9 ms·

I have no idea the right way of posting long posts. Here's the rest: https://pastebin.com/k0tYZYgY https://pastebin.com/k0tYZYgY

throwaway58130 7y ago
Contract arrives, I sit down with COO and CFO and explain that we have been duped. COO is angry; CFO is not concerned until I show him the contract that Bob's sent over. The contract ye olde healthcare startup signed apparently agrees to pay for 5 fixed resources (at $200/hr!) for 40 hours of work each, per week, for a period of a year. Now I'm not unfamiliar with being outsourced as a resource, from a consulting company, for a fixed amount per week - but never have I seen a contract that binds you for a year, especially for 5 resources, with not one deliverable mentioned anywhere. Maybe my five years of consulting wasn't enough, but that blew my mind. Additionally, they sent us the server bills (AWS) and informed us we paid directly for utilization in addition to a "HIPAA Monitoring and Compliance Fee" of $3000/mo. As I had not a year ago lowered our own cloud costs to about $800/mo, this number struck me as staggering. $3000/mo base + around $2000 for the servers currently running. Also, "what the fuck is HIPAA" I said aloud, the only answer being the two confused shaking heads of my COO and CFO. Uh-oh... Segway. The actual Project Manager of the acquired company (not the one from Bob's Hair Care IT Consulting Nail and Tire Salon) has moved in and I've finally got a victim to victimize with my many, many questions. She already looks harrowed before I begin my interrogation. Are people actually using this? How much do we make per visit? Visits per month? I forget the answers to these, but the end takeaway was: we bring in about $10k/mo net right now. I'm no accountant, but I'm fairly confident you can't pay the expenses of a company + a half dozen employees on $10k/mo. PM agrees - they've burnt through about $7 mil of investor cash over their 6 years of existence. No path to profitability is in sight. Around the same time I've got the Project X repository (whew, at least they used source control) moved over into my world and have started reviewing the actual source. I'm no Node wizard, but I'm immediately confused as I see both Express and Hapi (two server frameworks, generally considered competition to one another) used in the same project. That's...odd. Investigation intensifies: it's a simple CRUD project that takes a form submission from a registered user, saves it in Mongo and slaps it into a queue for delivery to the given doctors email. That's really it. There's some back-end admin that allows the doctor to write some notes about their visit. Like a little baby EMR (though I had no idea what an EMR was at that time). Amusingly, it's got an Angular front-end (1.x, because why not spread salt on my wounds) that hits an Express endpoint that then proxies the call to a Hapi endpoint. For no reason. I can't find a single comment or piece of documentation explaining why. Icing on the cake? Their is in fact authentication used from Angular -> Express. The Hapi endpoints, however, are wide open - but surely not from the ELB, right? Certainly it's just an idiotic architectural decision that isn't actually exposed to the public? Nope. There's a rule in the ELB. Sweet Baby Ray's someone help me, there is a publicly accessible, completely open API that anyone could discover that gives away patient and doctor information. Huh, I wonder if the US has any sort of regulation on that kind of stuff? I should really take some time to investigate that HIPAA thing I found earlier, maybe that's got something to do with it... Employment duration: unknown. My ulcer has had a baby. I think I may have had a psychotic break. I Googled HIPAA. I simultaneously shat and pissed myself, which I didn't think was possible during a panic attack, but the human body is an amazing thing. I took Thursday and Monday off from work to read through a PDF I found of this most enlightening "HIPAA" legislation. It says "SAMPLE" or "UNOFFICIAL" or some such on it, so I'm not sure how accurate it is, but whatever - I need to educate myself somehow. I spent a thrilling four days reading, re-reading, and summarizing what I understood of the several hundred page document - printed in three-column layout because why not make it more abysmal. It doesn't seem completely dire; it looks like there is some stuff we need to do if we are storing this mythical PHI, but it isn't terribly complex (at least technically!). I had already been planning encrypting everything we own, and all of our sites are already behind SSL, so this should be cake. Phew! Calm down, baby-ulcer, don't think about grand-kids quite yet. Also I found a few great summaries of the Act which I could share with my COO - but really, we need to sit down with Legal and have them explain why this was never brought up. And let's be honest, I'm not a lawyer - the professionals can handle this! Legal has never heard of HIPAA. That's not good. I convince COO to ask Legal to reach out to a different Legal who specializes in healthcare. We sit down with them a few days later and our new Legal turns white after I lay out everything we do, our concerns, and the simple question: "Do we need to do any of this stuff I read about?" Turns out, having your CTO read a complex, many-hundred-pages legal document is not the best way to get accurate legal advice. We're fucked. We're a TPA filing insurance claims - we absolutely, 100% must comply with this Act. Oh and guess what? The Act has a delightful addition called an Omnibus, passed back in '13, that makes any possible defense we might have had to not comply...completely null and void. We're in what is called 'Breach'! We have fucked up. Royally and legally. Icing? We're all personally liable, at least to the letter of the law. But don't worry - we didn't know we fucked up, so the fees are an order of magnitude less. They'll only bankrupt the company 5 times over, instead of 10! Hurray!
dang 7y ago
I've merged it into your comment above so the whole thing is one piece.
- zem 7y ago
  there's a lot of stuff in the pastebin that hasn't been added to the comment
  - dang 7y ago
    Ah ok. Thanks! I'll uncollapse the GP.
forgotmypwd123 7y ago
You're gonna go to jail.
- deleted 7y ago
  [deleted]
tomp 7y ago
You should be a writer. Or a movie producer.
- abledon 7y ago
  "We're never going to do that, Throwaway," -- genius.
abledon 7y ago
please write fiction please. you are like a thriller writer, it was better than watching "the dark night"
timwaagh 7y ago
For someone who cares so deeply about security you just gave away a lot of sensitive info and uploaded it to a popular forum.

