5 ms·
I work for a healthcare IT company that deals with tons of PHI (protected health information) and we have very strict security practices. New software is exten
by jugg1es 8y ago
I work for a healthcare IT company that deals with tons of PHI (protected health information) and we have very strict security practices. New software is extensively evaluated at several points in the SDLC for security issues and access is tightly controlled. Engineers and CEOs have been held personally liable for major breaches (not my company!). Health records are WAY more protected than your SSN. If what happened to Equifax happened to a company like Epic, they would go out of business.
- specialist 8y agoNone of your systems store patient data encrypted at rest. Inadvertent data breaches are inevitable. The very best you could possibly do is access logs and auditing. Which of your customers do any kind of auditing?
- paul_milovanov 8y agoHold on, do you know for a fact that EPIC specifically doesn't encrypt data at rest? I'm not questioning your competence/knowledge, just trying to understand specifically what you're saying.
- specialist 8y agoThe database or file system is likely (hopefully) encrypted. I'm referring to record and field level encryption. Like this: Translucent Databases http://a.co/d/5855TYO http://a.co/d/5855TYO http://wayner.org/node/46 http://wayner.org/node/46 Think of how password databases don't actually store passwords. Instead they (should) be storing salted and hashed passwords. --- Please see my other comment about plaintext demographic data vs using unique identifiers.
- sterwill 8y agoAlthough at-rest encryption of health data is an addressable part of US health regulations, not a required one, it's almost always done because it's easy and effective. Most electronic health records are encrypted at-rest.
- specialist 8y agoI should have been more clear. I'm advocating Translucent Database techniques, where patient data is encrypted at the field and row (document) level. Much like a salted password file. System level encryption still means the admins can still see the data. Therefore, breaches remain inevitable.
- jugg1es 8y agoLiterally every single system we have stores patient data encrypted at rest.
- rficcaglia 8y agoEpic is not hosted software, it is installed and heavily customized at each hospital. Epic doesn’t have a global db of all patient records.