My spouse works as psychotherapist. She has ever only used pen & paper for patient notes for exactly this reason. No digital service is unhackable, and the cases where you would actually need to access patient notes in electronic form are quite rare.

Sadly this is no guarantee as the news is replete with stories of people finding medical records in trash or abandoned in close facilities.

However since no system is perfect laws have to exist to prevent the information from being used by others except as how authorized by the law; examples would be preventing prospective employers from using it to filter candidates, housing agencies would be similar restricted. The same law would put in place a means to force it to be removed from any site hosting the information.

The key take away is we cannot guarantee full protection but we minimize the damage caused

Records-in-trash take considerable work to access, parse, transmit, and duplicate.

Digital data are immensely reproducible.

Motivated adversaries may be motivated. Ask Dan.

https://www.smithsonianmag.com/history/the-worlds-most-famou...

It also vastly decreases the feasible number of attackers. Digital records means you are vulnerable to criminals globally, particularly ones from places that don’t care so much about US law. Paper records in the trash are vulnerable to an extremely localized threat.

Quite.

If you can access it from anywhere (or your healthcare provider, other white hats, etc.), so can the black (or grey, or red, or geen,...) hats.

Yeah, but what's the scenario where isolated medical records put in trash turn into a massive extortion scheme like this?

It even turning into a small-scale extortion scheme seems unlikely. Records are in trash AND someone finds them in trash in the relatively brief period before they wind up landfilled or incinerated, AND they decide to take them and track down the people who they belong to for purposes of extortion? I mean, sure, it could happen, and it's not a good thing for medical records to be in the trash. There are no "guarantees".

Physical records are clearly much much lower risk though.

The employment/housing/financing impact is too real, too deep, and too damn important. Change. A change gonna come.

Many therapists don't write names in their psychotherapy notes, and instead use initials, and store them separately from records that require identifying information. It could be possible, but difficult to identify people from these records -- certainly not on a large scale like has happened here.

IMHO using separate computer not connected to any network, locked in cabinet, should be safe enough.

Agree on this point. Some computers just should not be internet connected. Security is the wild west right now and isn't going to be fixed any time soon.

Perhaps they should simply store patients as numbers.

That would help, but metadata is a powerful thing. The relations, tendencies, and activities of someone, particularly the kind of notes (I imagine) are kept for therapy subjects, would be a treasure trove even with some subject indirection.

That tends to not work very well: https://www.nytimes.com/2006/08/09/technology/09aol.html

Unfortunately you need surprisingly little data to uniquely identify someone. For example, sex, date of birth, and zip code can uniquely identify a large swath of the general public.

http://latanyasweeney.org/work/identifiability.html

So removing the unnecessary date of birth and zip code, problem solved.