5 ms·

In healthcare software development you do risk analysis as a daily exercise. Mitigating this is so easy. In this Github comment the only issue is a scared cust

by oaiey 9y ago

In healthcare software development you do risk analysis as a daily exercise. Mitigating this is so easy. In this Github comment the only issue is a scared customer management (how I read it), which in my opinion has no experience in handling audit findings or software development. Stopping CIL (or CLI) projects because of this is ridiculous and shows a lack of professionalism. I am in healthcare with multiple active development stacks (Java, Node, .NET, Python, ..) and in this regards I worry more of the Cordova/Node apps with their 1000s of npm dependencies which some of them do not even have a public source code repo and/or intentional anonymous author and/or without a license. Analyzing who is calling home there is a monumental task compared to the pretty uniform .NET or Java stacks.

Const-me 9y ago
I agree the lab management overreacted in this particular case. If I were them, I’d ask the author of the comment to fork that repo disabling telemetry, and probably implement some automatic verification tool/tests to make sure no parts of the software stack call home. However, I can also understand the reason for the management’s paranoia. Besides that HIPAA law, it’s also the fact that if your genome gets leaked, you can’t change password/order another card like with the traditional IT data leaks. Probably, they view the data leak risk as an existential risk for their whole company.
- oaiey 9y ago
  That is true. But in that level of paranoia I would argue they should stop using software :). In healthcare and other regulated environments they can shut you down for months or years because of your handling of audit findings. But you get findings because an employee missed his badge, hold open a door for an auditor or has the wrong training records. But there are finding severities, risk analysis and capa handlings to deal with them. Handling this case is easy. My argument is, when you are in healthcare and you cannot deal with audits and their outcome, stop being there.

by oaiey 9y ago

Const-me 9y ago

I agree the lab management overreacted in this particular case. If I were them, I’d ask the author of the comment to fork that repo disabling telemetry, and probably implement some automatic verification tool/tests to make sure no parts of the software stack call home. However, I can also understand the reason for the management’s paranoia. Besides that HIPAA law, it’s also the fact that if your genome gets leaked, you can’t change password/order another card like with the traditional IT data leaks. Probably, they view the data leak risk as an existential risk for their whole company.

oaiey 9y ago
That is true. But in that level of paranoia I would argue they should stop using software :). In healthcare and other regulated environments they can shut you down for months or years because of your handling of audit findings. But you get findings because an employee missed his badge, hold open a door for an auditor or has the wrong training records. But there are finding severities, risk analysis and capa handlings to deal with them. Handling this case is easy. My argument is, when you are in healthcare and you cannot deal with audits and their outcome, stop being there.