throwaway58130 7y ago

Contract arrives, I sit down with COO and CFO and explain that we have been duped. COO is angry; CFO is not concerned until I show him the contract that Bob's sent over. The contract ye olde healthcare startup signed apparently agrees to pay for 5 fixed resources (at $200/hr!) for 40 hours of work each, per week, for a period of a year. Now I'm not unfamiliar with being outsourced as a resource, from a consulting company, for a fixed amount per week - but never have I seen a contract that binds you for a year, especially for 5 resources, with not one deliverable mentioned anywhere. Maybe my five years of consulting wasn't enough, but that blew my mind. Additionally, they sent us the server bills (AWS) and informed us we paid directly for utilization in addition to a "HIPAA Monitoring and Compliance Fee" of $3000/mo. As I had not a year ago lowered our own cloud costs to about $800/mo, this number struck me as staggering. $3000/mo base + around $2000 for the servers currently running. Also, "what the fuck is HIPAA" I said aloud, the only answer being the two confused shaking heads of my COO and CFO. Uh-oh... Segway. The actual Project Manager of the acquired company (not the one from Bob's Hair Care IT Consulting Nail and Tire Salon) has moved in and I've finally got a victim to victimize with my many, many questions. She already looks harrowed before I begin my interrogation. Are people actually using this? How much do we make per visit? Visits per month? I forget the answers to these, but the end takeaway was: we bring in about $10k/mo net right now. I'm no accountant, but I'm fairly confident you can't pay the expenses of a company + a half dozen employees on $10k/mo. PM agrees - they've burnt through about $7 mil of investor cash over their 6 years of existence. No path to profitability is in sight. Around the same time I've got the Project X repository (whew, at least they used source control) moved over into my world and have started reviewing the actual source. I'm no Node wizard, but I'm immediately confused as I see both Express and Hapi (two server frameworks, generally considered competition to one another) used in the same project. That's...odd. Investigation intensifies: it's a simple CRUD project that takes a form submission from a registered user, saves it in Mongo and slaps it into a queue for delivery to the given doctors email. That's really it. There's some back-end admin that allows the doctor to write some notes about their visit. Like a little baby EMR (though I had no idea what an EMR was at that time). Amusingly, it's got an Angular front-end (1.x, because why not spread salt on my wounds) that hits an Express endpoint that then proxies the call to a Hapi endpoint. For no reason. I can't find a single comment or piece of documentation explaining why. Icing on the cake? Their is in fact authentication used from Angular -> Express. The Hapi endpoints, however, are wide open - but surely not from the ELB, right? Certainly it's just an idiotic architectural decision that isn't actually exposed to the public? Nope. There's a rule in the ELB. Sweet Baby Ray's someone help me, there is a publicly accessible, completely open API that anyone could discover that gives away patient and doctor information. Huh, I wonder if the US has any sort of regulation on that kind of stuff? I should really take some time to investigate that HIPAA thing I found earlier, maybe that's got something to do with it... Employment duration: unknown. My ulcer has had a baby. I think I may have had a psychotic break. I Googled HIPAA. I simultaneously shat and pissed myself, which I didn't think was possible during a panic attack, but the human body is an amazing thing. I took Thursday and Monday off from work to read through a PDF I found of this most enlightening "HIPAA" legislation. It says "SAMPLE" or "UNOFFICIAL" or some such on it, so I'm not sure how accurate it is, but whatever - I need to educate myself somehow. I spent a thrilling four days reading, re-reading, and summarizing what I understood of the several hundred page document - printed in three-column layout because why not make it more abysmal. It doesn't seem completely dire; it looks like there is some stuff we need to do if we are storing this mythical PHI, but it isn't terribly complex (at least technically!). I had already been planning encrypting everything we own, and all of our sites are already behind SSL, so this should be cake. Phew! Calm down, baby-ulcer, don't think about grand-kids quite yet. Also I found a few great summaries of the Act which I could share with my COO - but really, we need to sit down with Legal and have them explain why this was never brought up. And let's be honest, I'm not a lawyer - the professionals can handle this! Legal has never heard of HIPAA. That's not good. I convince COO to ask Legal to reach out to a different Legal who specializes in healthcare. We sit down with them a few days later and our new Legal turns white after I lay out everything we do, our concerns, and the simple question: "Do we need to do any of this stuff I read about?" Turns out, having your CTO read a complex, many-hundred-pages legal document is not the best way to get accurate legal advice. We're fucked. We're a TPA filing insurance claims - we absolutely, 100% must comply with this Act. Oh and guess what? The Act has a delightful addition called an Omnibus, passed back in '13, that makes any possible defense we might have had to not comply...completely null and void. We're in what is called 'Breach'! We have fucked up. Royally and legally. Icing? We're all personally liable, at least to the letter of the law. But don't worry - we didn't know we fucked up, so the fees are an order of magnitude less. They'll only bankrupt the company 5 times over, instead of 10! Hurray!

dang 7y ago

I've merged it into your comment above so the whole thing is one piece.

zem 7y ago
there's a lot of stuff in the pastebin that hasn't been added to the comment
- dang 7y ago
  Ah ok. Thanks! I'll uncollapse the GP.

forgotmypwd123 7y ago

You're gonna go to jail.

deleted 7y ago
[deleted]

tomp 7y ago

You should be a writer. Or a movie producer.

abledon 7y ago
"We're never going to do that, Throwaway," -- genius.

abledon 7y ago

please write fiction please. you are like a thriller writer, it was better than watching "the dark night"

timwaagh 7y ago

For someone who cares so deeply about security you just gave away a lot of sensitive info and uploaded it to a popular forum.