Hacker News Reader

Well somehow PCI compliance seems to work well enough for credit card payment processing. But what happens is, the payment handling is passed off to a vendor, so not every company has to get things right in house.. I wonder if that can be a solution here.. medical data is handled by external vendors.

View on HN

PCI compliance works because of the aligned financial interests of the actors.

Most kinds of compliance are linked to legal costs as the ultimate source of consequences, not so for PCI.

The ultimate costs for failing to comply with PCI are the actual costs of card fraud which don’t depend on anything in the legal system. When your regulations are designed and enforced by the entity that actually loses money when they aren’t followed, motivation lines up and they work better.

Good point. It seems like it might be hard for regulations to be designed and enforced by the losers of personal medical data leaks.

Credit card data is relatively small cardinality and easy to predict the form of.

Medical data is... not that

Reply on news.ycombinator.com