It just occurred to me that cleaning up our country's data privacy / data ownership mess might have extraordinarily positive second-order effects on our Kafkaesque and criminally expensive healthcare "system".

Maybe making it functionally impossible for there to be hundreds of middlemen between me and my doctor would be a... good thing?

A national identity service, like a normal mature economy, would be a massive public policy and public health win.

But it'd slightly decrease profits. So of course is quite impossible to implement.

Pre-HIPPA, the hospital would tell a news reporter about your status. Now, drug marketing companies know about your prescriptions before your pharmacy does.

In attendance were marketing, biz dev, execs. Ours and theres. But no legal. Hmmm.

And it would have worked if it weren't for those meddling teenagers.

From your comment, I'm inferring they're now allowed to use health records for marketing.

On the would-be due date, a box arrived via FedEx of Enfamil samples and a chirpy “welcome baby” message. Of course there was no baby.

It turns out that using prescription data, admission data and other information that is aggregated as part of subrogation and other processes, you can partially de-anonymize/rebuild / health record and make an inference. Enfamil told me what list they used and I bought it, it contained a bunch of information including my wife’s. I also know everyone in my zip code who had diabetes in 2015.

There’s even more intrusive stuff around opioid surveillance.

> Emfamil samples...

Insult to injury. They're all just ghouls. Profitting from other people's pain.

> what list they used

Who watches the watchers? Nobody.

We had an instance of Lexis/Nexus' (formerly Seisent) demographic database to play with. Most people just can't wrap their heads around how bad things were in the mid-aughts. I was called a "sweaty paranoid kook" by our local paper for simply describing how things worked (no opinion or predictions).

Oh well. Maybe society has started to recognize what's happened.

Thanks for reading my rant. Peace.

Can you please explain more about this or point me towards a source?

Worked on EMRs (during the aughts). Had yearly HIPAA and other security theater training. Not optional for any one in the field.

Of course we had root access. I forget the precise language, but HIPAA exempts "intermediaries" such as ourselves. How else could we build and verify the system(s). And that's why HIPAA is a joke.

Yes, our systems had consent and permissions and audit logs cooked in. So theoretically peeking at PII could be caught. Alas, it was just CYA. None of our customers reviewed their access logs.

--

I worked very hard to figure out how to protect patient (and voter) privacy. Eventually conceded that deanon always beats anon, because of Big Data.

I eventually found the book Translucent Databases. Shows how to design schemas to protect PII for common use cases. Its One Weird Trick is applying proper protection of passwords (salt + hash) to all other PII. Super clever. And obvious once you're clued in.

That's just 1/2 of the solution.

The other 1/2 is policy (non technical). All data about a person is owned by that person. Applying property law to PII transmutes 3rd party retention of PII from an asset to a liability. And once legal, finance, and accounting people get involved, orgs won't hoard PII unless it's absolutely necessary.

(The legal term "privacy" means something like "sovereignty over oneself", not just the folk understanding of "keeping my secrets private.)

please, do tell me, where "estimating better pricing models to extract more profit" fit into those?

> Doctor writes script -> EHR -> Pharmacy -> Switch -> Clearinghouse —> PA Processing -> PBM/Plan makes determination

All the OP mentions happens way after the fact of those paths you described. People have already been charged. Treatment was already decided.