4 ms·

So, here's the thing. We're going to be letting big data and whatnot into health. Every heartbeat you have, every milliliter of blood drawn, even your base pai

So, here's the thing. We're going to be letting big data and whatnot into health. Every heartbeat you have, every milliliter of blood drawn, even your base pairs will be cataloged meticulously and shoved into a database. So, that amount of privacy/care is gone, never to return. There are two things that are really worth asking: Are patients or practitioners the ones who own collected data? What is the utility of data leaks of non-billing information, truly? For the first, I rather think we're doomed if we don't legislate that patients own all of their own data and license it back to care providers--basically, treat labwork and everything as works-for-hire with copyright belonging to the patient. For the second, I think we're going to continue to treat all the health data as super mission critical, which will in turn only cause "security contsultants" to line their pockets further and justify the miserable busybodies in hospital IT that get in the way of progress under claims of "but but but the terror^H^H^H^H^HHIPAA". We already give away gigabytes of data every year about everything else, so it's kind of silly/sad that we're so protective about arguably the least harmful/most useful data we have.

orf 12y ago
>> ..which will in turn only cause "security contsultants" to line their pockets further and justify the miserable busybodies.. You obviously don't understand how utterly appalling the security of a lot of software is. My job title is "security consultant" and the last test I did was on a medical related application that tracks medication administered to patients in care facilities. All the sensitive patient data can be read and updated completely unauthenticated. They implemented ALL of their permission checks in the thick client which simply talked to a webservice - anyone with a decompiler and half a brain could alter patients drug doses with no record. This is a large application used in a large number of places. Maybe we need more security consultants in the medical industry.
- angersock 12y ago
  There's a lot of really weird systems design that goes on in hospitals, but that doesn't necessarily mean that it is wrong. The main problem I see is that the security is going to focus on things which won't matter, at the cost of creating still more barriers to entry for new techniques (I may or may not be fighting this battle at my current company).
  - chton 12y ago
    If your data can be reached by everyone, completely unsecured, that's not a weird design. That is just plain wrong. Security does matter for these things, because human lives and identities are at stake. Health data is far more important than your facebook profile, but it's woefully undersecured. If fixing security problems is "creating more barriers", then so be it, it has to be done.
    - angersock 12y ago
      It's not available to everyone--for example, a lot of institutions don't have wireless (lol) and have pretty strict controls on devices that plug into the wired networks.
      - chton 12y ago
        what if I break in to the network through a web server? or happen to find an open network port in my hospital room? Security is done in layers. Physical access is 1 layer, network security is another, requiring proper authentication/authorization for your software is yet another, etc. Each layer stops a percentage of hackers. If you skip important layers like auth, you're allowing a larger number of people in, simple as that. It's the equivalent of saying "but ofcourse I leave a large pile of cash in the middle of my dining room, my front door is locked, that's secure, right? Putting it in a safe or even a locked closet is just a burden." It ignores basic security principles.
      - orf 12y ago
        No it is available to anyone with an internet connection.
- lauradhamilton 12y ago
  Holy shit
rosser 12y ago
What is the utility of data leaks of non-billing information, truly? Blackmail. Deposit 10BTC at address X, or we'll tell everyone you have $condition.
- angersock 12y ago
  So what? If the problem is that you have a condition, people should be supportive regardless--that's what we should be fixing. There are more pressing and more troubling violations of privacy that occur as a matter of habit, so whether or not I've got $TERRIBLE_DISEASE doesn't really matter.
  - zAy0LfpBZLC8mAC 12y ago
    Except it's not about $TERRIBLE, but about $ECONOMICALLY_RISKY.
    - angersock 12y ago
      You know this, I know this--we should be fixing that part of the system.
      - gress 12y ago
        We have technical solutions to data security problems. What solution do you have for prejudice?
        angersock 12y ago
        ...teaching people not to be prejudiced? It's a better solution. (You could've replaced "data security" with "lawless minority" a few decades ago, and made the same--repugnant--point.)
        gress 12y ago
        I am not making a 'repugnant point'. I am in complete agreement that it would be better to fix social problems like prejudice and bigotry. The point I am making is that we don't know how to fix those problems quickly. In the meantime people are being hurt by the consequences and you are asking us not to protect those people. I think if anything qualifies as a repugnant point, that does. And no, you can't meaningfully put 'data security' in quotes and compare it to 'lawless minority' and act as though it is some kind of totalitarian repression. We are talking about stopping people's medical records from being hacked so easily. That is a practical and reasonable problem to fix.

