Hacker News Reader

Comment by jc4p | Hacker News Reader

I think the bigger issue (which another article I read on this last week described, but I sadly can't find it right now) is that low punishment for when it's caught means its more likely to happen and not be caught. There were 3 cases reported in 2015, how many went unreported? If the culture is "oh it's fine, just don't be egregious about it" I expect it's happened a lot more than 3 times in the last year.

Do they not maintain proper audit logs? I work for Stack Overflow and I can't look at a user's PII without it being logged in multiple systems, do we have higher internal security than the police department?

View on HN

> I work for Stack Overflow and I can't look at a user's PII without it being logged in multiple systems, do we have higher internal security than the police department?

Most likely: yes.

Imaging how these low-lifes would be treated if these were HIPAA violations.

One could argue that they aren't necessarily low-lifes: I'd wager many, many people would abuse such power if they could. Which is why it's more important to place constraints on positions of power, than to hope that we only staff those positions with wholly noble people (who are incredibly few in number, in reality).

The other consideration is that if they were doing so under the threat of HIPAA violations, they may not have abused the information quite so casually. Jealous husband fears a slap on the wrist, he abuses the database. Jealous husband fears jail time, he possibly [hires P.I. / follows his wife / etc.].

I'm not defending them–law enforcement enjoys some protections that are arguably unconstitutional, and as such should be held to a much higher standard–but it's unproductive to examine what would have happened if the penalties were different, while simultaneously assuming that the actors would have made identical decisions based on different criteria.

And the reason that's important brings me back to my first point–built-in constraints are the only way to solve this sort of thing, which is the same reasoning the founders used to try to place constraints on American politicians.

Lack of fear of penalties is likely why this happened in the first place. Regardless I should not have used the term low-lifes. I'm fairly sure it's not the appropriate kind of discourse for this place.

> One could argue that they aren't necessarily low-lifes: I'd wager many, many people would abuse such power if they could.

The fact that there may be more of them does not change that they are low-lifes.

Sure, but then we wind up having to broadly categorize most people as low-lifes. Which may be true, but that's all the more reason to construct a system that can survive them, not a system that falls apart when representative human beings are part of it.

There are very few examples of punishment or loss of licensure related to HIPPA violations (at least the last time I looked into it, to calm my RN wife that she didn't violate HIPPA and even if she did, her life isn't over.)

I'm interested to know how your system ensures that anyone accessing PII goes through the system. Don't sysadmins have full access to the db? When you are granted access, can you see the full table or just the row about this user?

It's not that hard to keep all PII encrypted in the DB. Ideally, PII should only be decrypted inside your application.

Though at a minimum https://en.wikipedia.org/wiki/Transparent_Data_Encryption should be used.

Of course you do. They still don't know what Snowden has.

Reply on news.ycombinator.com