4 ms·

Restrict data collection? It would kill all startups and firmly entrance a terrible provider monopoly who can comply. Have the government own data collection?

• gassi 9mo ago
  [deleted]
• nemomarx 9mo ago
  Why do the start ups need to collect data like this?
  • thinkingtoilet 9mo ago
    I work for a medical technology company. How do you propose we service our customers without their medical data?
    • cheeseomlit 9mo ago
      Ask for it?
      • pear01 9mo ago
        I hope you're joking... Otherwise it would suggest you think the problem is they didn't ask? When was the last time you saw a customer read a terms of service? Or better yet reject a product because of said terms once they hit that part of the customer journey? The issue isn't about asking it's that for take your pick of reasons no one ever says no. The asking is thus pro forma and irrelevant.
    • nemomarx 9mo ago
      Does it need to be hosted on your servers? Could you provide something to the customers where they host the data or their local doctors office does it? Can you delete it after the shortest possible period of using it, potentially? Do you keep data after someone stops being a customer or stops actively using the tech?
      • closeparen 9mo ago
        Having seen this world up close, the absolute last place you ever want your medical data to be is on the Windows Server in the closet of your local doctors office. The public cloud account of a Silicon Valley type company that hires reasonably competent people is Fort Knox by comparison.
        • fc417fc802 9mo ago
          Yeah but the a local private practice is a fairly small target. No one is going to break into my house just to steal my medical records, for example. This could also be drastically improved by the government spearheading a FOSS project for medical data management (archival, backup, etc). A single offering from the US federal government would have a massive return on investment in terms of impact per dollar spent. Maybe the DOGE staff could finally be put to good use.
          • nradov 9mo ago
            You seem to be confused about how this works. Attackers use automated scripts to locate vulnerable systems. Small local private practices are always targeted because everything is targeted. The notion of the US federal government offering an online data backup service is ludicrous, and wouldn't have even prevented the breach in this article.
            • fc417fc802 9mo ago
              > Attackers use automated scripts to locate vulnerable systems. I'm aware. I thought we were talking about something a bit higher effort than that. > online data backup service That isn't what I said. I suggested federally backed FOSS tooling for the specific usecase. If nothing else that would ensure that low effort scanners came up empty by providing purpose built software hardened against the expected attack vectors. Since it seems we're worrying about the potential for broader system misconfiguration they could even provide a blessed OS image. The breach in the article has nothing to do with what we're talking about. That was a case of shadow IT messing up. There's not much you can do about that.
    • rainonmoon 9mo ago
      I just registered CVEs in several platforms in a related industry, the founders of whom likely all asked themselves a similar question. And yet, it's the wrong question. The right one is, "Does this company need to exist?" I don't know you or your company. Maybe it's great. But many startups are born thinking there's a technological answer to a question that requires a social/political one. And instead of fixing the problem, the same founders use their newfound wealth to lobby to entrench the problem that justifies their company's existence, rather than resolves the need for it to exist in the first place. "How do you propose we service our customers without their medical data?" Fix your fucked healthcare system.
• troupo 9mo ago
  We apply crippling fines on companies and executives that let these breaches happen. Yes, some breaches (actual hack attacks) are unavoidable, so you don't slap a fine on every breach. But the vast majority of "breaches" are pure negligence.
• apercu 9mo ago
  > Restrict data collection? It would kill all startups and firmly entrance a terrible provider monopoly who can comply. That's a terrible argument for allowing our data to be sprayed everywhere. How about regulations with teeth that prohibit "dragons" from hoarding data about us? I do not care what the impact is on the "economy". That ship sailed with the current government in the US. Or, both more and less likely, cut us in on the revenue. That will at least help some of the time we have to waste doing a bunch of work every time some company "loses" our data. I'm tired of subsidizing the wealth and capital class. Pay us for holding our data or make our data toxic. Obviously my health provider and my bank need my data. But no one else does. And if my bank or health provider need to share my data with a third party it should be anonymized and tokenized. None of this is hard, we simply lack will (and most consumers, like voters are pretty ignorant).
• ourmandave 9mo ago
  Honestly I'd take the 16 cents. Usually its a discount voucher on a product you'd never buy. Or if it's a freebie then it's hidden behind a plain text link 3 levels deep on their website.
• logicchains 9mo ago
  The solution is to anonymize all data at the source, i.e. use a unique randomized ID as the key instead of someone's name/SSN. Then the medical provider would store the UID->name mapping in a separate, easily secured (and ideally air-gapped) system, for the few times it was necessary to use.
  • dredmorbius 9mo ago
    ...use a unique randomized ID as the key... 33 bits is all that are required to individually identify any person on Earth. If you'd like to extend that to the 420 billion or so who've lived since 1800, that extends to 39 bits, still a trivially small amount. Every bit[1] of leaked data bisects that set in half, and simply anonymising IDs does virtually nothing of itself to obscure identity. Such critical medical and billing data as date of birth and postal code are themselves sufficient to narrow things down remarkably, let alone a specific set of diagnoses, procedures, providers, and medications. Much as browser fingerprints are often unique or nearly so without any universal identifier so are medical histories. I'm personally aware of diagnostic and procedure codes being used to identify "anonymised" patients across multiple datasets dating to the early 1990s, and of research into de-anonymisation in Australia as of the mid-to-late 1990s. Australia publishes anonymisation and privacy guidelines, e.g.: "Data De‑identification in Australia: Essential Compliance Guide" <https://sprintlaw.com.au/articles/data-de-identification-in-australia-essential-compliance-guide/ https://sprintlaw.com.au/articles/data-de-identification-in-...> "De-identification and the Privacy Act" (2018) <https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/de-identification-and-the-privacy-act https://www.oaic.gov.au/privacy/privacy-guidance-for-organis...> It's not merely sufficient to substitute an alternative primary key, but also to fuzz data, including birthdates, addresses, diagnostic and procedure codes, treatment dates, etc., etc., all of which both reduces clinical value of the data and is difficult to do sufficiently. ________________________________ Notes: 1. In the "binary digit" sense, not in the colloquial "small increment" sense.
  • nradov 9mo ago
    What a silly idea. That would completely prevent federally mandated interoperability APIs from working. While privacy breaches are obviously a problem, most consumers don't want care quality and coordination harmed just for the sake of a minor security improvement. https://www.cms.gov/priorities/burden-reduction/overview/interoperability https://www.cms.gov/priorities/burden-reduction/overview/int...
• deleted 9mo ago
  [deleted]