5 ms·

Just a few months ago I had to take a series of tests with LifeLabs (blood, urine, physical, etc) to update my immigration papers. Did you know you cannot choos

Just a few months ago I had to take a series of tests with LifeLabs (blood, urine, physical, etc) to update my immigration papers. Did you know you cannot choose where to take these tests? You are more or less forced to use LifeLabs because the doctors designated by the IRCC (Immigration, Refugees and Citizenship Canada) only partner with LifeLabs to do these tests, it’s an ugly monopoly that is impossible to fight as an immigrant. I knew, from the moment I walked in the laboratory, all the information I was handing and the data they were going to find was going to be leaked sooner than later. I have tried more than once to make secretaries, assistants and nurses to understand how bad most of their systems are and how easy it is to expose the information of all their patients to malicious actors, but arguing with them is pointless because they barely understand what I am talking about or do not have the power to change anything. And the worst thing is, I have to visit LifeLabs again next month for another physical checkup and to take some X-rays and these news will not change anything. Side note… I used to work as a malware researcher for a security information company in the US. One day I remembered the story of Sisyphus: > In Greek mythology Sisyphus was the king of Ephyra (now known as Corinth). He was punished for his self-aggrandizing craftiness and deceitfulness by being forced to roll an immense boulder up a hill only for it to roll down when it nears the top, repeating this action for eternity — https://en.wikipedia.org/wiki/Sisyphus https://en.wikipedia.org/wiki/Sisyphus I ended up quitting my job no long after reading this story because it made me realize I was fighting an endless fight.

