5 ms·
Worth mentioning, because the authority level of medical practitioners throws people off. Don't ever give a doctor or practice your Social Security Number. They
by jppope 2y ago
Worth mentioning, because the authority level of medical practitioners throws people off. Don't ever give a doctor or practice your Social Security Number. They don't need it. Similarly if they want to check an ID that doesn't mean scan or photograph. Doctors, practices, etc are the worst at infosec. They have no training, basically no penalties if they do something wrong and all of that info is only to follow up in case you don't pay your bill.
- thfuran 2y agoIn the US, HIPAA is pretty much the strongest privacy legislation there is. There's probably no group that would have a more severe penalty for leaking your info than your healthcare provider.
- SR2Z 2y agoAnd yet the data still seems to leak pretty frequently...
- jandrese 2y agoHIPAA has strict rules with severe penalties, but enforcement is at best spotty. So honest hospitals and doctors offices bend over backwards to comply with the rules at great expense, but bad actors are rarely punished. It's the worst of both worlds. I'm pretty sure that is why the punishments are so harsh, because they need to put the fear of god into practitioners to make them take it seriously since there are so few inspectors.
- timewizard 2y agoIt's the difference in medical establishment skill level between your doctor and you. You are always at a disadvantage. I've long thought that a disinterested third party needs to be involved. Someone with real oversight taking a position adversarial to the hospital and strictly to create the best possible outcome for the patient. The Hippocratic model isn't awesome.
- edoceo 2y agoIn 2025 an oath don't mean shit.
- athenot 2y agoThis is true, however getting it funded is the difficult task. For it to be effective, the money can't come from the provider, meaning it's either from the payer or the patient. The payer doesn't really care, costs are contained as far as they are concerned, with the various Quality Initiatives. That leaves the patient to sign up for a subscription model. I explored that as a business 12 years ago, and sadly there is still a need. The worst part is that most clinicians actually want to do the right thing but it's the admins in their organization who set up processes that result in terrible outcomes.
- scarmig 2y agoPerhaps true, but the strongest privacy protections in the US are still pretty weak. The biggest penalty I know of is Anthem 2018, where they leaked HIPAA-qualifying records on 80 million customers. Their financial penalty was a whopping... $16 million. Two dimes per affected customer!
- thfuran 2y agoIt's true that the US rarely penalizes corporations enough to really disincentivize things, but healthcare providers probably take client data security more seriously than just about any other group besides maybe law firms. It's weird to single them out as being particularly unconcerned with and unpenalized for leaks.
- mixmastamyk 2y agoWe saw ours input PII into a Windows box. The idea that their ActiveX monstrosity has any security is not very persuasive.
- RGamma 2y agoActiveX... haven't read that in a long time...
- deleted 2y ago[deleted]
- colechristensen 2y agoEh. Last year the total HIPAA violations fines were less than $9.2 million. A figure I could find for hospital revenue in the same year which is a good enough proxy for fines vs revenue is about $1.2 trillion. Which rounding because who cares comes to 0.001% of medical revenue ends up being paid for HIPAA violation fines. Or the equivalent ratio of about a cup of coffee for a typical enough person per year. HIPAA needs teeth, what it says you're supposed to do is quite strong, the enforcement of it is pathetic.
- slt2021 2y agoPCI-DSS is the strongest, HIPAA is just a rubber stamp
- thfuran 2y agoThat's not actually law at all. It's part of the contract with payment processors.
- andrewmcwatters 2y agoOnly the young and inexperienced believe the law is enforced when it matters.
- paulcole 2y agoHow many healthcare providers do you know personally who have faced severe penalties for leaking information? The reality is that for a small doctor/dental/whatever office, there is essentially 0 risk. HIPAA violations that carry significant penalties go to huge hospitals and healthcare companies. Your neighborhood doctor has to screw up in a major way for an extended period of time to have a minute risk of any consequence.
- jmye 2y agoHow much information do you think your neighborhood PCP is “leaking” compared to, say, Elevance? This is such a goofy take. Are you expecting that every small provider group is just firing your data off on Facebook every Tuesday, and somehow, no one cares? They’re all using certified EMRs. They all take security seriously because their licenses are literally on the line. Do you work in healthcare? If they provably expose your data, and you report them, they will get fined. Or they would have last year, who knows if those people still have jobs.
- eclipticplane 2y agoHIPAA was designed for portability -- the 'p' standards for portability not privacy -- of health info, so there are immense carve outs in service of that objective. Fines for violating HIPAA are almost non-existent. HIPAA is wildly misunderstood by the public as a strong safeguard, meanwhile medical offices just get any patient (a captive audience) to sign a release waiver as part of patient intake ...
- thfuran 2y agoThey get patients to sign something permitting them to share PHI with other entities like e.g. the lab that runs blood work, not to disclaim liability for leaking it unintentionally.
- supertrope 2y agoWhat do you do if they refuse to book an appointment without it?
- sieabahlpark 2y ago[dead]
- x3n0ph3n3 2y agoFind a new provider. I have gone 2 decades without providing my SSN to doctors.
- edoceo 2y agoNew provider is unrealistic for many in USA. In NYC, maybe easy; in rural WI/KS much less so.
- RandomBacon 2y agoNot in my case, I do not provide my Social Security Number to (new to me) healthcare providers from small practices to major hospitals with different branches, either.
- mayneack 2y agoI've never had that happen (sample size ~5). They accept non-citizen patients, so they probably don't make SSN a required field. (for SSN, never tried to prevent scanning of my ID)
- jppope 2y agoYou can just use my SSN: 123-45-6789.
- RandomBacon 2y agoIn my experience, no one has ever asked it when booking, just when you fill out forms on your first visit. I always leave it blank (and most other things that don't pertain to my healthcare issue) blank and have never been hassled. I also always ask for a paper copy of the disclosures to sign, saying that "I don't sign blank checks" when asked to sign the electric pad. I've never had an issue with them printing it out, letting me sign, and them scanning it in. Healthcare "security"/"authentication" is just "protected" by your name and date of birth which is easily discovered for anyone online.
- deleted 2y ago[deleted]