Account Proliferation

Now days, when you get a job in an industry that pays half decent wages, they typically require you to setup an account with some web services.  Maybe it's Dropbox.  Perhaps it is Google.  One is probably a project or schedule management tool.  There are also plenty of job specific services you might need.  For software development, you will probably need an account with Github or some other software subversion repository.  Just to get a decent job, you typically need at least a Facebook account and a LinkedIn account.  If you change jobs, your new job will probably use a slightly different set of services, requiring you to setup several more accounts.  During your lifetime, you may go through 5 or 6 jobs (and that number seems to be increasing).  If each job requires you to sign up for 3 different web services, you will have 15 to 18 of them by you retire.  You will probably forget about at least half of them.  Most of the other half will be useless to a retiree

If you decide to get a college degree, you will also see this problem.  Your English teacher will probably expect you to sign up for an account with an anti-plagiarism service.  Your math teacher might encourage you to sign up for a free tutoring service, and advanced math teachers will want you to get an account with some company so you can get the student edition of their math software for cheap or free (and then you will be stuck only knowing how to use an extremely expensive piece of proprietary software; that's another discussion).  Many teachers like file repository software like Dropbox, but every teacher likes something different, so expect to be required to sign up for 2 to 4 of these services (or more, depending on the major).  There are also major specific services you may need.  For Computer Science, you will probably be expected to get a Github account and maybe an Amazon Web Services account.  For any kind of art related major, you can expect to sign up for an account with at least one website that serves as an art repository and gallery, like Deviant Art or Flickr.  You may also be expected to get an account with some popular art forum (though, again, different teachers will prefer different options).  In Electric Engineering, you will probably be expected to sign up for an account with at least one company that produces complex components like micro-controllers, for access to programming libraries, tutorials, and datasheets.  In Physical Education or any other health related discipline, you will probably need accounts for various medical sites, maybe a few forums, and possibly some nutritional data repositories.  Communications majors will likely be required to sign up for at least 20 accounts, including social media services, web forums, and even advertising services.  Depending on your major, you could end up with 5 or 10 more accounts.  Now, admittedly, some of them will be necessary for your jobs when you graduate, but again, while there is some overlap, it is very common for different employers to use different services.  As before, probably at least half of them will be useless once you graduate.


Now, this might seem like a trivial and benign problem.  Unfortunately, it is not.  There are many problems this causes.  The least harmful is the extra space taken up by unused accounts.  Every account for a web service uses some amount of storage space.  There are already a huge number of unused accounts spread over the internet, wasting a lot of space.  This is fairly easily mitigated though.  Service providers can delete accounts that have been inactive for a certain period of time.  If they want to keep the accounts open, just in case, they can buy more storage space, and when the cost is spread out among a large number of services, it can seem pretty small.  This is a problem, but it is not a critical one.

A worse problem is privacy.  If you have 20 accounts with different web services, you have probably already forgotten about half of them, unless you use them all very regularly.  All of those accounts hold some amount of your private information.  I'll discuss the security related things later, but for now, let us look at information that could be misused, but which is not a critical security risk.  The first, and most obvious one is credit card information.  Skirting around the subject of security (you did willingly give this information to these services), credit card data can be used in many ways.  It could be used to run credit checks.  It could be used to track you and your purchasing behavior.  Some of this is easy, some is more difficult, but a lot of this is possible and legal if you willingly gave the company your information.  Your physical address, phone numbers, and email address are all private information that could be misused without breaking the law, if you provided them willingly.  Some of these services might suddenly decide to start sending you ads a few years down the road, when their business is struggling.  You might get junk mail and telemarketing calls as well.  If one of these services is bought out, the buyer might decide to sell your personal information (not necessarily legal, if the original company agreed not to, but it happens anyway).  This is not necessarily a critical problem, but it could definitely cause a lot of inconvenience.

