Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Medical cannabis patient data exposed by unsecured database

wired.com

Post reply on HN
Print view View original

31–40 of 73 posts

Re: Medical cannabis patient data exposed by unsecured database

#31

Post by hx8 »

adi4213 wrote: post #13
sailfast wrote: post #4

So are people storing these things in a non-HIPAA-compliant way or is this mostly attributable to some other vector that would not have been helped by compliance? What a terrible leak - med records and marijuana use, especially in some circles - could be very useful blackmail material. :/

I think there are even more basic table stakes that were missed here well prior to conducting any manner of formal compliance auditing - like unauthenticated users accessing this database!

Sure, but if it was a HIPPA compliance issue then the legal action path is easier and more lucrative.

Re: Medical cannabis patient data exposed by unsecured database

#32

Post by [deleted] »

aspenmayer wrote: post #28
yieldcrv wrote: post #27

Earlier quoted context omitted.

You cash out in your personal account by launching a memecoin and buying a tiny bit on launch (or minting extra for yourself) the baked xmr funds are once again swapped into virgin addresses that all buy your memecoin, with your clean funds you sell your position into the liquidity pool of the pumped coin it looks the same as any other launch. are they bots, are they retail degens? who knows, pay capital gains tax an…

That isn’t cash, that’s just more crypto, or am I reading you wrong? The liquidity pool will get you back into mainline cryptos, but then what?

[deleted]

Re: Medical cannabis patient data exposed by unsecured database

#33

Post by eszed »

aspenmayer wrote: post #28
yieldcrv wrote: post #27

Earlier quoted context omitted.

You cash out in your personal account by launching a memecoin and buying a tiny bit on launch (or minting extra for yourself) the baked xmr funds are once again swapped into virgin addresses that all buy your memecoin, with your clean funds you sell your position into the liquidity pool of the pumped coin it looks the same as any other launch. are they bots, are they retail degens? who knows, pay capital gains tax an…

That isn’t cash, that’s just more crypto, or am I reading you wrong? The liquidity pool will get you back into mainline cryptos, but then what?

Sell your mainline crypto for money-money, and declare it on your taxes? Isn't that straightforward to do, nowadays? Not trying to be snarky: I've never been involved in crypto, but I thought I understood it in principle.

Sidenote: The GP's point was an Aha! moment for me about memecoins. I never got why anyone ever bought into these at all, but money laundering makes perfect sense.

Re: Medical cannabis patient data exposed by unsecured database

#34

Post by Krssst »

hacker_yacker wrote: post #29
recursive wrote: post #25

Earlier quoted context omitted.

This seems totally unrelated to whether cannabis should be recreational. If my insurance company leaked my PHI, that would certainly not be evidence that any of my prescriptions should be OTC.

IMHO only reason cannabis is illegal is it's a threat to Pharma Industry, Pharma Lobby, aka organized, legal crime.

Despite some of the discourse there are some long term side-effects (though it seems mostly especially bad for adolescents where stopping consumption does not revert the impact on cognitive function): https://en.m.wikipedia.org/wiki/Long-term_effects_of_cannabi...

Then it's a societal choice between the benefits of easier access to it for medical use (non-OTC drugs are harder to get when you need them) plus lower burden on law enforcement when it does not have to deal with this anymore, and the opportunity cost to society when some people don't use it responsibly and waste their chances. I see positives and negatives for both choices.

(I don't believe other drugs being legal is an argument, alcohol and tobacco wouldn't be legal if discovered today but because they have widespread use it's impossible to forbid them)

Re: Medical cannabis patient data exposed by unsecured database

#35

Post by time0ut »

sailfast wrote: post #4

So are people storing these things in a non-HIPAA-compliant way or is this mostly attributable to some other vector that would not have been helped by compliance? What a terrible leak - med records and marijuana use, especially in some circles - could be very useful blackmail material. :/

Medical marijuana dispensaries are not covered entities under HIPAA [0]. The way the law works is weird, but they are not required to comply. All the more reason the federal government needs to catch up with the times on cannabis.

[0] https://www.hhs.gov/hipaa/for-professionals/covered-entities...

Re: Medical cannabis patient data exposed by unsecured database

#36

Post by yieldcrv »

aspenmayer wrote: post #28
yieldcrv wrote: post #27

Earlier quoted context omitted.