coldcoldground 7y ago
There's something in this story that doesn't ring true. You knew from the moment you walked into the laboratory that their data handling practices were inadequate and prone to being hacked/leaked. How? You tried to explain this to their secretaries and nurses. Why bother when it's obvious they can't/won't do anything about it? Why not contacting their management or IT?
- guessmyname 7y ago
  > You knew from the moment you walked into the laboratory that their data handling practices were inadequate and prone to being hacked/leaked. How? The laboratory is divided into small rooms where the patient talks with the nurse and/or doctor, each room looks something like this [1] along with a computer that is connected to whatever system LifeLabs uses. When I arrived for my appointment the nurse left me alone in the room for approximately 15 minutes, the computer was on, and the user session (which I believe was created using the doctor’s credentials) was still alive, I could have done a lot with that computer while the nurse was outside checking the other patients. Later, the doctor came to do the initial physical checkup and then left for another 10-15 minutes to talk with another nurse. This gave me more time to “snoop around” and in fact, I took the opportunity to take a picture of the computer screen [1]. Ironically, you can see in the picture that the doctor uses a Post-it Note to cover the webcam, which means they do care about their privacy but not the privacy of their patient’s. You may think “this is not LifeLabs fault but the doctor’s fault” but this is how social engineering works and as people say “A chain is only as strong as its weakest link”. > You tried to explain this to their secretaries and nurses. > Why bother when it's obvious they can't/won't do anything about it? > Why not contacting their management or IT? Yes, good point, but this doesn’t disprove the rest of my anecdote. [1] https://en.wikipedia.org/wiki/Doctor%27s_office https://en.wikipedia.org/wiki/Doctor%27s_office [2] https://i.imgur.com/c0tXTEK.png https://i.imgur.com/c0tXTEK.png
- supercommand 7y ago
  To be fair to life labs, at least they don’t dox you aloud to an entire waiting room. I witnessed that happen to a few prominent financiers in Toronto while I was getting some bloodwork done. It was terrifying within about 5 minutes I had all the personal information I’d need to do some seriously nefarious things. This happens on most every occasion I visit a clinic in Canada. Nurses and secretaries do not care.
  - lvturner 7y ago
    I wonder if it's more that they just don't understand - also habits are hard to change. "it's always been this way" Not sure what the solution is.
  - rickyc091 7y ago
    Happens in the US too. As I was waiting for my doctor's appointment, I was just listening to the secretary call up patients to obtain payments. She was just reading out their credit card information out loud. I was honestly tempted to just take one down then call the credit card company to let them know it was compromised.
afthonos 7y ago
“One must imagine Sisyphus happy.” —Albert Camus, The Myth of Sisyphus
- ajlburke 7y ago
  I like to think of Sisyphus a bit like someone waiting in line for a rollercoaster or a ski lift. The pushing is a slog, but then you reach the top and WOW BOOOM the rock cascades down the hill and it's AWESOME! Time to start pushing it back up again. Yes yes I know Sisyphus is a metaphor for the pointlessness of life - but that doesn't mean you have to take it at face value.
  - jiveturkey 7y ago
    > pointlessness or perhaps that the work itself is the reward
  - gerbilly 7y ago
    > The pushing is a slog, but then you reach the top and WOW BOOOM the rock cascades down the hill and it's AWESOME! In the original myth the rock rolls down alright, but it rolls down over our hero and then he has to go down and push it back up again knowing what will happen.
jacquesm 7y ago
Canada is full of such stuff. Ditto banks, telcos, dairy, eggs, liquor and so on.
throw0101a 7y ago
> You are more or less forced to use LifeLabs because the doctors designated by the IRCC (Immigration, Refugees and Citizenship Canada) only partner with LifeLabs to do these tests, it’s an ugly monopoly that is impossible to fight as an immigrant. The other main option is Dynacare. Besides those two, who else is there? Both have built up convenient infrastructure where results are fed back into doctors' EHR systems. I wouldn't be against more competition, but it seems that there are certain economies of scale that make bigger more efficient: * https://healthydebate.ca/2015/02/topic/private-medical-labs-ontario https://healthydebate.ca/2015/02/topic/private-medical-labs-... * https://toronto.citynews.ca/2017/12/22/lab-industry-need-overhaul-say-critics/ https://toronto.citynews.ca/2017/12/22/lab-industry-need-ove... Side note: LifeLabs is owned by the OMERS pension fund.
aguyfromnb 7y ago
>Did you know you cannot choose where to take these tests? Welcome to the Canadian Healthcare system. It's free, but not without issue, even ignoring the long wait times and inability to get a doctor in most places in the country. Did you know I'm not allowed to go get my blood tested privately, even if I pay for it? That I require a requisition from a doctor (which I don't have, so I have to go to a walk-in clinic and take up the time of a doctor who could care less what they are signing)? And that the results then get shared back with said doctor, who's discretion it is what data he shares with me? It's bizarre. I often see Americans pointing to Canada's system as a shining example. I mean, sure, we don't have crushing medical debt, which is AWESOME. But our healthcare system has so many problems itself...
- SketchySeaBeast 7y ago
  What use case is there for getting your blood tested without getting a doctor involved?
  - endorphone 7y ago
    If you're bio-hacking, taking steroids for `recreation' and monitoring testosterone, just curious, etc, it does seem reasonable that you should be able to pay for and get your own tests. There are options that facilitate that, though it's a burgeoning market given that the overwhelming majority are ordered, and paid for, through the public system.
  - coralreef 7y ago
    Tracking your own health metrics when your curious to see how your diet, excercises, etc change
- stanski 7y ago
  Allowing private access to healthcare is a slippery slope. Anyone paying for a service is someone who is also taking the place of someone using that service as a basic right. I'm not saying it shouldn't be an option for blood tests in particular (as is your example) but there are multiple things to consider when you start opening those up to anyone willing/able to pay.

coldcoldground 7y ago

There's something in this story that doesn't ring true. You knew from the moment you walked into the laboratory that their data handling practices were inadequate and prone to being hacked/leaked. How? You tried to explain this to their secretaries and nurses. Why bother when it's obvious they can't/won't do anything about it? Why not contacting their management or IT?

