11 ms·

I strongly oppose this kind of law. HIPAA is a massive burden on medical and research organizations of all sizes, I've personally spent hundreds of hours naviga

I strongly oppose this kind of law. HIPAA is a massive burden on medical and research organizations of all sizes, I've personally spent hundreds of hours navigating both human and technical bureaucracy related to HIPAA and I wouldn't wish that on my worst enemy. Ultimately however the worst part of these laws is that they are so harmful to research in the long run. With easy and ready access to medical data we could be decades ahead of where we are today. There are legitimate concerns about health privacy (especially for women in the US) but the upside is just so much larger than the harms. It could be 10x less costly and time consuming to do both epidemiology and longitudinal intervention studies if we only had access to data. We could be directly tackling disease causal factors in ways that researchers today only dream of. It really is tens of thousands of lives lost each year that could have been saved if we could only have moved faster toward interventions. I believe medical records should be open and laws should address how people use the data, not trying to make something so valuable to all humanity secret from the beginning. For example you can download my genetic code here: https://www.openhumans.org/member/iandanforth/ https://www.openhumans.org/member/iandanforth/

dmbche 3y ago
What are your thought on privacy then? Shouldn't my records be my own business?
- ClumsyPilot 3y ago
  no your records are their business Thier corporate records are none of your business if we are gonna have no privacy, it should go both ways - companies lose privacy too
- iandanforth 3y ago
  I reject the framing. It's about responsibility vs selfishness and fear. Medical information is a byproduct of something you do anyway that can save lives. It is our responsibility to make it available. If you want to opt out, fine, but basic decency demands that as a society we get over our collective hangups and make this information available.
  - dmbche 3y ago
    Are you a researcher? I find it alarming to hear this kind of talk, especially after so many have raised the very serious issues that can arise from this being public. It is not our responsibility to make this public. Your logic is similar to the gov trying to get access to all exchanges over the web to scrape them for terrorism and violent behavior. Maybe take a step back and think about the harms that would come out of this?
    - delfinom 3y ago
      There's a group of individuals that have been lobbying the US government that if we got rid of HIPPA, then we could cure every disease on the planet with all that medical data they could now harvest.
  - arp242 3y ago
    I don't mind aggregate data, or anonymized where I'm "Patient b15-2gty", which is what you seem to be talking about, but I do mind "here's all the data about patient Martin Tournoij, for everyone to read". I wouldn't want any future employers to see my medical data for example, as they may use this to discriminate (theoretically anyway; my medical history thus far is essentially non-existent). Also: in the late 90s my mother worked for the city to digitize a lot of social security records and such. She had a good friend who had trouble walking (crutches, wheelchair); the story she told was that she was hit by a car, but my mother read her records during her job and found out she had simply fallen and was never hit by a car. Much drama ensued. I have no idea why anyone would lie about that and I'm fuzzy on the details as I was about 12-13 at the time, but fundamentally I think people should have the right to lie about things like this, if they so choose, for whatever reason.
    - hedora 3y ago
      Mapping “Patient b15-2gty” back to your real name has been trivial for decades. My first job involved a one hour lecture about how people had repeatedly accidentally deanonymized and accidentally leaked data at other institutions, leading to divorces and worse. We had somewhere between 10 to 100 bytes of entropy on each patient, and it would have been enough for any of their acquaintances to map back to real names and also severely violate privacy.
boring_twenties 3y ago
> upside is just so much larger than the harms Or more importantly, the harms are to me, and the upsides are to you, so who cares?
- iandanforth 3y ago
  You're correct in pointing out that people are inherently selfish, however one major purpose of collective government is to do those things which are necessary and not always in-line with selfish motivations. Just as most Americans would be horrified to have their salary posted publicly for fear of stigma, jealousy, reprisals etc, Norway has demonstrated that those fears are unfounded, and salary data doesn't even have the opportunity to save thousands and thousands of lives.
  - systemtest 3y ago
    What I earn and what my assets are is nobodies business other than the government. That is not selfish, and I am not American.
- PragmaticPulp 3y ago
  You don’t think you benefit from medical research?
  - boring_twenties 3y ago
    In the nightmare scenario proposed by GP, of everyone's medical records being open to the public, I would simply stop consuming all medical services. So no.
  - genocidicbunny 3y ago
    Oh sure, but you know, I also probably benefited a little bit from the Tuskegee Syphilis experiments, and heck, if nuclear war ever comes, the things learned from keeping Hisashi Ouchi alive after his radiation expose, will probably help too. Doesn't make them any less fucking wrong.
Pulcinella 3y ago
Absolutely not. Healthcare is already oppressively expensive in the US and now you want companies to be able to commercialize and exploit my private health information for profit? And they don’t even have to pay for it so they can sell me the cure they developed using information from my private health information? America needs to be a radically different place for me to be okay with what you want.
- darrin 3y ago
  It would be interesting if all research and advances based on PHI were automatically public domain. Sort of like the GPL - any derivatives, treatment discoveries, etc. must also be open. There would probably be too many loopholes to cover effectively, but it's a thought.
  - fallingknife 3y ago
    Then there would be no research and advances. Nothing is free.
    - cloverich 3y ago
      We have Government funding available for such purposes; a better connected and more open PHI system would reduce barriers and costs for these kinds of endeavors. We would still need controlled trials, which would continue to work similarly to today. But those would be perhaps less expensive as a result, reducing research costs and turn around times.
    - kerkeslager 3y ago
      So are you being paid to comment? It amazes me how many people are motivated without profit to insist that nobody is motivated by anything other than profit. Obviously funding is needed: funding which already comes from government in many cases. It's just that now that research funding gets handed to execs who then use the data to make more money, and only have to use the data to help people if it happens to coincide with their business strategy. Having the data public just means that the people working on it are motivated more by helping people and less by acquiring data to leverage for profit, which is a feature not a bug.
genocidicbunny 3y ago
Give me a surefire, 100% guarantee that my data won't be misused against me or anyone else, under severe penalty to you personally if your guarantee fails. Then we can talk.
