Hacker News Reader

Comment by Shivetya | Hacker News Reader

Sadly this is no guarantee as the news is replete with stories of people finding medical records in trash or abandoned in close facilities.

However since no system is perfect laws have to exist to prevent the information from being used by others except as how authorized by the law; examples would be preventing prospective employers from using it to filter candidates, housing agencies would be similar restricted. The same law would put in place a means to force it to be removed from any site hosting the information.

The key take away is we cannot guarantee full protection but we minimize the damage caused

View on HN

Records-in-trash take considerable work to access, parse, transmit, and duplicate.

Digital data are immensely reproducible.

Motivated adversaries may be motivated. Ask Dan.

https://www.smithsonianmag.com/history/the-worlds-most-famou...

It also vastly decreases the feasible number of attackers. Digital records means you are vulnerable to criminals globally, particularly ones from places that don’t care so much about US law. Paper records in the trash are vulnerable to an extremely localized threat.

Quite.

If you can access it from anywhere (or your healthcare provider, other white hats, etc.), so can the black (or grey, or red, or geen,...) hats.

Yeah, but what's the scenario where isolated medical records put in trash turn into a massive extortion scheme like this?

It even turning into a small-scale extortion scheme seems unlikely. Records are in trash AND someone finds them in trash in the relatively brief period before they wind up landfilled or incinerated, AND they decide to take them and track down the people who they belong to for purposes of extortion? I mean, sure, it could happen, and it's not a good thing for medical records to be in the trash. There are no "guarantees".

Physical records are clearly much much lower risk though.

The employment/housing/financing impact is too real, too deep, and too damn important. Change. A change gonna come.

Many therapists don't write names in their psychotherapy notes, and instead use initials, and store them separately from records that require identifying information. It could be possible, but difficult to identify people from these records -- certainly not on a large scale like has happened here.

Reply on news.ycombinator.com