3 ms·
Like I said, I suspect this is mostly a question of learning new paperwork. My experience at Google has been that the security and privacy tooling is granular e
by saulrh 8y ago
Like I said, I suspect this is mostly a question of learning new paperwork. My experience at Google has been that the security and privacy tooling is granular enough that access can be proposed, vetted, authorized, controlled, and monitored at the level of individual build numbers of individual binaries. I'd guess that the casual assumption was that there'd be a "defined use case" step but that it'd be covered by existing internal procedures, and I'd also guess that in any sane world it would be covered.
(This is, honestly, one of the reasons I call the entire thing stupid and trust HIPAA so little - at that cloud EMR company, every one of the 500+ devs must have had something like a perpetually-active use case of "debugging the product". If it weren't for the fact that I know that that company made it through audits I'd have phoned HHS my first month.)
- vageli 8y ago> (This is, honestly, one of the reasons I call the entire thing stupid and trust HIPAA so little - at that cloud EMR company, every one of the 500+ devs must have had something like a perpetually-active use case of "debugging the product". If it weren't for the fact that I know that that company made it through audits I'd have phoned HHS my first month.) So you're saying a valid use case to access patient data under HIPAA is for debugging the product? That sounds incredibly unlikely; even at my job we use faked data for this kind of thing. Can you point me to a source for your claim?
- saulrh 8y agoI wrote up a bit reply to clarify, but now I'm looking and thinking about it for the first time in a few years, with four years of job experience instead of four days, and realizing that I probably need to be showing this to a lawyer. The "learn to SQL" exercises directed me to manually inspect individual rows in the prod customer database. Even with the managers and senior devs all assuring me that it was okay and the company having survived for twenty years without being fined into oblivion, this is just... unbelievable. :/