4 ms·

> USA health care system, culturally, is about saving lives. With all respect, but for someone who had lived in the US after moving from EU, I'd say it's first

by cromka 5y ago

> USA health care system, culturally, is about saving lives. With all respect, but for someone who had lived in the US after moving from EU, I'd say it's first and foremost about making money. It saves lives where saving is needed, but I'd argue vast majority of cases are outpatient and the culture is strikingly blunt about milking the patient.

bumby 5y ago
If profit were the primary motive, wouldn’t you expect non-profit institutions (both healthcare and otherwise) to be in much better shape from a cybersecurity standpoint? E.g., is there evidence that a large non-profit healthcare system like the VA is substantially better at cybersecurity? While profit no doubt impacts the decisions, it doesn't appear to be the primary driver of cybersecurity lapses.
- Taywee 5y ago
  I wouldn't. Both goals of maximizing profit and achieving a goal on a minimal possible budget end up cutting costs in places that aren't immediate blockers, where security lies. In my experience, security is a focus at places, either non-profit or otherwise, in one of the following situations: * The organization has one or more squeaky wheel employees that force everybody else to consider security where they wouldn't otherwise. * The organization or another in the same industry has already had a very painful security breach. * Security itself is part of the selling point. Non profits are slightly different, but they still experience many of the same problems because the goal is still getting the most done on the budget you've got.
  - bumby 5y ago
    Yeah, I can see that. I think you’re right. But that feels more to the "cultural" point (i.e., different perspectives having different priorities) than the specific claim specifically that "profits" are the driver.
- deleted 5y ago
  [deleted]
- cromka 5y ago
  > If profit were the primary motive, wouldn’t you expect non-profit institutions (both healthcare and otherwise) to be in much better shape from a cybersecurity standpoint? I will respond to that partially: where profit is not a primary motive, i.e. in countries where healthcare is public, it tends to be centralized on federal or regional level, and, as such, much of the IT and cybersecurity is a lower, shared cost incurred by the government. Taking my native Poland as an example, there is a single country-wide portal available for patients (http://pacjent.gov.pl http://pacjent.gov.pl), as well as a single, centralized API for doctor/hospital software (https://cez.gov.pl/interoperacyjnosc/interfejsy/ https://cez.gov.pl/interoperacyjnosc/interfejsy/) and a bunch of helper systems (https://cez.gov.pl/projekty/nasze-systemy/project/rejestr-asystentow-medycznych-ram/ https://cez.gov.pl/projekty/nasze-systemy/project/rejestr-as...). Naturally hospitals would have their own 3rd party systems, etc., but the tendency is to unify everything, which logically reduces number of attack vectors. Hopefully someone with a better experience in the field can attest to that.
  - bumby 5y ago
    So if I understand your point correctly, it’s not necessarily that removing the profit incentives directly improves the outcome but rather the improvement is attributable to a better economy of scale?
zdragnar 5y ago
Hospitals in the US are not especially profitable. Including federal relief, median hospital profit margin is 2%. The whole market is wildly distorted- starting with doctor education up through private insurance and government programs like Medicare and Medicaid- that simple answers like this totally miss the mark.
- deleted 5y ago
  [deleted]
- spamizbad 5y ago
  Profit in this sense likely refers to the value of the hospital (or greater provider network) rather than simply their EBITDA or whatever.
- briHass 5y ago
  Agreed. Any simplistic statement like "the problem with healthcare in the US is [blank]" is evidence of someone that doesn't know very much about the many complex and interlinked issues. Likewise, someone thinking the system can be fixed by "just doing X" is also being reductionist. The pandemic showed a number of areas in healthcare where people were generally ignorant. For example, thinking that hospitals have tons of reserve capacity to handle extraordinary events. Even well before the current situation, hospitals (community) tended to run at about 80% occupancy. Far from being a profit-consideration, even the department of Health and Human Services mandated that hospitals had to run at least 55% occupancy, or they lost benefits.
  - skybrian 5y ago
    The pandemic is a bit unusual in affecting everyone at once. For a local or regional problem, staffing wouldn't be as much of an issue because workers can travel. (For example, traveling nurses.)
  - cromka 5y ago
    > Any simplistic statement like "the problem with healthcare in the US is [blank]" is evidence of someone that doesn't know very much But who made such statement in this discussion?

by cromka 5y ago

bumby 5y ago

If profit were the primary motive, wouldn’t you expect non-profit institutions (both healthcare and otherwise) to be in much better shape from a cybersecurity standpoint? E.g., is there evidence that a large non-profit healthcare system like the VA is substantially better at cybersecurity? While profit no doubt impacts the decisions, it doesn't appear to be the primary driver of cybersecurity lapses.

Taywee 5y ago
I wouldn't. Both goals of maximizing profit and achieving a goal on a minimal possible budget end up cutting costs in places that aren't immediate blockers, where security lies. In my experience, security is a focus at places, either non-profit or otherwise, in one of the following situations: * The organization has one or more squeaky wheel employees that force everybody else to consider security where they wouldn't otherwise. * The organization or another in the same industry has already had a very painful security breach. * Security itself is part of the selling point. Non profits are slightly different, but they still experience many of the same problems because the goal is still getting the most done on the budget you've got.
- bumby 5y ago
  Yeah, I can see that. I think you’re right. But that feels more to the "cultural" point (i.e., different perspectives having different priorities) than the specific claim specifically that "profits" are the driver.
deleted 5y ago
[deleted]
cromka 5y ago
> If profit were the primary motive, wouldn’t you expect non-profit institutions (both healthcare and otherwise) to be in much better shape from a cybersecurity standpoint? I will respond to that partially: where profit is not a primary motive, i.e. in countries where healthcare is public, it tends to be centralized on federal or regional level, and, as such, much of the IT and cybersecurity is a lower, shared cost incurred by the government. Taking my native Poland as an example, there is a single country-wide portal available for patients (http://pacjent.gov.pl http://pacjent.gov.pl), as well as a single, centralized API for doctor/hospital software (https://cez.gov.pl/interoperacyjnosc/interfejsy/ https://cez.gov.pl/interoperacyjnosc/interfejsy/) and a bunch of helper systems (https://cez.gov.pl/projekty/nasze-systemy/project/rejestr-asystentow-medycznych-ram/ https://cez.gov.pl/projekty/nasze-systemy/project/rejestr-as...). Naturally hospitals would have their own 3rd party systems, etc., but the tendency is to unify everything, which logically reduces number of attack vectors. Hopefully someone with a better experience in the field can attest to that.
- bumby 5y ago
  So if I understand your point correctly, it’s not necessarily that removing the profit incentives directly improves the outcome but rather the improvement is attributable to a better economy of scale?

zdragnar 5y ago

Hospitals in the US are not especially profitable. Including federal relief, median hospital profit margin is 2%. The whole market is wildly distorted- starting with doctor education up through private insurance and government programs like Medicare and Medicaid- that simple answers like this totally miss the mark.

deleted 5y ago
[deleted]
spamizbad 5y ago
Profit in this sense likely refers to the value of the hospital (or greater provider network) rather than simply their EBITDA or whatever.
briHass 5y ago
Agreed. Any simplistic statement like "the problem with healthcare in the US is [blank]" is evidence of someone that doesn't know very much about the many complex and interlinked issues. Likewise, someone thinking the system can be fixed by "just doing X" is also being reductionist. The pandemic showed a number of areas in healthcare where people were generally ignorant. For example, thinking that hospitals have tons of reserve capacity to handle extraordinary events. Even well before the current situation, hospitals (community) tended to run at about 80% occupancy. Far from being a profit-consideration, even the department of Health and Human Services mandated that hospitals had to run at least 55% occupancy, or they lost benefits.
- skybrian 5y ago
  The pandemic is a bit unusual in affecting everyone at once. For a local or regional problem, staffing wouldn't be as much of an issue because workers can travel. (For example, traveling nurses.)
- cromka 5y ago
  > Any simplistic statement like "the problem with healthcare in the US is [blank]" is evidence of someone that doesn't know very much But who made such statement in this discussion?