- scarby2 3y ago
  i cant give you that guarantee today. I can't guarantee the government or your healthcare provider isn't misusing your data. In fact a surefire guarantee essentially doesn't exist. But what exactly are you afraid of? How does someone weaponize your information? Everyone in my life already knows about my health conditions, i speak openly about them in my personal life, my business life and online there have been zero consequences to this.
  - phkahler 3y ago
    >> I can't guarantee the government or your healthcare provider isn't misusing your data. But at least there is a law against it. Loosening the rules would certainly lead to misuse - use against the patient.
  - michaelmior 3y ago
    > i speak openly about them in my personal life, my business life and online there have been zero consequences to this. Not everyone is comfortable speaking openly about their health issues and not everyone is in a situation where they will be free from consequences if they do.
  - genocidicbunny 3y ago
    > i cant give you that guarantee today. Well that's really the point, ain't it. You can't even meet the bare frakking minimum for this to be workable. > Everyone in my life already knows about my health conditions, i speak openly about them in my personal life, my business life and online there have been zero consequences to this. Would you mind listing them out? Also, some vital info like date, place of birth, name, family medical history? Who was your mom and dad? Grandparents? Got any siblings/cousins? Also, go ahead and measure your bp, heartrate, blood sugar levels, and post those here as well, might be useful to know those too. Oh, reminds me, gonna need to see your hepatic and renal panels as well, you never know when that sort of information about you might come in handy. I mean, now that we've interacted, I'm in your life too, and I'd like to know all these medical facts about you. Edit: > How does someone weaponize your information? A lot of other people have posted some of the terrible consequences that can result, but let me give you a more inane one that might actually be a little easier to connect with. Blood types are not evenly distributed, especially when it comes to blood banks. Some blood types, and especially if your have an uncommon Rh factor might be harder to get. So just imagine if your health insurance was more less expensive just based on your blood type -- something that you will probably need to know (and will thus be available to your insurer) at some point in your life, and probably relatively sooner than later. How'd you like to pay hundreds or thousands more for health insurance based on your blood type alone (because there won't be any discounts for the common ones, just penalties for the rare ones.) Or worse, being denied coverage for a surgery because the blood you'd need transfused during it would be 'too expensive'.
maxehmookau 3y ago
> HIPAA is a massive burden on medical and research organizations of all sizes That is the point. It is supposed to be burdensome. It is supposed to be difficult and cumbersome to do anything with anybody's medical data. I don't want to dismiss your comment entirely, because I understand the frustration around the good that the data could do but in the wrong hands it could be truly disasterous. I do not want Meta or Google anywhere near my medical data (and they're already pretty close in a lot of ways). I do not want my medical information used to enrich shareholders and that is the first thing that will happen; not improved research. It should be easier for people to opt-in to sharing their medical data with a wide range of organisations if they choose but right now they never get a choice. It's either "we're making a law so we can give this data away" or not. > the upside is just so much larger than the harms I also don't agree with this as a blanket statement. For many people, including women in the US as you pointed out (amongst many other groups), the harms are criminalisation and imprisonment. The harm here, for the individual, far outweighs any potential benefit.
- kkaske 3y ago
  I know that you probably meant Google (the search engine), but Google (the company) is already in your medical data: https://cloud.google.com/healthcare https://cloud.google.com/healthcare
  - maxehmookau 3y ago
    No, I meant the company. I'm in the UK and if it transpired that Google (the company) had routine access to NHS medical data, I'd be very upset and complaining to the information commissioners office.
    - scarby2 3y ago
      interestingly health data is a huge problem in the UK. In that the NHS trusts have extremely valuable information on a population wide basis and do next to nothing with it. Does google/a private company have to do it? No, but at a minimum the UK govt needs to make significantly better use of this data for research purposes. a 100x increase in medical research spending and a new more agile public medical research body would probably be enough
freeone3000 3y ago
Doctor-patient confidentiality is important so that the doctor can act in your best interest (yes, yes, very funny) with full information. Very many things doctors need to be aware of to diagnose conditions have significant social stigma. Examples include alcoholism, mental disorders, substance abuse, genital status, sexual status, pregnancy status, the list goes on. The average person is reluctant to share this information to begin with, with good reason, as it goes into a permanent record. If such a record were public… No, even for longitudinal studies, even with “anonymized” data, the risk is too great for any individual, and to society in general. Ideopathic and non-causal diseases should have some buy-in from patients; a standard waiver might be useful for research use of data. (I’ve signed one.) But in general, no, the restrictions are worth it.
- ClumsyPilot 3y ago
  > many things doctors need to be aware of to diagnose conditions have significant social stigma some are illegal - think threating drug overdose
  - michaelmior 3y ago
    In some jurisdictions, this not always the case. One example is the "Good Samaritan" law in California[0] which provides some protection patients seeking medical treatment for an overdose. https://www.wingerdenlaw.com/blog/2020/02/can-you-be-charged-with-drug-possession-if-you-overdose/ https://www.wingerdenlaw.com/blog/2020/02/can-you-be-charged...
  - ChrisMarshallNY 3y ago
    Nowadays, seeking abortion/family planning could -literally- result in being jailed, and forced to give birth. Mental health is a big deal. For better or for worse, if your employer/licensing org is aware of any mental health issues, then they could adjust how they treat you. Crappy bosses could use your history as a way to discredit or manipulate you. That's exactly what the CIA does, whenever someone blows a whistle on them. Some medical conditions can be interpreted by different people, in intensely negative ways. For example, at one time, being left-handed, meant that you were possessed by the devil. Often sexual orientation/behavior is a part of your medical history. But I'm suuuuure that no one would ever use this information in a questionable way. Look at the "mug shot protection racket" sites. These sites leverage personal information that has been made public, as a way to force you to pay them to remove it (and then immediately republish it in another venue). I guarantee that a number of folks on this very site, run those sites, and sincerely believe there's nothing wrong with it. No. Just because "I have nothing to hide," does not mean that I get to force others to divulge intensely personal stuff.
