Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NHS England patient data 'uploaded to Google servers', Tory MP says

theguardian.com

Post reply on HN
Print view View original

101–110 of 184 posts

Re: NHS England patient data 'uploaded to Google servers', Tory MP says

#101

Post by DanBC »

swombat wrote: post #5

Surely PA Consulting should immediately be sued out of existence. This kind of behaviour must be considered beyond negligent, practically criminal. I would strongly support throwing anyone involved in this into jail for a long time as a deterrent against future criminals. This is just unbelievable.

It's hard to know from the article just what happened and what data was uploaded.

But, even though they got approval, they may have committed a criminal offence.

This data initiative is really important. They've got to do something to win back trust. Someone has to lose a job and someone has to go to jail (if a crime was committed).

Re: NHS England patient data 'uploaded to Google servers', Tory MP says

#102

Post by Silhouette »

nly wrote: post #78
anon1385 wrote: post #36

Earlier quoted context omitted.

>What specifically are people actually afraid of with regard to this data set? I just don't get the regular public outcry about NHS data. Well specifically it would be all the sensitive medial information which for some reason you omitted to mention in your comment. People are only talking about DOB and post codes because that information can be used to identify an individual and associate them with the medical recor…

Apologies, I should have specified I meant on Googles servers. The HES database contains attendence records. You only need a a single verified data point, such as a tabloid hack following you to the hospital one day, to remove pseudoanonymity. The debate over whether pseudoanonymised records or personalised records should be made available to organisations, in real terms, isn't distinct. You still only need one data…

Outrage is being misdirected.

No, there is plenty of justification for outrage all round. The NHS staff shouldn't have given the data to an untrustworthy organisation. That organisation shouldn't have given it to a data mining company under the jurisdiction of a foreign government. And that data mining company and foreign government will deserve similar outrage if they don't properly delete the illegally uploaded data as soon as possible after they are properly notified of the circumstances.

It wasn't necessary to share these records like this. You seem to be confusing access by clinicians, or at least legitimate medical researchers subject to similar medical ethics and confidentiality rules, with (as now alleged) just leaving it out there for literally anyone to find it.

Perhaps you aren't outraged by this, but I'll bet most people with a sensitive medical condition that might lead to unjustified discrimination would be. First they came for the HIV-positive, but I was not HIV-positive and I said nothing.

Re: NHS England patient data 'uploaded to Google servers', Tory MP says

#103

Post by raldi »

Silhouette wrote: post #97
morgante wrote: post #82

I don't understand why the data being on "Google servers" is generating such outrage. Google almost certainly has superior security to this "PA Consulting" or even the government itself.

I don't understand why the data being on "Google servers" is generating such outrage. Because Google's systems demonstrably aren't secure (see numerous recent discussions about NSA etc.) and therefore aren't an appropriate choice to transmit or store sensitive personal data under UK data protection rules.

Is your concern that the NSA itself is targeting British health records? If so, what makes you think anyone else is better prepared for this adversary?

Or, if you're talking about someone other than the NSA (which you allude to with your use of "etc"), then who is it? What are they going to do, and why do you feel it's demonstrably more likely to happen with the data on Google's servers? Where would you put the data instead, and how would this help reduce the likelihood of the scenario?

"On a powered-down hard drive in a vault" doesn't count; presumably, PA was given the contract because the potential benefits of the research were believed to outweigh the privacy risks.

Re: NHS England patient data 'uploaded to Google servers', Tory MP says

#104

Post by easyfrag »

morgante wrote: post #82

I don't understand why the data being on "Google servers" is generating such outrage. Google almost certainly has superior security to this "PA Consulting" or even the government itself.

I don't think Americans get how distrustful other nations are of American-based cloud providers. It is not a matter of Google's or any other providers' behaviour but of the US Government (warrant-less searches and the like). This lack of trust predates the current NSA-Snowden affair and goes back to the Patriot Act (IMHO).

Of course I can't speak for all nations or industries (or even companies) but in my part of the Canadian Health care sector it is simply unthinkable to use a US-based cloud provider for anything to do with patient data.

Re: NHS England patient data 'uploaded to Google servers', Tory MP says

#105

Post by Silhouette »

adamrneary wrote: post #50

The shame of all of this noise is that resources going into medical research today ends up getting spent on data security and building expensive, custom solutions that avoid using servers of a certain type or location in the name of privacy. Sure, it would be more secure to conduct medical research without using computers at all, but what about all those people dying of nasty diseases? If I had 6 months to live, I pr…

The shame of all of this noise is that resources going into medical research today ends up getting spent on data security and building expensive, custom solutions that avoid using servers of a certain type or location in the name of privacy.

