From: Mats Bergstrom <matsb@sos.sll.se>
Date: Sat, 13 Aug 94 12:42:34 PDT
To: cypherpunks@toad.com
Subject: Re: Why Cash is So Important
In-Reply-To: <199408121740.KAA01304@netcom5.netcom.com>
Message-ID: <Pine.3.85.9408131440.A23299-0100000@cor.sos.sll.se>
MIME-Version: 1.0
Content-Type: text/plain



Timothy C. May wrote:

<good arguments for using cash deleted>

> - temporal extent implies record-keeping, such as insurance records,
> hospital visits, etc. This is automatically a potential privacy
> concern.

Yes, but...  An insurance company would hardly accept a totally
anonymous agent as a customer, for obvious reasons (how would they
know that the agent was paid for by the body needing repair and not
used for an unfortunate uninsured friend?). Now, if there was only
one insurance agency thad had to pay for everyone anyway, that
agency wouldn't have to trust the patients, 'only' the doctors (to
deliver the true figures of their care production) and so wouldn't
necessarily have to be given the identities of patients. Such a
system has other implications not belonging in this discussion but
this is just to show that no simle rules apply.

(In the present situation all insurance companies are so mixed up
with each other in reinsurances that in a way they are a single entity.)

> (And when the contract is more than just patient-doctor, but involves
> other payers, the records-keeping mushrooms. When the government is
> the ultimate payer, through mandatory plans, they'll have the records.
> No amount of crypto can possibly change that.)

Yes, since doctors are not to be trusted the ultimate payer needs
records. So they get to know that unit SSN XYZ has been given treatment
amounting to DRG (Diagnose Related Group - the system widely used by
insurance entities to equalize and minimize costs, which can be used by
doctors to 'diagnose' mostly the profitable entries) 384 (abortion,
spontaneous or provocated - detailed like this to enable easy record-
raiding by the DRG police, I guess).

Crypto no use? Perhaps, but ... Suppose those Central Records
are encrypted in layers. The DRG Paymasters have the key to the
outermost layer so they can read: A patient, anon-9Aq7r, was
treated by dr Bob Livingstone for DRG-New XY, where XY only points
to the costs without diagnose, at a specified date. They pay Joe
what they owe him. If they suspect him of grand fraud he is asked to 
reveal the key to the next layer, where the identity (no SNN needed,
only name and address) of Alice is in the open. The Paymasters
can now ask Alice if she was treated by Bob Livingstone at the
specified date. If they suspect Bob of salting his bills they
have to ask a court for permission to request his second key,
further opening the records to reveal DRG-Old 384, making it possible
to check with Alice if she was treated for abortion, spontaneous  
or (e g AND) provocated. If they suspect Alice of collaborating
with Bob in a scam they have to ask another (higher) court for
permission to request Alice's key, the only key to open the actual
treatment records (if these are falsified, well...).

This scheme is not a proposal, I just thought it up for the moment,
and has several obvious flaws. Like if Alice lies when the Paymasters
approach her, or just says 'no comment' or refuses to give away her
key. But some scheme might be possible that at least makes it more
difficult for the ultimate payer to invade privacy, still keeping
an eye on money-hungry doctors. 

> (When a patient pays cash, no problem. When a central service is used,
> opportunities for fraud increase. Doctors with ghost patients,
> kickbacks, etc. Any central-payment system must then have records and
> investigations at that central point. Hence, a central bureaucracy.
> Hence, a loss of privacy at that level.)

One problem with cash here is of course the high costs of helth care,
making it necessary for almost everybody to be insured if they are
not suicidal or willing to gamble their lifes. Another problem is the
unconsious-patient situation - or half-consious, might be hard to
remember the password to the e$ anonymous account. 

These are general arguments. I have no opinion in the specific case
of the NHCP, a very domestic US discussion.


Mats