The worst problem is security.  We have discussed legitimate abuse of private information and some illegitimate abuse that is only indirectly related to security.  Security itself is not just about abuse by the service provider though.  The more accounts you have, the higher the odds are that at least one provider has poor security.  In fact, a majority of web services use security that is well below the accepted security standards for web.  Even something as simple as how your password is stored on their server can make a huge difference.  It is a well known fact that a vast majority of people use the same password or small set of passwords for all of their accounts.  If a hacker can get your password from the most trivial site, he can probably use it to hack into all of your other accounts.  If you have 10 or 20 different accounts, the odds that one of them has fairly weak security is very high.  All it takes is one.  The more accounts you have, the worse your odds are for getting hacked on all of your accounts.  This can give an attacker access to all of the private information you have on all of your accounts.  And, hackers do not have business ethics, high legal liability, and high profiles like the service providers do, so they are far less likely to avoid abuses of your data.  In fact, this is one of the most common techniques used by identity thieves to get your private information.  They don't have to hack into your bank.  They just have to hack into that Sony account to get your password, which they can then use to log into your bank account with ease, regardless of your bank's security.

There are ways to mitigate all of these.  The first is up to the service providers, and it only affects end users by increasing the prices of paid services.  The second can be mitigated by researching service providers before signing up for accounts (though, your employer or professor may still insist) and by asking for service providers to cancel your accounts and delete your information when you are done using them.  There is no law stating that they have to comply (this may be in the works though), and in some cases, the law may even require them to retain records, but many providers will comply when they can legally do so.  The third can be mitigated by always using different usernames and passwords for every account.  Good luck with this though.  Password managers can help, but they just shift the point of weakness.  Remembering 20 passwords is extremely difficult, so you may be tempted to write them all down, but that is often worse than a password manager.  Using one really good password can also help a little, but if someone hacks the service provider's database, it will not matter how good your password is.  The only fool proof solution is to have 20 highly secure and totally different passwords, and then to memorize them all.  Like I said, good luck.

This is actually a pretty big problem.  A lot of people in positions of authority think it is appropriate to impose security risks on other people, without any accountability.  If an employer or professor requires you to use an insecure service, there is no responsibility for harm caused if your information is misused.  If you do your research and find that a certain service is a high risk, typically your only option will be to quit your job or drop the class.  If the class is required for your major, you might have to switch majors to avoid the security risk.  If you are lucky, you might find sympathy, but often people are so set in their ways that they will risk the safety of everyone else to avoid change.  This is a very serious problem, and anyone involved in perpetuating it should seriously consider the consequences.

I understand that many times, the use of web services is valuable and even necessary.  This does not justify putting others at risk though.  Those choosing what services to use, and those approving such decisions, have a moral responsibility to make sure that those services meet accepted security standards.  Those being required to use such services should also make sure they meet accepted standards, and when they do not, those people should band together in protest.  Frankly, I think colleges should regulate what services professors are allowed to make mandatory.  If a professor needs a file repository service, the school should provide an option that it has verified as compliant with accepted security standards.  The school does not need to run the service (in fact, in my experience colleges are often poor at running such services internally).  It just needs to have a standard in place.  If a professor chooses to use a service that is outside of school policy, there should a policy specifically exempting students from being required to use that service as a condition of their grade (and the professor should be required to notify students of this policy wherever such a service is used).  In other words, use of such a service should be optional, and students should not be expected to have any knowledge or understanding of course material that is offered only through unapproved services (note that this article is about services that require accounts, not free services that do not require accounts).  (Obviously, colleges doing this should also have an approval procedure to add services to the list.)  Businesses would do well to also adopt policies requiring security assessments of any service that is required as part of the job, and no service which has not passed such an assessment should be allowed to be used as a mandatory part of the work.  In short, people in positions of authority over others should have some sort of regulations set in place to avoid putting their subordinates at risk.  Sometimes such regulations will fail (even following accepted security standards does not make a site immune to hacking, just much more resistant), but this is not an excuse to avoid them altogether.  No one should be allowed to put someone else at undue risk as a condition of their education or employment without any accountability.

