Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Can you please give me a legitimate use case where you would have the ID of a medical case without also having the Date/Time of that corresponding record?


It's not that you can't possess the timestamp of an event. It's that you can't publish certain things that are deemed potentially identifiable.

Dates are specifically cited as potential vectors for de-anonymization. For example, you can't disclose that "Bob H presented to the clinic on October 10th" because that's a lot of information that can be used to find out who Bob H is.

Here's a practical example of what I'm talking about. Suppose you have an app for physicians that allows them to message each other to discuss a case. They can share relevant information for diagnostic purposes, e.g., "34y/o male from the southern Louisianna presented with a rash." They share de-identified photos and chat about ddx, treatment protocol, etc. All of that is cool. However, if the record of that visit is identified with a UUIDv7, and that ID is used as part of the URL you've exposed the time of the visit, and that would be a problem.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: