than in other developed countries. I have worked multiple jobs in the health sector, and it seemed as if the vast majority of the overhead and time spent was for the sake of complying with HIPAA.

vkou 8y ago
The reason health care costs in the US are ballooning is not HIPPA. It's the Byzantine system of who pays for what, how much, and why, where nobody has an incentive to make care cheaper. See: * Why nobody can itemize a medical bill. * Why a bag of saline may cost the patient $100. * Why an in-network hospital will bring in an out-of-network independent contractor nurse to assist an in-network surgeon, leaving you with a $200 bill for the surgery + a $5,000 bill for the out-of-network assistant. * Why nobody will tell you how much a procedure will cost, with, or without complications. * Why nobody knows how much your insurance will pay for, until the bill is due. Often months after the procedure. Compared to all of these problems and abuses, HIPAA seems the least of America's problems. I'd like to contribute to reducing the cost of care, by shopping around for more efficient/more affordable/better dollar for value doctors/hospitals, but I haven't the foggiest idea of where to start. It's like going to a car dealer, saying that you want a Prius, and not knowing what the age of the car, its condition, or how much you will be billed for until after the title is irrevocably transferred to you. Oh, and the dealer across the street will happily sell you one for half what you paid for. Or double. You really have no idea.
- devmunchies 8y ago
  > nobody has an incentive to make care cheaper. Companies who act as the insurance company and the care provider have an interest in cheaper care. E.g. Kaiser Permanente
  - vkou 8y ago
    Well, they are essentially a single-payer system for their customers. That's not really surprising. They also have an incentive to err on the side of providing less care. Since you still can't meaningfully comparison shop between them and their competitors, I suppose it is exactly like a national single-payer system.
    - ggg9990 8y ago
      > They also have an incentive to err on the side of providing less care. This is only true at the end of a person's life. Before then, ignoring problems does not make them go away, it in fact makes it more expensive for them.
      - mjevans 8y ago
        Not quite; there's also the chance you might switch providers before discovering a condition.
    - jonny_eh 8y ago
      And sometimes less care produces better outcomes. You can run too many diagnostics leading to more false positives.
- sli 8y ago
  > I'd like to contribute to reducing the cost of care, by shopping around for more efficient/more affordable/better dollar for value doctors/hospitals, but I haven't the foggiest idea of where to start. Not to mention that this is almost completely out of your hands if you're unconscious or otherwise not able-bodied. If you get in a car accident and are unconscious, you're likely to go to whichever hospital the ambulance takes you to, and you're on the hook for that ambulance ride now, too. Before you even get to the hospital, your bill can already be over $1000.
blattimwind 8y ago
AIUI HIPAA really isn't that much different from European regulations regarding medical data, so no, that argument does not seem to hold any water.
ashelmire 8y ago
> I have worked multiple jobs in the health sector, and it seemed as if the vast majority of the overhead and time spent was for the sake of complying with HIPAA. It is pretty easy to comply with HIPAA, and other countries also have privacy laws governing medical records. I suspect you've worked for incompetent organizations - some organizations intentionally drag out compliance and make things more difficult in order to complain or justify increased costs. This is the lamest excuse I've heard in a long time. All user/customer data should always be protected and compartmentalized to the greatest extent possible in any industry.
tzs 8y ago
Why US spends 2-3x in dollars per capita, and almost as much more in percent of GDP, on healthcare than Germany and France and similar countries is an interesting question...but is at actually an important question? The thing that is causing most of the problems for people when it comes to affording healthcare is that the costs keep going up. We think we've finally got something we can afford...and then in a few short years we can no longer afford it. It has outstripped our pay and our investments. This is not just a US problem, either. Costs are going up at roughly the same rate in those other countries. E.g., US to Germany dollars per capita ratio in 2017 for healthcare was 1.8. In 2010, it was 1.8. In 2000, it was 1.7. In 1990, it was 1.5. I'd happily for the US continuing to pay the high amount we are now paying if we could just curb the growth so that whenever I manage to get coverage I can afford I can keep it for a long time. Here's a site with all the data available for download, and explorable interactively on the site [1]. Uncheck "latest data available" and use the year range slider to select a range, and it will show you the growth in several countries over that range. You can use the filters to narrow it to specific countries or groups like G7, G20, OECD, etc. [1] https://data.oecd.org/healthres/health-spending.htm https://data.oecd.org/healthres/health-spending.htm
- woolvalley 8y ago
  It's not really HIPPA. I think it's more things like a lack of price transparency, the 'customers' of health care being disconnected from the users of health care and so on. Kind of like how B2B software is often horrible because the customers are disconnected execs and the users (employees) pay the price. This goes into more detail: http://abovethecrowd.com/2017/12/18/customer-first-healthcare/ http://abovethecrowd.com/2017/12/18/customer-first-healthcar...

TheCoreh 8y ago

Here in Brazil, where something like HIPAA doesn't exist, doctors routinely send patient records over WhatsApp, 'because it's more convenient'. I feel like despite making some some things more cumbersome, strict rules for sensitive data are usually a good idea.

opportune 8y ago
Conversely, in the US a lot of medical data still needs to be sent by Fax... so it's still not perfect by any means
- dragonwriter 8y ago
  > Conversely, in the US a lot of medical data still needs to be sent by Fax... That's actually largely because fax is exempt from security requirement applicable to electronic communication under HIPAAit's a loophole organizations exploit to avoid the cost of secure comms.
- paulie_a 8y ago
  I get my records via an app. I honestly have no faith that it is secure, but if someone really wants to know what my creatinine value is, im sadly not concerned.
  - dest 8y ago
    One day, your health insurance will be more expensive. One day, your might be denied a bank loan.
    - paulie_a 8y ago
      That's fine I wouldn't want to do business with that type of bank.
      - acct1771 8y ago
        Clearly you haven't observed the trend of corporate consolidation in this country, especially in the financial sector. What happens when there's only two, and they both deny you? Seems shortsighted to not care about your privacy.

closeparen 8y ago

Which specific HIPAA IT security requirements would you not have met otherwise? As I recall, it’s super basic controls like disk encryption, backups, system updates, and screensaver locks. Not, like, certified crypto hardware and static analysis. I appreciate that we can punish people for failing to meet table stakes, but if you weren’t going to do that stuff anyway, something is deeply wrong.

ATsch 8y ago
If the number of breaches happening every week is an indication, something is deeply wrong not with individual companies, but most of the industry.
- closeparen 8y ago
  HIPAA doesn't really begin to address APTs with 0-days. The controls it specifies are necessary, not sufficient.