{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreidipfe3yrpchxqe7zol2i3tpigctj7vaixolp5yjpjqeynyeyq6ma",
    "uri": "at://did:plc:haakkg7y3xdghcdmprxeexso/app.bsky.feed.post/3moouz4ml53n2"
  },
  "path": "/t/how-do-i-compellingly-advocate-for-my-privacy-with-doctors-and-other-healthcare-professionals/38299?page=3#post_50",
  "publishedAt": "2026-06-20T02:04:33.000Z",
  "site": "https://discuss.privacyguides.net",
  "tags": [
    "@gmail.com",
    "gmail.com",
    "extensions",
    "perfect forward secrecy",
    "post-quantum crypto"
  ],
  "textContent": "You _can_ have safe communication via user using @gmail.com e-mail address – but you both have to both use some end2end encryption (like PGP or S/MIME), and they cannot use regular gmail.com webmail interface (but either add web extensions, or download messages via IMAP or POP-3 to their local computers and decrypt there).\n\nWhether they’re educated enough and/or willing to do that is another matter.\n\nPurpleDime:\n\n> **Thank you for your very comprehensive feedback. I sincerely appreciate how you are breaking it down.** Although you make very valid points, I still somewhat disagree.\n\nSure, no worries. Life would be awfully boring if we all agreed on all things\n\nPurpleDime:\n\n> I am not an expert. I am just a regular person who likes to learn about privacy issues because it’s an issue I care deeply about. I do not have the advanced technical knowledge that you seem to clearly have. You have used numerous technical terms that I am not familiar with, which is the jargon I was referring to.\n\nWhich is a problem. Privacy is huge moving minefield in today’s world, that even when you’re an expert you’re going to have a hard time surviving it without major losses. The more you know about how stuff works, the more worried you’ll be and more time you’ll be using in trying to defend, with no guarantees it would help.\n\nYou mention the jargon, and I agree. But you used some it yourself - _**“E2EE”**_ is jargon too, and yet we expect doctors to know answer to that. But the problem is, that one acronym is just a **tip of the iceberg** , and nowadays it won’t help much by itself.\n\nEven with E2EE, many thing could (and does) go wrong:\n\n  * encryption used may be obsolete (easily broken). At least in EU, there is mess, where GDPR requires stuff to be encrypted, but does not state standards. So, you _have_ to know what standards they use, and if they are “state of the art”. So you need more jargon like _“ISO/IEC 27001”_ or _“FIPS 140-3”_ etc.\n  * even if they use proper encryption protocol, its implementation might be (and horrifyingly often is) flawed (e.g. reusing nonce parameters or similar). You need your doctor’s office to have full source security audit performed on all their software (and be able to read it) to have any insight into it.\n  * even if they use encryption protocols which are fine for today, and use it in proper manner, is it future-proof, i.e. does it employ perfect forward secrecy? Does it employ post-quantum crypto? Because, it is not really privacy for medical data if all encrypted data collected today can be easily decrypted in 5 years.\n  * software might have bugs. Shocking, I know.\n\n\n\nBut there are even **worse things** for privacy then **encryption when transferring data between doctor and the patient** (which you could BTW easily ensure by minor inconvenience of not leaving any e-communication contacts and insisting on exchanging information exclusively by coming in person and getting diagnosis in dead-tree or other physical format only).\n\nFor example:\n\n  * what is the “end” in that E2EE? Let’s say they use Office365, “End” is not really at their local computer, but more at Microsoft servers. So guess who can see the data except you and your doctor?\n  * how about if they do store data locally, but use, say, Microsoft Windows 11? Heard about that snoopy thing called _“Recall”_? It’s disaster for privacy. Yet what is the chance your doctor is using for example GNU/Linux or FreeBSD? Slim at best.\n  * where is patient data **stored**? Likely, in some completely unencrypted database on some “cloud”. Or at best, it is _“encrypted at rest”_ (which won’t help you one bit as it is basically never at rest), and/or encrypted with hardcoded key in app (which is just security-through-obscurity, so won’t really help either). That **whole database of all patients is more likely to leak** then not given enough time. And this is not hypothetical, it happens all the time. What is most infuriating, when it happens, companies at best get a slight slap on the wrist, if even that. They just publish _“we are so sorry that happened, we care about your privacy”,_ and then continue their sloppy practices unabated.\n  * How about _“Agentic AI”_? Heard about those yet? If not, no worry, “regular” AIs are bad enough, and people will gullibly copy/paste your private patient data into them in 2026, not to mention few years down the road. “Agentic” stuff is just 100x times worse, as it will do all of that without any input of human operator. But it’s _“more efficient”_ so some collateral casualties (like, last remains of your privacy) is already accepted sacrifice to the Gods of Profit. Even if operators are careful not to do that, almost every OS and app maker in the world is trying hard to give you AI you can’t disable which by definition needs to scrape all your devices for all your data, and has horrible security track record.\n  * what is their operational security? If not good, their communications are going to get compromised, and all that data _is_ going to be stolen and resold. Do they have at least _ISO/IEC 27001:2022_ certificate (more jargon I know)? It is not be-all-end-all by any stretch of imagination, but it does show they are at least trying to show the bare minimum of caring.\n\n\n\nAnd I could go for dozens more points…\n\nBut my point is that (while it is commendable that you go to extra effort to ask those things!), unless you become expert yourself you won’t be able to tell exactly _how bad_ their specific situation is (well, theoretically it _could_ be good too I guess. It is just that the reality haven’t been giving me much cause for optimism last two decades).\n\nProblem is that when enough people ask them such questions, they’ll learn what are the _“correct”_ words they need to say to appease the people asking (even if they don’t reflect the reality). And, unless you can independently confirm their claims, just believing those words is not much improvement over just believing their generic words that _“they take all the appropriate measures to protect your privacy”._",
  "title": "How do I compellingly advocate for my privacy with doctors and other healthcare professionals?"
}