6 ms·
A few years ago I found a random SSD on the ground while on a walk with my son. The drive contained unencrypted records which squarly fall under HIPPA. I also
by mkoryak 8y ago
A few years ago I found a random SSD on the ground while on a walk with my son.
The drive contained unencrypted records which squarly fall under HIPPA. I also did the right thing and returned it to the proper owner and told them about how their mdb files were readable by anyone.
The same exact thing happened. They thanked me and then their lawyers nicely asked me to clone my hard drive and sign a bunch of shit.
It was not fun at all. A lot of them thought that I hacked something.
- StudentStuff 8y agoThe type of organization that would store HIPPA encumbered data unencrypted, which based on my brief reading is not legal anymore, is not one that would operate in a reasonable (or legal) manner. Sadly, that seems to be most organizations that fall under HIPPA, compliance is a box to be checked while expending as little resources and effort as possible. How they reacted to your kind action is sad, and depressingly common. I hope you told them to pound sand, and contacted whoever the data protection authorities were in your state. There needs to be much more aggressive enforcement of HIPPA and similar data protection laws, CYA bull like you encountered should not be happening. Article I ran across: https://info.townsendsecurity.com/bid/74330/Does-HIPAA-Require-Encryption-of-Patient-Information-ePHI https://info.townsendsecurity.com/bid/74330/Does-HIPAA-Requi...
- scarejunba 8y agoGuys, it's HIPAA not HIPPA.
- thaumasiotes 8y agoThis is an interesting case. I always pronounced HIPAA as "hee-pah". That has the advantage of approximating the spelling, but the disadvantage that it's not really a natural way for an English word to be pronounced. People in the medical field, who deal with HIPAA all the time, pronounce it as if it was spelled HIPPA. It's a short step from there to actually spelling it HIPPA.
- rocqua 8y agoDid you actually give them that clone and sign the documents? Or did you give push back like in the article? It feels to me like they shouldn't have much of a leg to stand on.
- mkoryak 8y agoI did consider fighting them for about 7 minutes. Then I remembered that they had a legal team paid for by taxpayers, while I had a toddler and a pretty decent, mostly stress free life. The laptop that I connected thier SSD to was my coding box, so I deleted all the code and secure erased the free space before they cloned it. They gave me shit about it too, because their forensic people saw days without any file activity. When I told them that it was because I removed my IP they responded with "why don't you think you need to do that? We can keep your data from falling into the wrong hands". Maybe if I was some kind of an activist I would have tried to fight it.
- natch 8y ago“We can keep your data from falling into the wrong hands...” just like they did for that drive you found.
- ada1981 8y agoI don’t understand... You found an drive, tried to return it and then we’re subject to an illegal search? Or you consented to a search that would have otherwise been illegal?
- mratzloff 8y agoHandling these kinds of things anonymously is the only reasonable way to protect yourself.
- Pfhreak 8y agoIs there a service that supports this? Like, get it to a security researcher, wipe it from your drive, and have the security researcher handle returning the data and providing a basic education (or reporting the data loss to the appropriate authorities.)
- tgb 8y agoJust turn it in to the police anonymously, let them look at the drive.
- dokem 8y agoWhy would you ever reach out to the owner? Is patting yourself on the back really worth the risk?