orf 12y ago

>> ..which will in turn only cause "security contsultants" to line their pockets further and justify the miserable busybodies.. You obviously don't understand how utterly appalling the security of a lot of software is. My job title is "security consultant" and the last test I did was on a medical related application that tracks medication administered to patients in care facilities. All the sensitive patient data can be read and updated completely unauthenticated. They implemented ALL of their permission checks in the thick client which simply talked to a webservice - anyone with a decompiler and half a brain could alter patients drug doses with no record. This is a large application used in a large number of places. Maybe we need more security consultants in the medical industry.

angersock 12y ago
There's a lot of really weird systems design that goes on in hospitals, but that doesn't necessarily mean that it is wrong. The main problem I see is that the security is going to focus on things which won't matter, at the cost of creating still more barriers to entry for new techniques (I may or may not be fighting this battle at my current company).
- chton 12y ago
  If your data can be reached by everyone, completely unsecured, that's not a weird design. That is just plain wrong. Security does matter for these things, because human lives and identities are at stake. Health data is far more important than your facebook profile, but it's woefully undersecured. If fixing security problems is "creating more barriers", then so be it, it has to be done.
  - angersock 12y ago
    It's not available to everyone--for example, a lot of institutions don't have wireless (lol) and have pretty strict controls on devices that plug into the wired networks.
    - chton 12y ago
      what if I break in to the network through a web server? or happen to find an open network port in my hospital room? Security is done in layers. Physical access is 1 layer, network security is another, requiring proper authentication/authorization for your software is yet another, etc. Each layer stops a percentage of hackers. If you skip important layers like auth, you're allowing a larger number of people in, simple as that. It's the equivalent of saying "but ofcourse I leave a large pile of cash in the middle of my dining room, my front door is locked, that's secure, right? Putting it in a safe or even a locked closet is just a burden." It ignores basic security principles.
    - orf 12y ago
      No it is available to anyone with an internet connection.
lauradhamilton 12y ago
Holy shit

rosser 12y ago

What is the utility of data leaks of non-billing information, truly? Blackmail. Deposit 10BTC at address X, or we'll tell everyone you have $condition.

angersock 12y ago
So what? If the problem is that you have a condition, people should be supportive regardless--that's what we should be fixing. There are more pressing and more troubling violations of privacy that occur as a matter of habit, so whether or not I've got $TERRIBLE_DISEASE doesn't really matter.
- zAy0LfpBZLC8mAC 12y ago
  Except it's not about $TERRIBLE, but about $ECONOMICALLY_RISKY.
  - angersock 12y ago
    You know this, I know this--we should be fixing that part of the system.
    - gress 12y ago
      We have technical solutions to data security problems. What solution do you have for prejudice?
      - angersock 12y ago
        ...teaching people not to be prejudiced? It's a better solution. (You could've replaced "data security" with "lawless minority" a few decades ago, and made the same--repugnant--point.)
        gress 12y ago
        I am not making a 'repugnant point'. I am in complete agreement that it would be better to fix social problems like prejudice and bigotry. The point I am making is that we don't know how to fix those problems quickly. In the meantime people are being hurt by the consequences and you are asking us not to protect those people. I think if anything qualifies as a repugnant point, that does. And no, you can't meaningfully put 'data security' in quotes and compare it to 'lawless minority' and act as though it is some kind of totalitarian repression. We are talking about stopping people's medical records from being hacked so easily. That is a practical and reasonable problem to fix.