You cash out in your personal account by launching a memecoin and buying a tiny bit on launch (or minting extra for yourself) the baked xmr funds are once again swapped into virgin addresses that all buy your memecoin, with your clean funds you sell your position into the liquidity pool of the pumped coin it looks the same as any other launch. are they bots, are they retail degens? who knows, pay capital gains tax an…

That isn’t cash, that’s just more crypto, or am I reading you wrong? The liquidity pool will get you back into mainline cryptos, but then what?

the liquidity pool will get you back into mainline cryptos, you transfer that back to your personal coinbase or any crypto exchange account, sell for your nation’s currency, transfer to your bank account.

can take a few minutes from liquidity pool to your bank account, to a few hours. several days in the worst case.

Re: Medical cannabis patient data exposed by unsecured database

#37

Post by yieldcrv »

eszed wrote: post #33
aspenmayer wrote: post #28

Earlier quoted context omitted.

That isn’t cash, that’s just more crypto, or am I reading you wrong? The liquidity pool will get you back into mainline cryptos, but then what?

Sell your mainline crypto for money -money, and declare it on your taxes? Isn't that straightforward to do, nowadays? Not trying to be snarky: I've never been involved in crypto, but I thought I understood it in principle. Sidenote: The GP's point was an Aha! moment for me about memecoins. I never got why anyone ever bought into these at all, but money laundering makes perfect sense.

you understand it

but one thing you’re missing is that people dont know which ones will be money laundered - or attract gobs of capital for unknown reasons - and go up in price wildly. so people play at all levels depending on their risk appetite since the profits from a coin being pumped are so wild.

these things launch with a marketcap in the low thousands, and run to marketcaps in the millions and billions for tens of thousands of % gains. its what retail has always wanted from the IPO market, but instead of waiting decades for every rule to slowly change with no sign of the private sector using those rules, they have the crypto ecosystem now and its been a hit.

as far as financial market innovation goes, the liquidity pool code is pretty novel and an active area of research and competition, a candidate of something to graduate to - or intertwine with - the traditional markets

Re: Medical cannabis patient data exposed by unsecured database

#38

Post by lmkg »

sailfast wrote: post #14
nickff wrote: post #12

Earlier quoted context omitted.

From some quick research, it seems unclear whether dispensaries are covered entities under HIPAA, as they are not reimbursed by Insurers, due to the federal illegality of the drug. https://mjbizdaily.com/do-medical-marijuana-companies-need-t...

Kinda incredible - even if they’re not covered providers they are still requesting medical records!

HIPAA is not a privacy law, nor even a healthcare law. It's an insurance law. It does not cover medical records generally. It deals strictly with how doctors bill insurance companies, and mandates security for health information being billed about.

For the same reason, health & wellness apps are not generally covered by HIPAA, and in fact quite a few of those exist solely for the purpose of selling medical data to data brokers. Especially ones related to women's health.

Re: Medical cannabis patient data exposed by unsecured database

#39

Post by aspenmayer »

yieldcrv wrote: post #36
aspenmayer wrote: post #28

Earlier quoted context omitted.

That isn’t cash, that’s just more crypto, or am I reading you wrong? The liquidity pool will get you back into mainline cryptos, but then what?

the liquidity pool will get you back into mainline cryptos, you transfer that back to your personal coinbase or any crypto exchange account, sell for your nation’s currency, transfer to your bank account. can take a few minutes from liquidity pool to your bank account, to a few hours. several days in the worst case.

This just in: cashing out is out, direct investment is in.

Bullish's $1.15B in IPO Proceeds Entirely in Stablecoins in Public Market First - https://news.ycombinator.com/item?id=44957496

Re: Medical cannabis patient data exposed by unsecured database

#40

Post by firefax »

recursive wrote: post #25
firefax wrote: post #11

Earlier quoted context omitted.

More evidence cannabis needs to be recreational. We can let people use their FSA money for it and/or give a steep discount to people who "really" need it, like cancer patients... but I think a lot of people who bounce between Anyways, there are a LOT of little fly by night outfits that "help" you get a medical card in many states. It's a joke, and all it does is empower the same type of person who used to be a pill d…

This seems totally unrelated to whether cannabis should be recreational. If my insurance company leaked my PHI, that would certainly not be evidence that any of my prescriptions should be OTC.

>This seems totally unrelated to whether cannabis should be recreational.

Basically, they only pretend it's "medical" in order to gatekeep and rentseek care. Since they are interested in profit rather than actual services, their systems tend to have many issues.

Post reply on HN