3 ms·

What bothers me is that I was under the impression that if you have a HIPAA compliant information system (software or hardware) that none of these criticisms wo

What bothers me is that I was under the impression that if you have a HIPAA compliant information system (software or hardware) that none of these criticisms would be true, yet we know that this is essentially the norm and that healthcare providers routinely ignore the problem. What's going on such that hospitals have the worst of both worlds - expensive devices subject to incredible amounts of regulation to safeguard patients but demonstrably insecure systems? I'd hate to think of what would happen if we had no regulations whatsoever, but on the other hand the current effective infosec status of the healthcare industry seems to be not very far off from as if they had no regulations. Did I miss something in HIPAA about "don't make it easy as hell for any random person to come in and steal patient data or command other HIPAA compliant systems to act as an agent?"

dragonwriter 11y ago
> What bothers me is that I was under the impression that if you have a HIPAA compliant information system The idea of a "HIPAA compliant information system" is largely empty marketing speak (less so in terms of the Transactions and Code Sets rule than the Privacy and Security rules); HIPAA and its implementing regulations do not establish specific standards for information systems (in privacy/security terms), it sets specific standards for what organizations holding PHI must do, and most of the technical features of software related to those functions are unspecified and, to the extent that there are requirements, whether the software as used is compliant will be highly dependent on the relation between the policies, specific functions performed by the organization, and how the software is used. At most, software has features which facilitate compliance with some parts of HIPAA, but you can't just drop in a piece of software and achieve turnkey HIPAA compliance.

dragonwriter 11y ago

> What bothers me is that I was under the impression that if you have a HIPAA compliant information system The idea of a "HIPAA compliant information system" is largely empty marketing speak (less so in terms of the Transactions and Code Sets rule than the Privacy and Security rules); HIPAA and its implementing regulations do not establish specific standards for information systems (in privacy/security terms), it sets specific standards for what organizations holding PHI must do, and most of the technical features of software related to those functions are unspecified and, to the extent that there are requirements, whether the software as used is compliant will be highly dependent on the relation between the policies, specific functions performed by the organization, and how the software is used. At most, software has features which facilitate compliance with some parts of HIPAA, but you can't just drop in a piece of software and achieve turnkey HIPAA compliance.