JohnFen 3y ago
I understand your perspective, and respectfully disagree. The reason HIPAA exists is because of a long history of the abuse of people's medical records. Companies should not have access to my records without my explicit informed consent. They have shown time and time again that they can't be trusted with sensitive data. That's at least equally true for tech companies.
- ryandrake 3y ago
  I'd be OK with a system that gave researchers access to my medical history only if they obtained actual, informed, and un-coerced consent. No "In order to use this medical service you must consent...", no "Please click Agree on this 38-page terms of service (which also sneakily agrees to consent)". No "I provide consent to each and every so-called researcher who wants access to my health history." An actual written request for consent from a research institution, telling me exactly what data they intend to access, how they will access it, how many people will have access, for how long, and what they will do with the data / results after they are done. One that I can at my option sign and send back, or trash. I'd in all likelihood say yes! But as a patient, I deserve the right to say yes or no. "Lives might be lost" is simply not justification for obtaining it. This doesn't seem that unreasonable to me. It balances the need for research with the patient's need for privacy.
  - genocidicbunny 3y ago
    > how many people will have access, for how long And more importantly, _who_ the people are. Yeah, I want full legal names. I want someone to name in a lawsuit if things go wrong or my data is leaked. I want personal legal culpability from everyone interacting with that data.
    - ryandrake 3y ago
      I mean, I’d be for this but I was trying to meet OP half way. CONSENT. That’s all that we are asking for.
      - 3y ago
manicennui 3y ago
Right after we make all medical treatments not-for-profit and all medical research completely open.
- taskforcegemini 3y ago
  that would solve a lot of problems, probably a lot more than making health data public. otherwise keeping your data off the record becomes just another bussiness model.
- JohnFen 3y ago
  Now that would change the equation quite a lot!
eimrine 3y ago
> I believe medical records should be open and laws should address how people use the data, not trying to make something so valuable to all humanity secret from the beginning. I believe exactly that about not medical records but medical procedures. If the doctors force me to share my medical records with the world of spammers and scammers I would rather choose to be a doctor for myself. But I see a little bit of problem when medical books are hard to download and medical drugs are very expensive because of so-called intellectual property. Medical industry relies too much on just obeying to all the doctor tells to do, blindly and brainlessly. Do you really believe that my medical records bond to my personal data are more important knowledge to society than how to do drugs which can save anybody?
annoyingnoob 3y ago
> Ultimately however the worst part of these laws is that they are so harmful to research in the long run. With easy and ready access to medical data we could be decades ahead of where we are today. You are saying that you'd like to take my personal data and make money from it without compensating me. My records are mine and they are private and it should stay this way.
croes 3y ago
>With easy and ready access to medical data we could be decades ahead of where we are today. And the people could be in big trouble because this data was stolen or is used against them. On top of that it isn't even guaranteed that we were decades ahead. Many of the big data promises didn't work out. Remember IBM's Watson? >but the upside is just so much larger than the harms. How do you know?
balls187 3y ago
How is HIPAA a massive burden?
- orbz 3y ago
  It’s wild, the world before HIPAA was even more walled off and data just didn’t flow at all. It was still a world of paper records widely at that point. Where we are with HIPAA is so much better, but still plenty of room to improve with delegated access.
taskforcegemini 3y ago
how will you make sure potential employers or insurance companies do not use that knowledge against individuals? What about social stigma? Victims of abuse/rape might be even less likely to come forward if the medical data is made public. I think before advocating to break down walls we should learn why they were raised to begin with, before countless people are hurt one way or the other.
indymike 3y ago
As a patient, I feel like HIPAA has been used by care providers to bully me into giving away my rights and data on pain of not getting care. It's a train wreck.
tgv 3y ago
> With easy and ready access to medical data we could be decades ahead of where we are today. That's just bullshit. Also, given the state of medical research methodology, you could just as well argue that it would yield even more unreliable studies, each adding confusion to our knowledge.
- justrealist 3y ago
  I don't have time to type an essay but I have been in this field for years and it's simply true. Please trust the opinions of people who have tried to do this work. There are many people trying to advance medical research in good faith who can attest to the insane inefficiencies of working with medical data.
  - clusterhacks 3y ago
    I have also been in this field for years and the allure of "open medical data" magically accelerating medical research very much does NOT feel true to me. Skip the essay but at least give me three or four sentences why I should feel differently?
- iandanforth 3y ago
  I get where you're coming from but the problems are orthogonal. Let's say that each research study spends 10% of its time on recruitment and another 5-10% of its time on compliance. (Real numbers can be much higher). Open medical data would reduce both these efforts, so every study, regardless of quality now goes more quickly and/or is less expensive. This is the primary benefit. Now you're pointing out that extremely open data can lead to rapid and perhaps erroneous analysis. This is true, but it would also lead to rapid and accurate analysis. My point is that everything speeds up and compliance regulations around data handling are far less impactful on study quality than are protocols around experiment design.
  - clusterhacks 3y ago
    For all intents and purposes, once IRB approval for a study is obtained, medical records ARE ALREADY OPEN to researchers for the purpose of recruitment. I believe open medical data would have absolutely zero effect on the amount of time spent on recruitment. Source: Me. I work with clinical trials data management in a medical research institution pulling hospital-side clinical data and patient schedules into systems on the research-side specifically for the purpose of recruitment.
nonameiguess 3y ago
This reads an awful lot like we could eliminate all crime with a sufficiently strong police and surveillance state, or eliminate all obesity by attaching activity trackers to everyone and having the government ration only as much food as you actually need. Both true, but humans inherently value things other than health and longevity, such as freedom and privacy. Governments that are not dictatorship have to manage these competing demands from citizens. Otherwise, you could probably maximize health outcomes by allowing research facilities to just all operate like Unit 731. Sure, you might kill a few million people, but you're doing it to save trillions in the future.
kgwxd 3y ago
