4 ms·

Sadly this is no guarantee as the news is replete with stories of people finding medical records in trash or abandoned in close facilities. However since no sy

Sadly this is no guarantee as the news is replete with stories of people finding medical records in trash or abandoned in close facilities. However since no system is perfect laws have to exist to prevent the information from being used by others except as how authorized by the law; examples would be preventing prospective employers from using it to filter candidates, housing agencies would be similar restricted. The same law would put in place a means to force it to be removed from any site hosting the information. The key take away is we cannot guarantee full protection but we minimize the damage caused

dredmorbius 6y ago
Records-in-trash take considerable work to access, parse, transmit, and duplicate. Digital data are immensely reproducible. Motivated adversaries may be motivated. Ask Dan. https://www.smithsonianmag.com/history/the-worlds-most-famous-filing-cabinet-36568830/ https://www.smithsonianmag.com/history/the-worlds-most-famou...
- eloisius 6y ago
  It also vastly decreases the feasible number of attackers. Digital records means you are vulnerable to criminals globally, particularly ones from places that don’t care so much about US law. Paper records in the trash are vulnerable to an extremely localized threat.
  - dredmorbius 6y ago
    Quite. If you can access it from anywhere (or your healthcare provider, other white hats, etc.), so can the black (or grey, or red, or geen,...) hats.
AbenezerMamo 6y ago
The employment/housing/financing impact is too real, too deep, and too damn important. Change. A change gonna come.
jrochkind1 6y ago
Yeah, but what's the scenario where isolated medical records put in trash turn into a massive extortion scheme like this? It even turning into a small-scale extortion scheme seems unlikely. Records are in trash AND someone finds them in trash in the relatively brief period before they wind up landfilled or incinerated, AND they decide to take them and track down the people who they belong to for purposes of extortion? I mean, sure, it could happen, and it's not a good thing for medical records to be in the trash. There are no "guarantees". Physical records are clearly much much lower risk though.
travisp 6y ago
Many therapists don't write names in their psychotherapy notes, and instead use initials, and store them separately from records that require identifying information. It could be possible, but difficult to identify people from these records -- certainly not on a large scale like has happened here.

dredmorbius 6y ago

Records-in-trash take considerable work to access, parse, transmit, and duplicate. Digital data are immensely reproducible. Motivated adversaries may be motivated. Ask Dan. https://www.smithsonianmag.com/history/the-worlds-most-famous-filing-cabinet-36568830/ https://www.smithsonianmag.com/history/the-worlds-most-famou...

eloisius 6y ago
It also vastly decreases the feasible number of attackers. Digital records means you are vulnerable to criminals globally, particularly ones from places that don’t care so much about US law. Paper records in the trash are vulnerable to an extremely localized threat.
- dredmorbius 6y ago
  Quite. If you can access it from anywhere (or your healthcare provider, other white hats, etc.), so can the black (or grey, or red, or geen,...) hats.

AbenezerMamo 6y ago

The employment/housing/financing impact is too real, too deep, and too damn important. Change. A change gonna come.

jrochkind1 6y ago

Yeah, but what's the scenario where isolated medical records put in trash turn into a massive extortion scheme like this? It even turning into a small-scale extortion scheme seems unlikely. Records are in trash AND someone finds them in trash in the relatively brief period before they wind up landfilled or incinerated, AND they decide to take them and track down the people who they belong to for purposes of extortion? I mean, sure, it could happen, and it's not a good thing for medical records to be in the trash. There are no "guarantees". Physical records are clearly much much lower risk though.

travisp 6y ago

Many therapists don't write names in their psychotherapy notes, and instead use initials, and store them separately from records that require identifying information. It could be possible, but difficult to identify people from these records -- certainly not on a large scale like has happened here.