3 ms·
I trained as a therapist a decade ago, and even then it was written into my organisational code of ethics that patient notes be stored encrypted with identifyin
by dbspin 6y ago
I trained as a therapist a decade ago, and even then it was written into my organisational code of ethics that patient notes be stored encrypted with identifying codes rather than names, and the list of name / numbers stored and encrypted separately. While our code of practice didn't specify scheme or location, it's pretty awful that this company didn't seem to have anything in place. But I guess that's to be expected from what sounds like a corporate firm rather than a set of practitioners. At this scale, clients are just numbers on a balance sheet.
- ptaipale 6y agoThat makes sense, but Finland is a welfare state where government pays for a large part of health care costs, and this data breach was at a start-up that has a couple hundred therapists that mostly contract for the public health care system. And government regulations require tracking of sessions, costs and compensations, identifiable by person ID. One extra piece of anguish people have here is that not only may their mental records be revealed, but simply that their address and person ID is used by identify thiefs who take loans or mail-order things in their name. The government has now responded by starting to find out if the person IDs of the victims could be changed quickly to avoid this risk, but I think that is an answer to wrong question. The right question is why it is permitted to apply for loans with a specific person ID without providing reliable authentication (either electronic signing or physical photo ID).