4 ms·

Nothing scares me more than my medical records on internet. I have close to zero confidence into any of the hospitals or medical companies to implement their IT

Nothing scares me more than my medical records on internet. I have close to zero confidence into any of the hospitals or medical companies to implement their IT securely.

Real_S 7y ago
The only thing worse might be if you found your DNA available openly on the internet [0]. [0] https://www.bloomberg.com/news/articles/2019-07-09/dna-testing-service-exposed-thousands-of-customer-records-online https://www.bloomberg.com/news/articles/2019-07-09/dna-testi...
- dekhn 7y ago
  you can find a copy of my genome right here: https://my.pgp-hms.org/profile/hu80855C https://my.pgp-hms.org/profile/hu80855C (but I put it there)
earthboundkid 7y ago
I've met people whose job is to put honeypots on hospital networks to detect ransomware installation attempts. They supposedly have a very short response time SLA, like "if there's bad network activity, we will call your administrator within 5 minutes." It's interesting that job exists, since the ransomware mostly uses old exploits that shoulda been patched anyway.
- aperrien 7y ago
  One of the problems is that many of the medical devices on hospital networks have badly outdated software, that runs proprietary applications. There should be a better job done by vendors to clean that up, but no-one seems interested in supporting this once the sale is made. Sometimes the IT staff simply have their hands tied, and network isolation is the best they can do, at least for medical devices. Billing and file sharing vendors should on the other hand have active maintenance contracts to prevent exactly this.
  - taborj 7y ago
    > There should be a better job done by vendors to clean that up, but no-one seems interested in supporting this once the sale is made. Working in healthcare IT (and I should note this is my personal opinion only), it's actually a little more complicated than that. Healthcare software vendors are generally building their software to meet certain certifications (because the clinics are demanding that), as well as fixing security/patient safety issues, and lastly adding in features the clinics want The problem comes in that not every clinic cares about the certifications, and the software they have "works fine." So there's no incentive to upgrade to a newer version that has security fixes. It's important to remember that, with a few exceptions, doctors are not IT, and many clinics are small enough that they outsource their IT. If that IT group doesn't force the clinics to upgrade, the clinic will continue using the version that does what they want, as long as it isn't obviously broken. Clinics are generally risk-averse, which in many cases is the correct mindset. Unfortunately, that affects their perception of the benefits of updated software.
- roywiggins 7y ago
  Can't upgrade devices with XP embedded in them. Of course, the vendor would be happy to sell you one running Windows 7, but the existing hardware works fine, so...
corebit 7y ago
Why? It doesn't affect you in any way.
- rainyMammoth 7y ago
  Are you being serious? Did you already look at the notes your physician takes after the visit ? All your personal details are in there. What If you went to see your doctor about some touchy subject ?(STD for example) and the transcript of your conversation gets available on internet?

Nothing scares me more than my medical records on internet. I have close to zero confidence into any of the hospitals or medical companies to implement their IT securely.

Real_S 7y ago

The only thing worse might be if you found your DNA available openly on the internet [0]. [0] https://www.bloomberg.com/news/articles/2019-07-09/dna-testing-service-exposed-thousands-of-customer-records-online https://www.bloomberg.com/news/articles/2019-07-09/dna-testi...

dekhn 7y ago
you can find a copy of my genome right here: https://my.pgp-hms.org/profile/hu80855C https://my.pgp-hms.org/profile/hu80855C (but I put it there)

earthboundkid 7y ago

I've met people whose job is to put honeypots on hospital networks to detect ransomware installation attempts. They supposedly have a very short response time SLA, like "if there's bad network activity, we will call your administrator within 5 minutes." It's interesting that job exists, since the ransomware mostly uses old exploits that shoulda been patched anyway.

aperrien 7y ago
One of the problems is that many of the medical devices on hospital networks have badly outdated software, that runs proprietary applications. There should be a better job done by vendors to clean that up, but no-one seems interested in supporting this once the sale is made. Sometimes the IT staff simply have their hands tied, and network isolation is the best they can do, at least for medical devices. Billing and file sharing vendors should on the other hand have active maintenance contracts to prevent exactly this.
- taborj 7y ago
  > There should be a better job done by vendors to clean that up, but no-one seems interested in supporting this once the sale is made. Working in healthcare IT (and I should note this is my personal opinion only), it's actually a little more complicated than that. Healthcare software vendors are generally building their software to meet certain certifications (because the clinics are demanding that), as well as fixing security/patient safety issues, and lastly adding in features the clinics want The problem comes in that not every clinic cares about the certifications, and the software they have "works fine." So there's no incentive to upgrade to a newer version that has security fixes. It's important to remember that, with a few exceptions, doctors are not IT, and many clinics are small enough that they outsource their IT. If that IT group doesn't force the clinics to upgrade, the clinic will continue using the version that does what they want, as long as it isn't obviously broken. Clinics are generally risk-averse, which in many cases is the correct mindset. Unfortunately, that affects their perception of the benefits of updated software.
roywiggins 7y ago
Can't upgrade devices with XP embedded in them. Of course, the vendor would be happy to sell you one running Windows 7, but the existing hardware works fine, so...

corebit 7y ago

Why? It doesn't affect you in any way.

rainyMammoth 7y ago
Are you being serious? Did you already look at the notes your physician takes after the visit ? All your personal details are in there. What If you went to see your doctor about some touchy subject ?(STD for example) and the transcript of your conversation gets available on internet?