"but the upside is just so much larger than the harms" Without the privacy, the world would be a different place and the people in power in that world would have no interest in advancing anything that doesn't directly give themselves more power. There would be no well funded scientist outside of the military.
sensanaty 3y ago
Please give me your full address, all your passwords & associated emails & phone number please, I pinky swear I won't misuse these in any way and will only do research with this information about the security of people's houses & accounts!
glitchc 3y ago
Privacy is a right, ability to conduct research is a privilege. It's clear which takes priority over the other.
jimbob45 3y ago
Couldn't agree more. Until you work in the healthcare field, you don't realize how much time and energy is wasted following HIPAA protocols. The doctor can receive your results, know your results, and still force you to come in because they can't tell you your results over the phone per protocol. Europe gets to use their free and open medical data freely for research. The US gatekeeps that information. It's a huge competitive advantage for Europe.
- nradov 3y ago
  There is nothing in HIPAA which prevents doctors from telling patients their results over the phone. They might not be able to leave voice mail with those results unless you specifically consented to that. They can also ask the patient for additional information during a phone call to verify it's really them and not someone else who answered the phone. For particularly sensitive test results, like say an HIV diagnosis, doctors might sometimes ask the patient to come for an in person visit so that they can explain everything in context and arrange an appropriate treatment plan. Sometimes people blame HIPAA for all sorts of random stuff which has no connection to the actual law.
screye 3y ago
The alarm around possible exploitation due to public medical data far exceeds the ground reality. At the same time, it has stifled progress in the field leading to more deaths than we should have to tolerate. Big Tech is not a thing, just like big-sensors was not a thing. Electric sensing became a thing in the 1900s, and the medical community benefitted from the machines built because of them. Tech is similarly a tool that has become available to all fields over the last 30 years. By treating big-tech as a bogeyman, we end up anthropomorphizing an inanimate marker of of progress in our time. It's Scientific cartelized Amish-ness. My controversial & intentionally provocative opinion for a while has been : "Doctors are evil". The more I read about it, the more I feel like there is an ounce of truth there.
- JohnFen 3y ago
  "Big Tech" is referring to specific companies that are demonstrably abusive as part of their business model. It's not just some imaginary threat.
lisasays 3y ago
I believe medical records should be open Other people's medical records, you mean?
adunsulag 3y ago
I used to have the same philosophy having also spent hundreds of hours dealing with the bureaucracy both technical and human of HIPAA and the need to have more data to improve health outcomes for people. I then went through the process of applying for disability insurance and dealt with the quagmire of them wanting access to all of my mental health records. Not a summary of my mental health diagnoses, but ALL of the individual progress notes. I refused them having those records and ended up having to waive any disability coverage due to mental health issues I was facing. That type of data I just didn't trust this insurance company to keep the data safe, especially as the paperwork stated they would share the data with all of their affiliates and partners with no recourse on my part to restrict what was shared. At that point, I realized that there are VERY good reasons why we don't just allow all of our medical data to be open.
TheCaptain4815 3y ago
I've always thought this about HIPPA as well, having worked in the healthcare field years ago. I imagine some "hero" leaking an enormous healthcare dataset after anonymizing some info and furthering research. Too bad I never had access to that.
- JohnFen 3y ago
  > I imagine some "hero" leaking an enormous healthcare dataset after anonymizing some info and furthering research. You misspelled "villain" there. If that were to happen, I'd 100% be calling for them to spend as much time in prison as possible.
- nradov 3y ago
  There is nothing legally stopping healthcare organizations from asking patients for informed consent to share their anonymized data with researchers. The government even provides clear guidelines for de-identification. https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/special-...
kerkeslager 3y ago
Why am I not surprised that the top voted comment on Hacker News is one that ignorantly states only one side of an issue which just happens to benefit corporations at the expense of everyone else? HN can always be trusted to present the pro-corporate, anti-human take. "Under the patchwork of laws existing prior to adoption of HIPAA and the Privacy Rule, personal health information could be distributed—without either notice or authorization—for reasons that had nothing to do with a patient's medical treatment or health care reimbursement. For example, unless otherwise forbidden by State or local law, without the Privacy Rule patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient's application for a home mortgage or a credit card, or to an employer who could use it in personnel decisions."[1] That's what's on the HHS website, and that's a mild example of what was happening prior to HIPAA. Health information was being used to out gays and HIV patients, discover people's race, bypass due process, stalk women, etc. With data being weaponized against individuals more and more, we have good reason to believe that this would be worse in 2023 if these laws didn't exist, not better. Yes, I'm aware of the burden that this puts on medical research. Behaving ethically is hard sometimes--get over it. You don't get a free pass to use people's private data without their consent. You might claim that you're only going to use that data for good, but the fact that you think bypassing people's basic human rights is acceptable shows that you don't have a working moral compass. You can't be trusted to only use people's data for good. The fact that you wrote three paragraphs on this topic and didn't even mention the rights of the patient shows me I don't want you to have access to my medical data, let alone having authority to make decisions about who else can see my medical data. You're not a person who will make that decision ethically and responsibly. [1] https://www.hhs.gov/hipaa/for-professionals/faq/188/why-is-the-privacy-rule-needed/index.html https://www.hhs.gov/hipaa/for-professionals/faq/188/why-is-t...
peteradio 3y ago
If medical records are open by default then there will be a dark research market that easily operates outside the purview of the law. Medical data, hell most data about people should be hidden by default. Your idea is wildly naive and you ought to read about chestertons fence.
voldacar 3y ago
What if you don't want other people viewing your medical data
Woodi 3y ago
Btw. I read somewhere "they" already have a lot of data. > With easy and ready access to medical data we could be decades ahead So make it ! On premises. Pay for helping in that. Do not pay for storage and cpu in clouds ! And don't be naive about what good and progress "they" can bring to medicine. They will promise then stall as much as possible and you will be paying for not deleting your precious data. Or accessing your own data :> And watching like your data are published and sold on black markets...

