On the Third Hand: Health privacy

Katie Benner is reporting in Bloomberg, for example, that one health care company has about 15,000 suppliers with access to its network and enough of a network security budget to audit 12 of those suppliers each year.

When Harry Houdini was working as an escape artist, he encouraged the people who were supposed to tie him up to maximize use of rope. Using lots of rope made it look as if he was tied up especially well. In reality, in most cases, the more rope the knotmakers used in their knots, the looser the knots probably were.

In the case of the Health Insurance Portability and Accountability Act (HIPAA) health information privacy and date security requirements, intelligent, well-meaning policymakers have devoted so much rope to protecting health information that the knots are too loose. People with routine information are inconvenienced, and may end up taking actions (such as writing passwords on notes taped by their work computers) that expose their data to anyone who puts any effort into getting their data.

Meanwhile, the people with genuinely sensitive information may end up with little or no protection coming from measures such as encryption and data security audits, because the need for general audits for everyone is too vast for anyone to have time to focus security resources on the people who really need privacy.

Maybe one solution would be to let people choose whether to ask for extra privacy protection or extra convenience. Maybe saving money on the extra-convenience consumers would expand the resources available to help the extra-privacy consumers.