Records-in-trash take considerable work to access, parse, transmit, and duplicate.

Digital data are immensely reproducible.

Motivated adversaries may be motivated. Ask Dan.

https://www.smithsonianmag.com/history/the-worlds-most-famou...

It also vastly decreases the feasible number of attackers. Digital records means you are vulnerable to criminals globally, particularly ones from places that don’t care so much about US law. Paper records in the trash are vulnerable to an extremely localized threat.

Quite.

If you can access it from anywhere (or your healthcare provider, other white hats, etc.), so can the black (or grey, or red, or geen,...) hats.

Yeah, but what's the scenario where isolated medical records put in trash turn into a massive extortion scheme like this?

It even turning into a small-scale extortion scheme seems unlikely. Records are in trash AND someone finds them in trash in the relatively brief period before they wind up landfilled or incinerated, AND they decide to take them and track down the people who they belong to for purposes of extortion? I mean, sure, it could happen, and it's not a good thing for medical records to be in the trash. There are no "guarantees".

Physical records are clearly much much lower risk though.

The employment/housing/financing impact is too real, too deep, and too damn important. Change. A change gonna come.

Many therapists don't write names in their psychotherapy notes, and instead use initials, and store them separately from records that require identifying information. It could be possible, but difficult to identify people from these records -- certainly not on a large scale like has happened here.