8 ms·

I'm a hospitalist (internal medicine employed by a hospital). I'm fairly certain that what they are intercepting are pages from the ER to admitting or consultin

I'm a hospitalist (internal medicine employed by a hospital). I'm fairly certain that what they are intercepting are pages from the ER to admitting or consulting physicians. In the US, this would be a HIPAA violation but I'm not sure of the Canadian law. We still use pages at my hospital, but no PHI, only room numbers in the ER for admissions are paged and then you log into the EMR. We use HIPAA compliant texting apps to communicate PHI.

marcolussetti 7y ago
Under BC Law, it would strike me as a FIPPA violation, but it's a bit more complicated.
jhart99 7y ago
What about communications between the ambulance and the receiving ER? Those are unencrypted digital voice here in San Diego. I've heard names, DOBs, medical histories etc being blasted out over their repeater.
- _r2h 7y ago
  HIPAA allows us (I'm a medic) to broadcast patient information for treatment related purposes. It's useful for us and hospitals because they can pre-register time sensitive patients and pull up history/previous test that can be extremely important for STEMIs/strokes/etc.
  - 420codebro 7y ago
    I understand your point but I would prefer an end to end crypto system to protect said data.
blaisio 7y ago
HIPAA is such an awesome law. I have to work with it daily as an engineer, and I'm continually amazed that the US government requires so much security. Normally the US is extremely hands off when it comes to privacy and security. Congress almost never passes laws that have such far reaching scope. And HIPAA actually has teeth, with significant penalties for companies who don't comply (and of course people can sue as well over the violation). I think aspects of it could definitely be improved. I see HIPAA violations at doctor's offices all the time - but they are usually still fairly minor, and doctors and nurses grow concerned quickly as soon as you mention a possible violation.
- t34543 7y ago
  Yes, I am fond of HIPAA too. One project I worked on was physical infrastructure for a healthcare company. One cool thing I remember is that the phone lines within the building had to be in armored cable, so they couldn’t be tapped without leaving a huge mess.
  - closeparen 7y ago
    You can read the technical safeguards. They are pretty reasonable and not nearly that intense. There is definitely a cottage industry of security/compliance consultants giving maximalist interpretations to bill more hours, but there are also shops doing pretty average modern IT best practices (individual user accounts, TLS, screensaver passwords, etc) that do fine. https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/techsafeguards.pdf https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/ad...
- corebit 7y ago
  How are you fond of this law? It's so obviously a pointless waste of money. As a fellow engineer who has worked with it I cant wait ffg or its repeal - and I see that coming.
  - chooseaname 7y ago
    I'll bite. What would be the options for keeping our PHI from being freely shared everywhere? You have to know that Facebook would love a piece of that.
    - clinta 7y ago
      First of all, I don't think HIPPA actually prevents PHI from being shared. If Facebook were to become a business partner of a hospital, and maintain HIPPA compliance themselves, hospitals can share data with Facebook. To tackle the problem HIPPA tries to solve, that is making sure that data sharing is secure and only with the intended parties, I want to see stronger enforcement of liability. Granted, the US doesn't have a great track record on that, seeing Equifax get away with what their doing. But I think that's the system that needs to be improved. Instead of government dictating what "secure" means, different approaches can be experimented with on the market with strong enforcement of liability providing the necessary incentives.

marcolussetti 7y ago

Under BC Law, it would strike me as a FIPPA violation, but it's a bit more complicated.

jhart99 7y ago

What about communications between the ambulance and the receiving ER? Those are unencrypted digital voice here in San Diego. I've heard names, DOBs, medical histories etc being blasted out over their repeater.

_r2h 7y ago
HIPAA allows us (I'm a medic) to broadcast patient information for treatment related purposes. It's useful for us and hospitals because they can pre-register time sensitive patients and pull up history/previous test that can be extremely important for STEMIs/strokes/etc.
- 420codebro 7y ago
  I understand your point but I would prefer an end to end crypto system to protect said data.

blaisio 7y ago

HIPAA is such an awesome law. I have to work with it daily as an engineer, and I'm continually amazed that the US government requires so much security. Normally the US is extremely hands off when it comes to privacy and security. Congress almost never passes laws that have such far reaching scope. And HIPAA actually has teeth, with significant penalties for companies who don't comply (and of course people can sue as well over the violation). I think aspects of it could definitely be improved. I see HIPAA violations at doctor's offices all the time - but they are usually still fairly minor, and doctors and nurses grow concerned quickly as soon as you mention a possible violation.

t34543 7y ago
Yes, I am fond of HIPAA too. One project I worked on was physical infrastructure for a healthcare company. One cool thing I remember is that the phone lines within the building had to be in armored cable, so they couldn’t be tapped without leaving a huge mess.
- closeparen 7y ago
  You can read the technical safeguards. They are pretty reasonable and not nearly that intense. There is definitely a cottage industry of security/compliance consultants giving maximalist interpretations to bill more hours, but there are also shops doing pretty average modern IT best practices (individual user accounts, TLS, screensaver passwords, etc) that do fine. https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/techsafeguards.pdf https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/ad...
corebit 7y ago
How are you fond of this law? It's so obviously a pointless waste of money. As a fellow engineer who has worked with it I cant wait ffg or its repeal - and I see that coming.
- chooseaname 7y ago
  I'll bite. What would be the options for keeping our PHI from being freely shared everywhere? You have to know that Facebook would love a piece of that.
  - clinta 7y ago
    First of all, I don't think HIPPA actually prevents PHI from being shared. If Facebook were to become a business partner of a hospital, and maintain HIPPA compliance themselves, hospitals can share data with Facebook. To tackle the problem HIPPA tries to solve, that is making sure that data sharing is secure and only with the intended parties, I want to see stronger enforcement of liability. Granted, the US doesn't have a great track record on that, seeing Equifax get away with what their doing. But I think that's the system that needs to be improved. Instead of government dictating what "secure" means, different approaches can be experimented with on the market with strong enforcement of liability providing the necessary incentives.