Discrimination Against the Poor - Part 1

I want to share a little bit of back story before I start the actual article.  We just had our 5th child.  It was a natural birth at a local hospital.  Our first birth was a water birth in a birthing center, and we went home three hours after the birth.  Our other three were all natural in-hospital births, where the hospital required us to stay for 24 hours for observation after the birth, and my wife was sick of this.  We made a birth plan specifying that we wanted to leave 12 hours after the birth, and while we forgot it at home, we made our plans very clear to the hospital staff.  Our nurse, our midwife, and the pediatrician all accepted our decision, though some of them did not agree with it.  The nurse, however, informed the billing person for the hospital, who came in and informed my wife that if we left against medical advice (the hospital's 24 hour policy required the pediatrician to write the discharge for the baby as "against medical advice" if we left before 24 hours), Medicaid would not pay for the services provided for the baby, and we would have to pay out of pocket.  The midwife had told us something different, so I went home and did some research, while my wife tried to contact Medicaid by phone.  Eventually, she reached Medicaid who told her that they had no such policy and could only find a reference stating that if we brought the baby back before the 24 hours were up, we might be charged for services for the new visit that did not qualify as medically necessary.  Before that, however, my research at home revealed a rats nests around the billing lady's claim.  First, her claim was completely and absolutely false.  Second, most hospitals tell their patients this lie (though, hospital staff rarely knows the truth to begin with) and not just those insured through Medicaid.  I found three research papers from three different studies about this problem.  None of them found any insurers in the US with such a policy.  Anyhow, we left about 13 hours after the birth, and we informed the nurse that the claims were false and asked her to forward that on to the billing lady (the baby had no issues within those last 11 hours, though, the hospital staff had already determined she was perfectly healthy and the probability of problems was extremely low).


It should be obvious that poor people in the US face regular discrimination.  It is awfully hard to get hired for a job, even a really poor job, without nice clothing to wear to the interview (in fact, at least one US charity loans suits to poor job applicants to wear to interviews).  Many Medicaid, Food Stamp, and WIC office employees treat clients as inferiors.  Often, schools in poorer areas of towns and cities get sub-par teachers, while the other schools get the more skilled ones.  Middle and upper class people often look down on poor people and treat them as inferiors, and sometimes poor people even treat each other more poorly than those with more wealth.  Many Americans assume poor people are lazy.  This problem is so prevalent that comments from the few people that really are freeloading on government welfare often reflect badly on anyone who is receiving government welfare for any reason.  There is one place where this discrimination against the poor is especially repugnant, not to mention of questionable legality.

Most hospital employees in the US will tell patients that if they leave before their treatment is complete (known as leaving "against medical advice" or AMA), their insurance will not pay for it.  Because most patients leaving AMA are Medicaid patients, and because more wealthy patients can afford the costs better, this affects poor people far more than anyone else.  At least three studies have been done on this subject in the last three years, and none of these studies have found any insurance provider in the US with such a policy (some insurers actually laughed at the researchers for even asking).  Medicaid also has no such policy.  Now, in most cases, the hospital employees are not deliberately lying (though, hospitals do stand to benefit from patients staying "for observation" longer than is strictly necessary).  This is a common misconception among hospital employees, and it is presumably perpetuated as interns are taught this lie by regular employees.  This problem is not just bad for patients, it is also bad for insurers and potentially very bad for hospitals.

