Hacker News Reader

Comment by lbacaj | Hacker News Reader

As someone who currently works in healthcare tech I can tell you that taking on health records is one of the riskiest things any company could ever do. In fact we try to keep health records as isolated as technically, and humanly, possible.

For each HIPAA violation a company will be fined $10,000 dollars per customer. If ten million records on a database are part of a breach the company can be out of business.

It boggles the mind that anyone would want to take on that liability.

https://www.hhs.gov/hipaa/for-individuals/guidance-materials...

View on HN

It takes more than storing medical data to be covered by HIPAA. Usually you have to be a medical provider or have a business agreement with a medical provider. If I upload an MRI scan to imgur, imgur isn't instantly governed by HIPAA.

This means data harvesting companies can siphon up this stuff where they can find it. As long as they don't have a particular contractual relationship with an actual hospital, it's just like any other data, and they're not governed by HIPAA.

There may be some other ways to get governed by HIPAA, but that's the general rule. It's hard to do by accident.

Data brokers aren't interested in a couple of records here or there of x-rays from Imgur.

They want millions of records with some kind of identifier, and some kind of predictive value. Eg. The number of ice creams I buy might be a good predictor of if I'll be buying diabetes treatment next year.

Without all 3, your data won't be used.

As someone else who works in HealthTech, I'd expect someone else in HealthTech talking about HIPAA would mention that HIPAA only applies to Covered Entities.

Doom Eternal is not a Covered Entity (unless they're doing something crazy) and would not be subject to HIPAA in any capacity. This is either an overly protective lawyer or in reaction to a different, non-HIPAA data law.

We need more laws about this for financial data, surfing history, customer purchase data, location data etc.

Hoarding customer data should be a liability!

As a software developer I personally refuse to work on HIPAA compliant software, because if there is a HIPAA violation I can be held liable.

The problem with software and leaks from it is that not all software holds developers liable. It really really need to change.

I'm guessing you don't work in software. There will always be leaks, it's the nature of the beast, building things way more complicated than any single person can fully comprehend.

That's why data minimization is so important, only keeping what you absolutely need.

Every single field has figured out - sometimes forcefully - how to minimize harm to consumers. From a properly grounded toaster to a bridge, other industries manage to build complex things that don't hurt people.

The nature of the beast is that its nature can change. We need to stop thinking software is somehow special, we're just more careless and face fewer consequences following catastrophic failure.

> Every single field has figured out - sometimes forcefully - how to minimize harm to consumers.

I think it would be more accurate to say every field has figured out how to minimize liability from harm to customers. Data collection makes companies money, and there's little liability involved in most cases if you aren't in the health sector, so they grab all the data whether their core business needs it or not. The health sector needs some data because sharing it is vitally important, and they've shown that it takes a massive amount of time and money and complexity to do it to any acceptable level.

If we had some way to accurately value our data and privacy, and laws that made it the property of the individual, we would see a change very quickly.

Reply on news.ycombinator.com