dmbche 3y ago

What are your thought on privacy then? Shouldn't my records be my own business?

ClumsyPilot 3y ago
no your records are their business Thier corporate records are none of your business if we are gonna have no privacy, it should go both ways - companies lose privacy too
iandanforth 3y ago
I reject the framing. It's about responsibility vs selfishness and fear. Medical information is a byproduct of something you do anyway that can save lives. It is our responsibility to make it available. If you want to opt out, fine, but basic decency demands that as a society we get over our collective hangups and make this information available.
- dmbche 3y ago
  Are you a researcher? I find it alarming to hear this kind of talk, especially after so many have raised the very serious issues that can arise from this being public. It is not our responsibility to make this public. Your logic is similar to the gov trying to get access to all exchanges over the web to scrape them for terrorism and violent behavior. Maybe take a step back and think about the harms that would come out of this?
  - delfinom 3y ago
    There's a group of individuals that have been lobbying the US government that if we got rid of HIPPA, then we could cure every disease on the planet with all that medical data they could now harvest.
- arp242 3y ago
  I don't mind aggregate data, or anonymized where I'm "Patient b15-2gty", which is what you seem to be talking about, but I do mind "here's all the data about patient Martin Tournoij, for everyone to read". I wouldn't want any future employers to see my medical data for example, as they may use this to discriminate (theoretically anyway; my medical history thus far is essentially non-existent). Also: in the late 90s my mother worked for the city to digitize a lot of social security records and such. She had a good friend who had trouble walking (crutches, wheelchair); the story she told was that she was hit by a car, but my mother read her records during her job and found out she had simply fallen and was never hit by a car. Much drama ensued. I have no idea why anyone would lie about that and I'm fuzzy on the details as I was about 12-13 at the time, but fundamentally I think people should have the right to lie about things like this, if they so choose, for whatever reason.
  - hedora 3y ago
    Mapping “Patient b15-2gty” back to your real name has been trivial for decades. My first job involved a one hour lecture about how people had repeatedly accidentally deanonymized and accidentally leaked data at other institutions, leading to divorces and worse. We had somewhere between 10 to 100 bytes of entropy on each patient, and it would have been enough for any of their acquaintances to map back to real names and also severely violate privacy.

boring_twenties 3y ago

> upside is just so much larger than the harms Or more importantly, the harms are to me, and the upsides are to you, so who cares?

iandanforth 3y ago
You're correct in pointing out that people are inherently selfish, however one major purpose of collective government is to do those things which are necessary and not always in-line with selfish motivations. Just as most Americans would be horrified to have their salary posted publicly for fear of stigma, jealousy, reprisals etc, Norway has demonstrated that those fears are unfounded, and salary data doesn't even have the opportunity to save thousands and thousands of lives.
- systemtest 3y ago
  What I earn and what my assets are is nobodies business other than the government. That is not selfish, and I am not American.
PragmaticPulp 3y ago
You don’t think you benefit from medical research?
- boring_twenties 3y ago
  In the nightmare scenario proposed by GP, of everyone's medical records being open to the public, I would simply stop consuming all medical services. So no.
- genocidicbunny 3y ago
  Oh sure, but you know, I also probably benefited a little bit from the Tuskegee Syphilis experiments, and heck, if nuclear war ever comes, the things learned from keeping Hisashi Ouchi alive after his radiation expose, will probably help too. Doesn't make them any less fucking wrong.

Pulcinella 3y ago

Absolutely not. Healthcare is already oppressively expensive in the US and now you want companies to be able to commercialize and exploit my private health information for profit? And they don’t even have to pay for it so they can sell me the cure they developed using information from my private health information? America needs to be a radically different place for me to be okay with what you want.

darrin 3y ago
It would be interesting if all research and advances based on PHI were automatically public domain. Sort of like the GPL - any derivatives, treatment discoveries, etc. must also be open. There would probably be too many loopholes to cover effectively, but it's a thought.
- fallingknife 3y ago
  Then there would be no research and advances. Nothing is free.
  - cloverich 3y ago
    We have Government funding available for such purposes; a better connected and more open PHI system would reduce barriers and costs for these kinds of endeavors. We would still need controlled trials, which would continue to work similarly to today. But those would be perhaps less expensive as a result, reducing research costs and turn around times.
  - kerkeslager 3y ago
    So are you being paid to comment? It amazes me how many people are motivated without profit to insist that nobody is motivated by anything other than profit. Obviously funding is needed: funding which already comes from government in many cases. It's just that now that research funding gets handed to execs who then use the data to make more money, and only have to use the data to help people if it happens to coincide with their business strategy. Having the data public just means that the people working on it are motivated more by helping people and less by acquiring data to leverage for profit, which is a feature not a bug.

genocidicbunny 3y ago

Give me a surefire, 100% guarantee that my data won't be misused against me or anyone else, under severe penalty to you personally if your guarantee fails. Then we can talk.