Because this problem affects primarily the poor, it is a clear case of discrimination against the poor.  As such, it is rather appalling.  It is also dangerous and perhaps even illegal.  This may be one reason that medical costs in the US are so high.  The biggest reasons people leave a hospital AMA are poor treatment or lack of additional time after treatment is complete.  Often, Medicaid patients have long waits to see a doctor, when their conditions are not critical.  Eventually, they get fed up with waiting, and they sometimes leave against medical advice.  The second, and more nefarious problem is when a patient has completed treatment, but the hospital either wants to observe the patient for an extra day or more, or the patient has to wait a long time for the doctor to do a final review and sign discharge papers.  In both cases, the hospital may charge more money to Medicaid, another insurer, or the patient, for the longer stay.  In the second case, however, it is possible that the long waits are actually deliberate abuse of the system, designed to allow the hospital to charge more for the visit by keeping the patient there longer.  Either way, forcing patients to wait so long that they consider leaving without getting full treatment is dangerous to the health of the patient.  Telling the patient that insurance will not pay if they leave early, however, may be more dangerous to the hospital than the patient.

Most hospitals require patients to sign a release before leaving AMA, to reduce liability for any problems that might have been prevented had the patient received full treatment.  Patients leaving AMA is considered a big problem in the US right now, especially among Medicaid patients (males patients are also more likely to do this).  Concerned hospital workers may be tempted to lie to patients to convince them to stay and complete treatment.  This carries two very dangerous consequences.  If found out, these lies will cause patients to distrust doctors, and this is already a big enough problem in the US; we really do not need to add to it.  Lying to patients may cause them to look for alternatives to normal medical treatment that might be dangerous or at least allow serious conditions to go untreated.  This is not in the best interest of the patients, and as such, it qualifies as a violation of the oath taken by nearly all medical practitioners in the US to avoid harming patients.  The second consequence is worse, at least for the hospital.  Medical patients have legally protected rights in the US, and one of those rights is to refuse treatment.  Any medical patient in the US may choose to leave a hospital at any time, without legal penalty, and if the hospital attempts to hold them against their will, the hospital is breaking the law.  This is a very serious offense.  Lying to a patient to manipulate them into forgoing this right, when they would otherwise have chosen to exercise it is a violation of this right.  Telling a patient that there will be severe financial penalties (for people on Medicaid, nearly any hospital bill is severe) is essentially forcing the patient to make a choice under duress.  Decisions made under duress are not legally binding.  If the patient has informed a hospital employee of an intent to leave AMA, and the hospital uses this lie to convince the patient to stay, the patient's original decision is still in force (because the overriding decision was made under duress), and by keeping the patient, the hospital is both holding the patient against his or her will (this is illegal by itself) as well as violating the rights of the patient.

There are several better ways to treat this kind of situation.  First, financial employees in hospitals should determine policy for specific insurance providers before any employee is allowed to suggest to a patient that penalties might exist.  Since most insurance companies have no such penalties, there is no point discussing them without asking the companies first.  Second, instead of trying to scare patients to stay by lying to them, it should be far more effective to inform them of the actual medical consequences of leaving AMA.  Even Medicaid patients are not stupid.  If they still want to leave, fully informed of the potential consequences, then it is their legal right to do so.  At that point, they have chosen to own the consequences, and nobody has any right to force them to stay.

This problem is dangerous to both patients and hospitals.  Employees need to be educated properly so that they do not inadvertently do or say things that could get the hospital in trouble.  Violations of patient rights can incur heavy fines, and multiple instances can get hospitals shut down.  Given how prevalent this problem is in the US, there have probably been enough of this kind of patient rights violations at most US hospitals to get them shut down.  Further, this kind of discrimination against the poor needs to stop.  Most poor people may not have the research skills to ever discover the lie they have been fed, but this does not absolve hospital employees of their responsibility to treat patients well and honestly.  If nothing else, more care should be taken to treat the poor fairly and legally, because they have a disadvantage.


Following are the studies on this problem:

The University of Chicago Medicine
http://www.uchospitals.edu/news/2012/20120203-billing.html

PubMed.gov, Journal of General Internal Medicine
http://www.ncbi.nlm.nih.gov/pubmed/22331399

Annals of Emergency Medicine, An International Journal
http://www.annemergmed.com/article/S0196-0644%2809%2901798-3/fulltext