As I read your comment, I had a growing expectation that you were about to express horror at the mass gathering and warehousing of individuals' health data. I was very surprised when you expressed such excitement at the prospect.
Good call. It was a mistake for me to post such a once-sided comment.
> And while you might assume that this information is legally protected the same way your hospital and medical records are, that’s not necessarily the case.
https://www.consumerreports.org/health-privacy/are-health-ap...
I don't understand why you think there is a difference between taking a health reading at your doctors office and having it included in your patient chart, or taking a reading at your house and having that included in your patient chart. I'm wondering if I'm missing something that is just being unsaid.
Let's say it is a blood pressure reading taken by your Fitbit and uploaded to Google's servers. That data is not subject to HIPAA regulations. When your doctor takes your blood pressure and records it in your chart, it is subject to those regulations (as you say, it would be wildly unethical for them to sell it).
Separately, even if the two scenarios were subject to the same regulations, I would still expect the doctor's office scenario to be more secure. I think that any given patient's home network/device/security practices are more lax than those of most healthcare organizations.
You can be HIPAA compliant and on Google servers.
Perhaps this is not an inherent downside to the data security, but it's a reality with the current medical system and regulation does play a part in how we got here. And there is no financial incentive for hospitals to fix these sort of issues, in fact there is a disincentive (I'm doing another EEG now...). So I just don't see how it gets fixed without some outside disruption.
It may not be a popular opinion on HN but I'm much more concerned with having access to my own medical information than how secure it is.
For the most part security for healthcare systems is like security for government systems. A lot of checkbox marking and little real security. Just look at the large number of successful ransomware attacks against healthcare organizations. Having at one time worked in health informatics and from observing the practices at my healthcare providers I am not confident my data is anymore protected at a doctor's office.
If I needed to get one person’s medical information, I think I’d I have a higher likelihood of getting it from their medicine cabinet or snooping on their devices or search history.
If I needed the information of many people, I’d target the doctor. But even then, the goal typically isn’t to leak anyone’s information, it’s to get money from the healthcare provider and the information stays secret, theoretically.
Not really disagreeing with you just rambling.
They key thing is, as always, ensuring that your data remains your property. Europe is bigger on that than the US.
So if your doctor is part of a larger health system or uses an EMR system odds are that all your data is bundled up and sold. It’s not identifiable easily, but is still sold and used.