scarby2 3y ago
i cant give you that guarantee today. I can't guarantee the government or your healthcare provider isn't misusing your data. In fact a surefire guarantee essentially doesn't exist. But what exactly are you afraid of? How does someone weaponize your information? Everyone in my life already knows about my health conditions, i speak openly about them in my personal life, my business life and online there have been zero consequences to this.
- phkahler 3y ago
  >> I can't guarantee the government or your healthcare provider isn't misusing your data. But at least there is a law against it. Loosening the rules would certainly lead to misuse - use against the patient.
- michaelmior 3y ago
  > i speak openly about them in my personal life, my business life and online there have been zero consequences to this. Not everyone is comfortable speaking openly about their health issues and not everyone is in a situation where they will be free from consequences if they do.
- genocidicbunny 3y ago
  > i cant give you that guarantee today. Well that's really the point, ain't it. You can't even meet the bare frakking minimum for this to be workable. > Everyone in my life already knows about my health conditions, i speak openly about them in my personal life, my business life and online there have been zero consequences to this. Would you mind listing them out? Also, some vital info like date, place of birth, name, family medical history? Who was your mom and dad? Grandparents? Got any siblings/cousins? Also, go ahead and measure your bp, heartrate, blood sugar levels, and post those here as well, might be useful to know those too. Oh, reminds me, gonna need to see your hepatic and renal panels as well, you never know when that sort of information about you might come in handy. I mean, now that we've interacted, I'm in your life too, and I'd like to know all these medical facts about you. Edit: > How does someone weaponize your information? A lot of other people have posted some of the terrible consequences that can result, but let me give you a more inane one that might actually be a little easier to connect with. Blood types are not evenly distributed, especially when it comes to blood banks. Some blood types, and especially if your have an uncommon Rh factor might be harder to get. So just imagine if your health insurance was more less expensive just based on your blood type -- something that you will probably need to know (and will thus be available to your insurer) at some point in your life, and probably relatively sooner than later. How'd you like to pay hundreds or thousands more for health insurance based on your blood type alone (because there won't be any discounts for the common ones, just penalties for the rare ones.) Or worse, being denied coverage for a surgery because the blood you'd need transfused during it would be 'too expensive'.

maxehmookau 3y ago

> HIPAA is a massive burden on medical and research organizations of all sizes That is the point. It is supposed to be burdensome. It is supposed to be difficult and cumbersome to do anything with anybody's medical data. I don't want to dismiss your comment entirely, because I understand the frustration around the good that the data could do but in the wrong hands it could be truly disasterous. I do not want Meta or Google anywhere near my medical data (and they're already pretty close in a lot of ways). I do not want my medical information used to enrich shareholders and that is the first thing that will happen; not improved research. It should be easier for people to opt-in to sharing their medical data with a wide range of organisations if they choose but right now they never get a choice. It's either "we're making a law so we can give this data away" or not. > the upside is just so much larger than the harms I also don't agree with this as a blanket statement. For many people, including women in the US as you pointed out (amongst many other groups), the harms are criminalisation and imprisonment. The harm here, for the individual, far outweighs any potential benefit.

kkaske 3y ago
I know that you probably meant Google (the search engine), but Google (the company) is already in your medical data: https://cloud.google.com/healthcare https://cloud.google.com/healthcare
- maxehmookau 3y ago
  No, I meant the company. I'm in the UK and if it transpired that Google (the company) had routine access to NHS medical data, I'd be very upset and complaining to the information commissioners office.
  - scarby2 3y ago
    interestingly health data is a huge problem in the UK. In that the NHS trusts have extremely valuable information on a population wide basis and do next to nothing with it. Does google/a private company have to do it? No, but at a minimum the UK govt needs to make significantly better use of this data for research purposes. a 100x increase in medical research spending and a new more agile public medical research body would probably be enough

freeone3000 3y ago

Doctor-patient confidentiality is important so that the doctor can act in your best interest (yes, yes, very funny) with full information. Very many things doctors need to be aware of to diagnose conditions have significant social stigma. Examples include alcoholism, mental disorders, substance abuse, genital status, sexual status, pregnancy status, the list goes on. The average person is reluctant to share this information to begin with, with good reason, as it goes into a permanent record. If such a record were public… No, even for longitudinal studies, even with “anonymized” data, the risk is too great for any individual, and to society in general. Ideopathic and non-causal diseases should have some buy-in from patients; a standard waiver might be useful for research use of data. (I’ve signed one.) But in general, no, the restrictions are worth it.

ClumsyPilot 3y ago
> many things doctors need to be aware of to diagnose conditions have significant social stigma some are illegal - think threating drug overdose
- michaelmior 3y ago
  In some jurisdictions, this not always the case. One example is the "Good Samaritan" law in California[0] which provides some protection patients seeking medical treatment for an overdose. https://www.wingerdenlaw.com/blog/2020/02/can-you-be-charged-with-drug-possession-if-you-overdose/ https://www.wingerdenlaw.com/blog/2020/02/can-you-be-charged...
- ChrisMarshallNY 3y ago
  Nowadays, seeking abortion/family planning could -literally- result in being jailed, and forced to give birth. Mental health is a big deal. For better or for worse, if your employer/licensing org is aware of any mental health issues, then they could adjust how they treat you. Crappy bosses could use your history as a way to discredit or manipulate you. That's exactly what the CIA does, whenever someone blows a whistle on them. Some medical conditions can be interpreted by different people, in intensely negative ways. For example, at one time, being left-handed, meant that you were possessed by the devil. Often sexual orientation/behavior is a part of your medical history. But I'm suuuuure that no one would ever use this information in a questionable way. Look at the "mug shot protection racket" sites. These sites leverage personal information that has been made public, as a way to force you to pay them to remove it (and then immediately republish it in another venue). I guarantee that a number of folks on this very site, run those sites, and sincerely believe there's nothing wrong with it. No. Just because "I have nothing to hide," does not mean that I get to force others to divulge intensely personal stuff.

