5 ms·

Email is not private and not secure. I'm not sure if the law makes exceptions for encrypted emails, but that's a moot point considering most doctors can barely

by joesmo 13y ago

Email is not private and not secure. I'm not sure if the law makes exceptions for encrypted emails, but that's a moot point considering most doctors can barely use a computer.

dllthomas 13y ago
But it's my privacy and security that's at issue. I don't think it's obvious why I shouldn't be able to waive those concerns.
- UweSchmidt 13y ago
  Most people can not understand the impact of such a decision and must therefore be protected from doing that.
  - dllthomas 13y ago
    That's one argument; I don't think it's an outstanding one. A sort of "traffic analysis" argument seems somewhat reasonable, too - if the only things kept secret are embarrassing or compromising, then learning of the existence of a secret communication tells you there's something embarrassing or compromising going on.
    - UweSchmidt 13y ago
      Protecting people from themselves has plenty of precedents - food industry, handrails... Regarding your second point: Many things that are not embarrassing or compromising (in a negative sense) are rightfully kept secret. Anyways, great topic, not so great subthread, I'm out.
      - dllthomas 13y ago
        "Many things that are not embarrassing or compromising (in a negative sense) are rightfully kept secret." I don't intend any negative sense, just things that you have a particular reason to keep hidden. Allowing additional inference around that by being selective about channels seems like poor privacy practice.
- joesmo 13y ago
  True. The doctor can still be held liable for damages, so the law is actually there to protect both patient and doctor in this case.
- dragonwriter 13y ago
  > But it's my privacy and security that's at issue. I don't think it's obvious why I shouldn't be able to waive those concerns. You could, in theory, consent to a disclosure to of your PHI in insecure form to the doctor's email provider (or maybe to the whole chain between the doctor and you, but i don't think that would be necessary since once its been disclosed under your consent to someone not covered by HIPAA they can do anything they want with the data, including delivering it to you), but doctors would probably to use a method that doesn't require that overhead and not also manage the kind of consent tracking that would be necessary to use unsecure email (and would rather not deal with the PR fallout that would happen when someone who didn't really understand the implications got bit by it.) The fact that you could, in theory, under the law consent to certain insecure disclosures to third parties doesn't mean that doctors are mandated to maintain the infrastructure to deal with every conceivable way you might want to do that. They are required to provide information to you under certain circumstances, and not to provide it to others except as allowed under the law.
  - dllthomas 13y ago
    Fair enough.

by joesmo 13y ago

Email is not private and not secure. I'm not sure if the law makes exceptions for encrypted emails, but that's a moot point considering most doctors can barely use a computer.

dllthomas 13y ago

But it's my privacy and security that's at issue. I don't think it's obvious why I shouldn't be able to waive those concerns.

UweSchmidt 13y ago
Most people can not understand the impact of such a decision and must therefore be protected from doing that.
- dllthomas 13y ago
  That's one argument; I don't think it's an outstanding one. A sort of "traffic analysis" argument seems somewhat reasonable, too - if the only things kept secret are embarrassing or compromising, then learning of the existence of a secret communication tells you there's something embarrassing or compromising going on.
  - UweSchmidt 13y ago
    Protecting people from themselves has plenty of precedents - food industry, handrails... Regarding your second point: Many things that are not embarrassing or compromising (in a negative sense) are rightfully kept secret. Anyways, great topic, not so great subthread, I'm out.
    - dllthomas 13y ago
      "Many things that are not embarrassing or compromising (in a negative sense) are rightfully kept secret." I don't intend any negative sense, just things that you have a particular reason to keep hidden. Allowing additional inference around that by being selective about channels seems like poor privacy practice.
joesmo 13y ago
True. The doctor can still be held liable for damages, so the law is actually there to protect both patient and doctor in this case.
dragonwriter 13y ago
> But it's my privacy and security that's at issue. I don't think it's obvious why I shouldn't be able to waive those concerns. You could, in theory, consent to a disclosure to of your PHI in insecure form to the doctor's email provider (or maybe to the whole chain between the doctor and you, but i don't think that would be necessary since once its been disclosed under your consent to someone not covered by HIPAA they can do anything they want with the data, including delivering it to you), but doctors would probably to use a method that doesn't require that overhead and not also manage the kind of consent tracking that would be necessary to use unsecure email (and would rather not deal with the PR fallout that would happen when someone who didn't really understand the implications got bit by it.) The fact that you could, in theory, under the law consent to certain insecure disclosures to third parties doesn't mean that doctors are mandated to maintain the infrastructure to deal with every conceivable way you might want to do that. They are required to provide information to you under certain circumstances, and not to provide it to others except as allowed under the law.
- dllthomas 13y ago
  Fair enough.