3 ms·
You know what the really stupid thing is? Looking at the attack surfaces and data values and compromise histories, and having been inside Google to see how it t
by saulrh 8y ago
You know what the really stupid thing is? Looking at the attack surfaces and data values and compromise histories, and having been inside Google to see how it treats PII and been inside a cloud EMR provider to see how it treated PHI, I'd move my data out of that EMR and into Google in a heartbeat. If you're saying that Google would need to learn about a brand new truckload of paperwork, sure. But HIPAA is neither necessary nor sufficient for privacy or security.
- snuxoll 8y agoThe problem is HIPAA doesn't allow one to share data without a reason - in fact it's only to be ACCESSED with a reason even by those with privileges to do so. I would trust Google to keep data safe, but brazenly asking for data without a defined use case is in blatant disregard for the regulations we operate under.
- saulrh 8y agoLike I said, I suspect this is mostly a question of learning new paperwork. My experience at Google has been that the security and privacy tooling is granular enough that access can be proposed, vetted, authorized, controlled, and monitored at the level of individual build numbers of individual binaries. I'd guess that the casual assumption was that there'd be a "defined use case" step but that it'd be covered by existing internal procedures, and I'd also guess that in any sane world it would be covered. (This is, honestly, one of the reasons I call the entire thing stupid and trust HIPAA so little - at that cloud EMR company, every one of the 500+ devs must have had something like a perpetually-active use case of "debugging the product". If it weren't for the fact that I know that that company made it through audits I'd have phoned HHS my first month.)
- vageli 8y ago> (This is, honestly, one of the reasons I call the entire thing stupid and trust HIPAA so little - at that cloud EMR company, every one of the 500+ devs must have had something like a perpetually-active use case of "debugging the product". If it weren't for the fact that I know that that company made it through audits I'd have phoned HHS my first month.) So you're saying a valid use case to access patient data under HIPAA is for debugging the product? That sounds incredibly unlikely; even at my job we use faked data for this kind of thing. Can you point me to a source for your claim?
- saulrh 8y agoI wrote up a bit reply to clarify, but now I'm looking and thinking about it for the first time in a few years, with four years of job experience instead of four days, and realizing that I probably need to be showing this to a lawyer. The "learn to SQL" exercises directed me to manually inspect individual rows in the prod customer database. Even with the managers and senior devs all assuring me that it was okay and the company having survived for twenty years without being fined into oblivion, this is just... unbelievable. :/
- ams6110 8y ago> having been inside Google to see how it treats PII and been inside a cloud EMR provider to see how it treated PHI, I'd move my data out of that EMR and into Google in a heartbeat I'd prefer to not have any of my data in the cloud, or with Google, or in any internet connected system. Seems that's not a choice however.
- saulrh 8y agoI've had enough medical problems and paperwork fuckups to be damned thankful that my medical records aren't on paper. And I worked for a couple years on one of the EMRs that "protects" my data. Yes, the situation could be better. It could also be worse, and in ways much more immediate and dramatic than the usual privacy issues.