JohnFen 3y ago

I understand your perspective, and respectfully disagree. The reason HIPAA exists is because of a long history of the abuse of people's medical records. Companies should not have access to my records without my explicit informed consent. They have shown time and time again that they can't be trusted with sensitive data. That's at least equally true for tech companies.

ryandrake 3y ago
I'd be OK with a system that gave researchers access to my medical history only if they obtained actual, informed, and un-coerced consent. No "In order to use this medical service you must consent...", no "Please click Agree on this 38-page terms of service (which also sneakily agrees to consent)". No "I provide consent to each and every so-called researcher who wants access to my health history." An actual written request for consent from a research institution, telling me exactly what data they intend to access, how they will access it, how many people will have access, for how long, and what they will do with the data / results after they are done. One that I can at my option sign and send back, or trash. I'd in all likelihood say yes! But as a patient, I deserve the right to say yes or no. "Lives might be lost" is simply not justification for obtaining it. This doesn't seem that unreasonable to me. It balances the need for research with the patient's need for privacy.
- genocidicbunny 3y ago
  > how many people will have access, for how long And more importantly, _who_ the people are. Yeah, I want full legal names. I want someone to name in a lawsuit if things go wrong or my data is leaked. I want personal legal culpability from everyone interacting with that data.
  - ryandrake 3y ago
    I mean, I’d be for this but I was trying to meet OP half way. CONSENT. That’s all that we are asking for.
    - 3y ago

manicennui 3y ago

Right after we make all medical treatments not-for-profit and all medical research completely open.

taskforcegemini 3y ago
that would solve a lot of problems, probably a lot more than making health data public. otherwise keeping your data off the record becomes just another bussiness model.
JohnFen 3y ago
Now that would change the equation quite a lot!

eimrine 3y ago

> I believe medical records should be open and laws should address how people use the data, not trying to make something so valuable to all humanity secret from the beginning. I believe exactly that about not medical records but medical procedures. If the doctors force me to share my medical records with the world of spammers and scammers I would rather choose to be a doctor for myself. But I see a little bit of problem when medical books are hard to download and medical drugs are very expensive because of so-called intellectual property. Medical industry relies too much on just obeying to all the doctor tells to do, blindly and brainlessly. Do you really believe that my medical records bond to my personal data are more important knowledge to society than how to do drugs which can save anybody?

annoyingnoob 3y ago

> Ultimately however the worst part of these laws is that they are so harmful to research in the long run. With easy and ready access to medical data we could be decades ahead of where we are today. You are saying that you'd like to take my personal data and make money from it without compensating me. My records are mine and they are private and it should stay this way.

croes 3y ago

>With easy and ready access to medical data we could be decades ahead of where we are today. And the people could be in big trouble because this data was stolen or is used against them. On top of that it isn't even guaranteed that we were decades ahead. Many of the big data promises didn't work out. Remember IBM's Watson? >but the upside is just so much larger than the harms. How do you know?

balls187 3y ago

How is HIPAA a massive burden?

orbz 3y ago
It’s wild, the world before HIPAA was even more walled off and data just didn’t flow at all. It was still a world of paper records widely at that point. Where we are with HIPAA is so much better, but still plenty of room to improve with delegated access.

taskforcegemini 3y ago

how will you make sure potential employers or insurance companies do not use that knowledge against individuals? What about social stigma? Victims of abuse/rape might be even less likely to come forward if the medical data is made public. I think before advocating to break down walls we should learn why they were raised to begin with, before countless people are hurt one way or the other.

indymike 3y ago

As a patient, I feel like HIPAA has been used by care providers to bully me into giving away my rights and data on pain of not getting care. It's a train wreck.

tgv 3y ago

> With easy and ready access to medical data we could be decades ahead of where we are today. That's just bullshit. Also, given the state of medical research methodology, you could just as well argue that it would yield even more unreliable studies, each adding confusion to our knowledge.

justrealist 3y ago
I don't have time to type an essay but I have been in this field for years and it's simply true. Please trust the opinions of people who have tried to do this work. There are many people trying to advance medical research in good faith who can attest to the insane inefficiencies of working with medical data.
- clusterhacks 3y ago
  I have also been in this field for years and the allure of "open medical data" magically accelerating medical research very much does NOT feel true to me. Skip the essay but at least give me three or four sentences why I should feel differently?
iandanforth 3y ago
I get where you're coming from but the problems are orthogonal. Let's say that each research study spends 10% of its time on recruitment and another 5-10% of its time on compliance. (Real numbers can be much higher). Open medical data would reduce both these efforts, so every study, regardless of quality now goes more quickly and/or is less expensive. This is the primary benefit. Now you're pointing out that extremely open data can lead to rapid and perhaps erroneous analysis. This is true, but it would also lead to rapid and accurate analysis. My point is that everything speeds up and compliance regulations around data handling are far less impactful on study quality than are protocols around experiment design.
- clusterhacks 3y ago
  For all intents and purposes, once IRB approval for a study is obtained, medical records ARE ALREADY OPEN to researchers for the purpose of recruitment. I believe open medical data would have absolutely zero effect on the amount of time spent on recruitment. Source: Me. I work with clinical trials data management in a medical research institution pulling hospital-side clinical data and patient schedules into systems on the research-side specifically for the purpose of recruitment.

nonameiguess 3y ago

This reads an awful lot like we could eliminate all crime with a sufficiently strong police and surveillance state, or eliminate all obesity by attaching activity trackers to everyone and having the government ration only as much food as you actually need. Both true, but humans inherently value things other than health and longevity, such as freedom and privacy. Governments that are not dictatorship have to manage these competing demands from citizens. Otherwise, you could probably maximize health outcomes by allowing research facilities to just all operate like Unit 731. Sure, you might kill a few million people, but you're doing it to save trillions in the future.

kgwxd 3y ago

"but the upside is just so much larger than the harms" Without the privacy, the world would be a different place and the people in power in that world would have no interest in advancing anything that doesn't directly give themselves more power. There would be no well funded scientist outside of the military.

