[Xeoncross]

Restrict data collection? It would kill all startups and firmly entrance a terrible provider monopoly who can comply.

Have the government own data collection? Yeah, I don't even know where to start with all the problems this would cause.

Ignore it and let companies keep abusing customers? Nope.

Stop letting class-action lawsuits slap the company's wrists and then give $0.16 payouts to everyone?

What exactly do we do without killing innovation, building moats around incumbents, giving all the power to politicians who will just do what the lobbyists ask (statistically), or accepting things as is?

[nemomarx]

Why do the start ups need to collect data like this?

[thinkingtoilet]

I work for a medical technology company. How do you propose we service our customers without their medical data?

[troupo]

We apply crippling fines on companies and executives that let these breaches happen.

Yes, some breaches (actual hack attacks) are unavoidable, so you don't slap a fine on every breach. But the vast majority of "breaches" are pure negligence.

[apercu]

> Restrict data collection? It would kill all startups and firmly entrance a terrible provider monopoly who can comply.

That's a terrible argument for allowing our data to be sprayed everywhere. How about regulations with teeth that prohibit "dragons" from hoarding data about us? I do not care what the impact is on the "economy". That ship sailed with the current government in the US.

Or, both more and less likely, cut us in on the revenue. That will at least help some of the time we have to waste doing a bunch of work every time some company "loses" our data.

I'm tired of subsidizing the wealth and capital class. Pay us for holding our data or make our data toxic.

Obviously my health provider and my bank need my data. But no one else does. And if my bank or health provider need to share my data with a third party it should be anonymized and tokenized.

None of this is hard, we simply lack will (and most consumers, like voters are pretty ignorant).

[logicchains]

The solution is to anonymize all data at the source, i.e. use a unique randomized ID as the key instead of someone's name/SSN. Then the medical provider would store the UID->name mapping in a separate, easily secured (and ideally air-gapped) system, for the few times it was necessary to use.

[dredmorbius]

...use a unique randomized ID as the key...

33 bits is all that are required to individually identify any person on Earth.

If you'd like to extend that to the 420 billion or so who've lived since 1800, that extends to 39 bits, still a trivially small amount.

Every bit[1] of leaked data bisects that set in half, and simply anonymising IDs does virtually nothing of itself to obscure identity. Such critical medical and billing data as date of birth and postal code are themselves sufficient to narrow things down remarkably, let alone a specific set of diagnoses, procedures, providers, and medications. Much as browser fingerprints are often unique or nearly so without any universal identifier so are medical histories.

I'm personally aware of diagnostic and procedure codes being used to identify "anonymised" patients across multiple datasets dating to the early 1990s, and of research into de-anonymisation in Australia as of the mid-to-late 1990s. Australia publishes anonymisation and privacy guidelines, e.g.:

"Data De‑identification in Australia: Essential Compliance Guide"

<https://sprintlaw.com.au/articles/data-de-identification-in-...>

"De-identification and the Privacy Act" (2018)

<https://www.oaic.gov.au/privacy/privacy-guidance-for-organis...>

It's not merely sufficient to substitute an alternative primary key, but also to fuzz data, including birthdates, addresses, diagnostic and procedure codes, treatment dates, etc., etc., all of which both reduces clinical value of the data and is difficult to do sufficiently.

________________________________

Notes:

1. In the "binary digit" sense, not in the colloquial "small increment" sense.

[nradov]

What a silly idea. That would completely prevent federally mandated interoperability APIs from working. While privacy breaches are obviously a problem, most consumers don't want care quality and coordination harmed just for the sake of a minor security improvement.

https://www.cms.gov/priorities/burden-reduction/overview/int...

[gassi]

[deleted]

[ourmandave]

Honestly I'd take the 16 cents. Usually its a discount voucher on a product you'd never buy.

Or if it's a freebie then it's hidden behind a plain text link 3 levels deep on their website.