3 ms·

I work in the space, and can say for certain that while everyone talk a good game about their encryption, and compliance policies, the reality is often a bit di

by ch4s3 10y ago

I work in the space, and can say for certain that while everyone talk a good game about their encryption, and compliance policies, the reality is often a bit different.

cnnsucks 10y ago
Indeed. If you believe HIPAA has ensured everything is encrypted you've been suckered by the potemkin village that is EHR compliance pencil whipping. The work is farmed out to all sorts of fly-by-night shops that are expert at passing the audits and filling out the applications that make the grant money flow and get the necessary boxes ticked with the feds.
- ch4s3 10y ago
  It kind of depends, I think. I work with some really great companies who take this stuff very seriously and do a really good job. There is however a gigantic attack surface. The vulnerability to plain old spear phishing alone is gigantic. Additionally a lot of hospitals have too few, poorly paid and trained IT staff running their in house infrastructure. This is a big mistake, but they think doing it this way is more secure. And, as you suggest, there are some bad actors. Fortunately there's been a lot of consolidation on the EHR side that's wiped out a lot of the fly by night operations. Third party contractors, are of course another story and a mixed bag.
- chapium 10y ago
  Anyone with exposure to the industry and has an ounce of sense would realize there are a ton of security vulnerabilities. Patchwork implementation of encryption is just one of many ails.
metaobject 10y ago
A few years ago I had my identity stolen by someone from a large hospital on the east coast. They charged about $20K of merchandise, opened about 6-7 credit cards and failed to open a few more before I started getting bills in the mail. It took me dozens of hours and weeks on the phone to get things cleared up. They caught the person on Target surveillance camera and finally arrested and charged them at the federal level. There were ~40 other people who had their info stolen as well. They went to prison and will be there for a few more years. The whole ordeal was a fairly stressful thing to deal with right after having major surgery. I looked into my legal options after I cleared things up, but I couldn't get anyone to seriously listen to my case. I wanted to know whether the hospital was responsible, but I guess I didn't know who to contact (the right lawyer, etc). Everyone I contacted either weren't able to help me or didn't know I should contact.

by ch4s3 10y ago

I work in the space, and can say for certain that while everyone talk a good game about their encryption, and compliance policies, the reality is often a bit different.

cnnsucks 10y ago

Indeed. If you believe HIPAA has ensured everything is encrypted you've been suckered by the potemkin village that is EHR compliance pencil whipping. The work is farmed out to all sorts of fly-by-night shops that are expert at passing the audits and filling out the applications that make the grant money flow and get the necessary boxes ticked with the feds.

ch4s3 10y ago
It kind of depends, I think. I work with some really great companies who take this stuff very seriously and do a really good job. There is however a gigantic attack surface. The vulnerability to plain old spear phishing alone is gigantic. Additionally a lot of hospitals have too few, poorly paid and trained IT staff running their in house infrastructure. This is a big mistake, but they think doing it this way is more secure. And, as you suggest, there are some bad actors. Fortunately there's been a lot of consolidation on the EHR side that's wiped out a lot of the fly by night operations. Third party contractors, are of course another story and a mixed bag.
chapium 10y ago
Anyone with exposure to the industry and has an ounce of sense would realize there are a ton of security vulnerabilities. Patchwork implementation of encryption is just one of many ails.

metaobject 10y ago

A few years ago I had my identity stolen by someone from a large hospital on the east coast. They charged about $20K of merchandise, opened about 6-7 credit cards and failed to open a few more before I started getting bills in the mail. It took me dozens of hours and weeks on the phone to get things cleared up. They caught the person on Target surveillance camera and finally arrested and charged them at the federal level. There were ~40 other people who had their info stolen as well. They went to prison and will be there for a few more years. The whole ordeal was a fairly stressful thing to deal with right after having major surgery. I looked into my legal options after I cleared things up, but I couldn't get anyone to seriously listen to my case. I wanted to know whether the hospital was responsible, but I guess I didn't know who to contact (the right lawyer, etc). Everyone I contacted either weren't able to help me or didn't know I should contact.