sensanaty 3y ago

Please give me your full address, all your passwords & associated emails & phone number please, I pinky swear I won't misuse these in any way and will only do research with this information about the security of people's houses & accounts!

glitchc 3y ago

Privacy is a right, ability to conduct research is a privilege. It's clear which takes priority over the other.

jimbob45 3y ago

Couldn't agree more. Until you work in the healthcare field, you don't realize how much time and energy is wasted following HIPAA protocols. The doctor can receive your results, know your results, and still force you to come in because they can't tell you your results over the phone per protocol. Europe gets to use their free and open medical data freely for research. The US gatekeeps that information. It's a huge competitive advantage for Europe.

nradov 3y ago
There is nothing in HIPAA which prevents doctors from telling patients their results over the phone. They might not be able to leave voice mail with those results unless you specifically consented to that. They can also ask the patient for additional information during a phone call to verify it's really them and not someone else who answered the phone. For particularly sensitive test results, like say an HIV diagnosis, doctors might sometimes ask the patient to come for an in person visit so that they can explain everything in context and arrange an appropriate treatment plan. Sometimes people blame HIPAA for all sorts of random stuff which has no connection to the actual law.

screye 3y ago

The alarm around possible exploitation due to public medical data far exceeds the ground reality. At the same time, it has stifled progress in the field leading to more deaths than we should have to tolerate. Big Tech is not a thing, just like big-sensors was not a thing. Electric sensing became a thing in the 1900s, and the medical community benefitted from the machines built because of them. Tech is similarly a tool that has become available to all fields over the last 30 years. By treating big-tech as a bogeyman, we end up anthropomorphizing an inanimate marker of of progress in our time. It's Scientific cartelized Amish-ness. My controversial & intentionally provocative opinion for a while has been : "Doctors are evil". The more I read about it, the more I feel like there is an ounce of truth there.

JohnFen 3y ago
"Big Tech" is referring to specific companies that are demonstrably abusive as part of their business model. It's not just some imaginary threat.

lisasays 3y ago

I believe medical records should be open Other people's medical records, you mean?

adunsulag 3y ago

I used to have the same philosophy having also spent hundreds of hours dealing with the bureaucracy both technical and human of HIPAA and the need to have more data to improve health outcomes for people. I then went through the process of applying for disability insurance and dealt with the quagmire of them wanting access to all of my mental health records. Not a summary of my mental health diagnoses, but ALL of the individual progress notes. I refused them having those records and ended up having to waive any disability coverage due to mental health issues I was facing. That type of data I just didn't trust this insurance company to keep the data safe, especially as the paperwork stated they would share the data with all of their affiliates and partners with no recourse on my part to restrict what was shared. At that point, I realized that there are VERY good reasons why we don't just allow all of our medical data to be open.

TheCaptain4815 3y ago

I've always thought this about HIPPA as well, having worked in the healthcare field years ago. I imagine some "hero" leaking an enormous healthcare dataset after anonymizing some info and furthering research. Too bad I never had access to that.

JohnFen 3y ago
> I imagine some "hero" leaking an enormous healthcare dataset after anonymizing some info and furthering research. You misspelled "villain" there. If that were to happen, I'd 100% be calling for them to spend as much time in prison as possible.
nradov 3y ago
There is nothing legally stopping healthcare organizations from asking patients for informed consent to share their anonymized data with researchers. The government even provides clear guidelines for de-identification. https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/special-...

kerkeslager 3y ago

Why am I not surprised that the top voted comment on Hacker News is one that ignorantly states only one side of an issue which just happens to benefit corporations at the expense of everyone else? HN can always be trusted to present the pro-corporate, anti-human take. "Under the patchwork of laws existing prior to adoption of HIPAA and the Privacy Rule, personal health information could be distributed—without either notice or authorization—for reasons that had nothing to do with a patient's medical treatment or health care reimbursement. For example, unless otherwise forbidden by State or local law, without the Privacy Rule patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient's application for a home mortgage or a credit card, or to an employer who could use it in personnel decisions."[1] That's what's on the HHS website, and that's a mild example of what was happening prior to HIPAA. Health information was being used to out gays and HIV patients, discover people's race, bypass due process, stalk women, etc. With data being weaponized against individuals more and more, we have good reason to believe that this would be worse in 2023 if these laws didn't exist, not better. Yes, I'm aware of the burden that this puts on medical research. Behaving ethically is hard sometimes--get over it. You don't get a free pass to use people's private data without their consent. You might claim that you're only going to use that data for good, but the fact that you think bypassing people's basic human rights is acceptable shows that you don't have a working moral compass. You can't be trusted to only use people's data for good. The fact that you wrote three paragraphs on this topic and didn't even mention the rights of the patient shows me I don't want you to have access to my medical data, let alone having authority to make decisions about who else can see my medical data. You're not a person who will make that decision ethically and responsibly. [1] https://www.hhs.gov/hipaa/for-professionals/faq/188/why-is-the-privacy-rule-needed/index.html https://www.hhs.gov/hipaa/for-professionals/faq/188/why-is-t...

peteradio 3y ago

If medical records are open by default then there will be a dark research market that easily operates outside the purview of the law. Medical data, hell most data about people should be hidden by default. Your idea is wildly naive and you ought to read about chestertons fence.

voldacar 3y ago

What if you don't want other people viewing your medical data

Woodi 3y ago

Btw. I read somewhere "they" already have a lot of data. > With easy and ready access to medical data we could be decades ahead So make it ! On premises. Pay for helping in that. Do not pay for storage and cpu in clouds ! And don't be naive about what good and progress "they" can bring to medicine. They will promise then stall as much as possible and you will be paying for not deleting your precious data. Or accessing your own data :> And watching like your data are published and sold on black markets...