4 ms·

>There should be equivalent standards and audits and consultants for private information of all sorts, including healthcare info. There is. In fact, that stand

>There should be equivalent standards and audits and consultants for private information of all sorts, including healthcare info. There is. In fact, that standard and the regulations attending it were tailor made for healthcare information. These guys are in deep doo doo, and based on the way they talk, it's not clear to me that they understand that fact. Number one, they took the job. The job of holding that data in the first place brings with it certain iron clad legal obligations. It's not something that some startup or random company should just launch off into willy nilly. Number two, having taken the job, they didn't properly secure the data. Which is actually a federal crime. Which brings me to number three. The fact that they publicly communicate these facts in as laissez faire a fashion as they do really does betray not only a level of technological ineffectiveness, but also a level of legal naiveté that borders on imbecilia.

azinman2 7y ago
Yup — these are HIPAA violations that can carry jail time if malicious, an certainly large fines if not.
- dragonwriter 7y ago
  No, if they aren't due to “willful neglect” and are corrected within a reasonable time (for which the minimum allowed is 30 days after the offendig party either knew or reasonably should have known of the violation, but more can be allowed based on circumstances), no monetary penalties can be imposed for HIPAA violations. See 45 CFR 160.410(c).
  - zaroth 7y ago
    And how could they “reasonably” not have known they were broadcasting these records to the world? To take the one thing you are storing and put it on the internet for anyone to access? Maybe this underlying software which has a port open does so without informing anyone that it’s doing it? I can’t quite believe that. So that leaves me thinking that at some point, someone did not RTFM. The analogy would be something like running a Bitcoin wallet service and leaving your bitcoind RPC bound to 0.0.0.0 with no password.

azinman2 7y ago

Yup — these are HIPAA violations that can carry jail time if malicious, an certainly large fines if not.

dragonwriter 7y ago
No, if they aren't due to “willful neglect” and are corrected within a reasonable time (for which the minimum allowed is 30 days after the offendig party either knew or reasonably should have known of the violation, but more can be allowed based on circumstances), no monetary penalties can be imposed for HIPAA violations. See 45 CFR 160.410(c).
- zaroth 7y ago
  And how could they “reasonably” not have known they were broadcasting these records to the world? To take the one thing you are storing and put it on the internet for anyone to access? Maybe this underlying software which has a port open does so without informing anyone that it’s doing it? I can’t quite believe that. So that leaves me thinking that at some point, someone did not RTFM. The analogy would be something like running a Bitcoin wallet service and leaving your bitcoind RPC bound to 0.0.0.0 with no password.