Timothy C. May wrote: <good arguments for using cash deleted>
- temporal extent implies record-keeping, such as insurance records, hospital visits, etc. This is automatically a potential privacy concern.
Yes, but... An insurance company would hardly accept a totally anonymous agent as a customer, for obvious reasons (how would they know that the agent was paid for by the body needing repair and not used for an unfortunate uninsured friend?). Now, if there was only one insurance agency thad had to pay for everyone anyway, that agency wouldn't have to trust the patients, 'only' the doctors (to deliver the true figures of their care production) and so wouldn't necessarily have to be given the identities of patients. Such a system has other implications not belonging in this discussion but this is just to show that no simle rules apply. (In the present situation all insurance companies are so mixed up with each other in reinsurances that in a way they are a single entity.)
(And when the contract is more than just patient-doctor, but involves other payers, the records-keeping mushrooms. When the government is the ultimate payer, through mandatory plans, they'll have the records. No amount of crypto can possibly change that.)
Yes, since doctors are not to be trusted the ultimate payer needs records. So they get to know that unit SSN XYZ has been given treatment amounting to DRG (Diagnose Related Group - the system widely used by insurance entities to equalize and minimize costs, which can be used by doctors to 'diagnose' mostly the profitable entries) 384 (abortion, spontaneous or provocated - detailed like this to enable easy record- raiding by the DRG police, I guess). Crypto no use? Perhaps, but ... Suppose those Central Records are encrypted in layers. The DRG Paymasters have the key to the outermost layer so they can read: A patient, anon-9Aq7r, was treated by dr Bob Livingstone for DRG-New XY, where XY only points to the costs without diagnose, at a specified date. They pay Joe what they owe him. If they suspect him of grand fraud he is asked to reveal the key to the next layer, where the identity (no SNN needed, only name and address) of Alice is in the open. The Paymasters can now ask Alice if she was treated by Bob Livingstone at the specified date. If they suspect Bob of salting his bills they have to ask a court for permission to request his second key, further opening the records to reveal DRG-Old 384, making it possible to check with Alice if she was treated for abortion, spontaneous or (e g AND) provocated. If they suspect Alice of collaborating with Bob in a scam they have to ask another (higher) court for permission to request Alice's key, the only key to open the actual treatment records (if these are falsified, well...). This scheme is not a proposal, I just thought it up for the moment, and has several obvious flaws. Like if Alice lies when the Paymasters approach her, or just says 'no comment' or refuses to give away her key. But some scheme might be possible that at least makes it more difficult for the ultimate payer to invade privacy, still keeping an eye on money-hungry doctors.
(When a patient pays cash, no problem. When a central service is used, opportunities for fraud increase. Doctors with ghost patients, kickbacks, etc. Any central-payment system must then have records and investigations at that central point. Hence, a central bureaucracy. Hence, a loss of privacy at that level.)
One problem with cash here is of course the high costs of helth care, making it necessary for almost everybody to be insured if they are not suicidal or willing to gamble their lifes. Another problem is the unconsious-patient situation - or half-consious, might be hard to remember the password to the e$ anonymous account. These are general arguments. I have no opinion in the specific case of the NHCP, a very domestic US discussion. Mats