If the various disclosures, legal or not, actual or planned, actually had anything to do with legitimate clinical care or medical research, I think a lot of us would look more kindly upon them. There seems to be little evidence that this is the case, and plenty of evidence that the data was or was going to be disclosed, for profit, to organisations who are not involved in either direct clinical care or legitimate medical research, such as insurers and foreign governments.

Re: NHS England patient data 'uploaded to Google servers', Tory MP says

#106

Post by [deleted] »

DanBC wrote: post #101
swombat wrote: post #5

Surely PA Consulting should immediately be sued out of existence. This kind of behaviour must be considered beyond negligent, practically criminal. I would strongly support throwing anyone involved in this into jail for a long time as a deterrent against future criminals. This is just unbelievable.

It's hard to know from the article just what happened and what data was uploaded. But, even though they got approval, they may have committed a criminal offence. This data initiative is really important. They've got to do something to win back trust. Someone has to lose a job and someone has to go to jail (if a crime was committed).

[deleted]

Re: NHS England patient data 'uploaded to Google servers', Tory MP says

#107

Post by easyfrag »

k-mcgrady wrote: post #13

Why does the government repeatedly hire incompetent people?? They pay crazy amounts of money for it too. I hope there is a very public investigation into this. We are losing privacy every day now and this is one area of our lives that needs to remain private at all costs. There is very little I can see to gain and lots to lose from losing privacy in health. Especially in a public system like the NHS.

I think there's 2 reasons: Often times the services are contracted out and those contracts are often subject to "lowest bid wins" rules. It is very difficult to judge a quality like competence especially when there's differing interpretations of purchasing legislation involved.

The other reason is that it is often difficult to fire people in the public sector. I believe it to be due to the impact of unions, which will protect even the most egregious offender out of principle. This builds a culture around being hard to get rid of people, even if it is a non-union position the HR process of dismissal is often the same. For example public bodies often have a lot of employee supports (Employee Assistance programs,etc) and before you dismiss anyone you must allow them to avail of these supports.

Re: NHS England patient data 'uploaded to Google servers', Tory MP says

#108

Post by Silhouette »

raldi wrote: post #103
Silhouette wrote: post #97

Earlier quoted context omitted.

I don't understand why the data being on "Google servers" is generating such outrage. Because Google's systems demonstrably aren't secure (see numerous recent discussions about NSA etc.) and therefore aren't an appropriate choice to transmit or store sensitive personal data under UK data protection rules.

Is your concern that the NSA itself is targeting British health records? If so, what makes you think anyone else is better prepared for this adversary? Or, if you're talking about someone other than the NSA (which you allude to with your use of "etc"), then who is it? What are they going to do, and why do you feel it's demonstrably more likely to happen with the data on Google's servers? Where would you put the data…

The NSA specifically isn't the point, though I do believe their blanket surveillance of the Internet (and the similar surveillance by other government spy agencies such as our own GCHQ) should be considered a hostile act and incur a proportionate response. I simply don't accept that there is any ethical legitimacy to such dragnet programmes or that they bring more benefit than the risk they obviously pose to free, peaceful, democratically governed civilisation.

In any case, Google aren't a part of any government. They are a private, profit-making corporation, and they are in the business of collecting as much data on people as possible for their own benefit, and they evidently cannot comply with the restrictions on handing personal data required by UK law even if they want to. Providing this kind of treasure trove to them should be unthinkable.

Re: NHS England patient data 'uploaded to Google servers', Tory MP says

#109

Post by yapcguy »

boomzilla wrote: post #72
atmosx wrote: post #37

Earlier quoted context omitted.

So apparently they don't have money to spend on building a secure, state-owned cloud storage service for patient records right? I wonder, does the GCHQ use private cloud storage contractors or for spying material the government found money to create an appropriate database? :-)

This is just crazy. According to the article, this "big data" fits in 27 DVDs, which is roughly 1-2 TB of data. Do you really need Big Query or whatever for this?

50 x 50GB blu-ray discs, for over 2TB of storage, only costs $126 at Amazon.

A 2TB portable USB drive costs $100.

But no, let's just upload everything to Google Drive.

Re: NHS England patient data 'uploaded to Google servers', Tory MP says

#110

Post by ataggart »

swombat wrote: post #5

Surely PA Consulting should immediately be sued out of existence. This kind of behaviour must be considered beyond negligent, practically criminal. I would strongly support throwing anyone involved in this into jail for a long time as a deterrent against future criminals. This is just unbelievable.

Taking a sentient human being and throwing them in a cage is a profoundly violent act. I find it troubling that you guys so casually reach for it as a punitive tool, particularly when the subject has neither committed physical violence nor poses such a threat to others. Surely you clever people can think of forms of punishment/deterrence less destructive to both the individual and society as a whole.
Post reply on HN