I've been keen to see how the GDPR and CCPA play out. Hopefully better than HIPAA, FERPA, etc. Providence Hospital in Portland OR (details?) had a big (for the

I've been keen to see how the GDPR and CCPA play out. Hopefully better than HIPAA, FERPA, etc. Providence Hospital in Portland OR (details?) had a big (for the time) data leak about the time I started doing medical records. They settled out of court. I contacted both sides and tried to reach the admins, to ask what fix they settled on. "Try harder next time." Terrific. We geeks creating the infrastructure for electronic medical record interchanges resigned ourselves to the inevitable massive data leak. I spent a lot of effort trying to figure out how to protect patient privacy. I eventually determined there's only one technical solution, based on strategies from Translucent Databases book. (TLDR: field level encryption for all data at rest, just like proper password storage.) But there's no social, legal, or cultural protection. And the small legal change (globally unique person identifiers) we'd have to do for the sole workable technical solution is strenuously opposed across the political spectrum. So. My plan now is to rethink the entire stack. Extend property rights to PII. Let accounting fix what algorithms couldn't. If someone divines a better plan, I'm totally on board. As in "shut up and take my money". But I'm not holding my breath. FWIW, one of my besties wrote a book on privacy. My proposal makes his head explode. Apoplectic. So I get the push back. But 15 years later, no one, including him, have a better idea. Better as in feasible, actionable. If you've got something, please share.