guessmyname 7y ago
> You knew from the moment you walked into the laboratory that their data handling practices were inadequate and prone to being hacked/leaked. How? The laboratory is divided into small rooms where the patient talks with the nurse and/or doctor, each room looks something like this [1] along with a computer that is connected to whatever system LifeLabs uses. When I arrived for my appointment the nurse left me alone in the room for approximately 15 minutes, the computer was on, and the user session (which I believe was created using the doctor’s credentials) was still alive, I could have done a lot with that computer while the nurse was outside checking the other patients. Later, the doctor came to do the initial physical checkup and then left for another 10-15 minutes to talk with another nurse. This gave me more time to “snoop around” and in fact, I took the opportunity to take a picture of the computer screen [1]. Ironically, you can see in the picture that the doctor uses a Post-it Note to cover the webcam, which means they do care about their privacy but not the privacy of their patient’s. You may think “this is not LifeLabs fault but the doctor’s fault” but this is how social engineering works and as people say “A chain is only as strong as its weakest link”. > You tried to explain this to their secretaries and nurses. > Why bother when it's obvious they can't/won't do anything about it? > Why not contacting their management or IT? Yes, good point, but this doesn’t disprove the rest of my anecdote. [1] https://en.wikipedia.org/wiki/Doctor%27s_office https://en.wikipedia.org/wiki/Doctor%27s_office [2] https://i.imgur.com/c0tXTEK.png https://i.imgur.com/c0tXTEK.png
supercommand 7y ago
To be fair to life labs, at least they don’t dox you aloud to an entire waiting room. I witnessed that happen to a few prominent financiers in Toronto while I was getting some bloodwork done. It was terrifying within about 5 minutes I had all the personal information I’d need to do some seriously nefarious things. This happens on most every occasion I visit a clinic in Canada. Nurses and secretaries do not care.
- lvturner 7y ago
  I wonder if it's more that they just don't understand - also habits are hard to change. "it's always been this way" Not sure what the solution is.
- rickyc091 7y ago
  Happens in the US too. As I was waiting for my doctor's appointment, I was just listening to the secretary call up patients to obtain payments. She was just reading out their credit card information out loud. I was honestly tempted to just take one down then call the credit card company to let them know it was compromised.

afthonos 7y ago

“One must imagine Sisyphus happy.” —Albert Camus, The Myth of Sisyphus

ajlburke 7y ago
I like to think of Sisyphus a bit like someone waiting in line for a rollercoaster or a ski lift. The pushing is a slog, but then you reach the top and WOW BOOOM the rock cascades down the hill and it's AWESOME! Time to start pushing it back up again. Yes yes I know Sisyphus is a metaphor for the pointlessness of life - but that doesn't mean you have to take it at face value.
- jiveturkey 7y ago
  > pointlessness or perhaps that the work itself is the reward
- gerbilly 7y ago
  > The pushing is a slog, but then you reach the top and WOW BOOOM the rock cascades down the hill and it's AWESOME! In the original myth the rock rolls down alright, but it rolls down over our hero and then he has to go down and push it back up again knowing what will happen.

jacquesm 7y ago

Canada is full of such stuff. Ditto banks, telcos, dairy, eggs, liquor and so on.

throw0101a 7y ago

> You are more or less forced to use LifeLabs because the doctors designated by the IRCC (Immigration, Refugees and Citizenship Canada) only partner with LifeLabs to do these tests, it’s an ugly monopoly that is impossible to fight as an immigrant. The other main option is Dynacare. Besides those two, who else is there? Both have built up convenient infrastructure where results are fed back into doctors' EHR systems. I wouldn't be against more competition, but it seems that there are certain economies of scale that make bigger more efficient: * https://healthydebate.ca/2015/02/topic/private-medical-labs-ontario https://healthydebate.ca/2015/02/topic/private-medical-labs-... * https://toronto.citynews.ca/2017/12/22/lab-industry-need-overhaul-say-critics/ https://toronto.citynews.ca/2017/12/22/lab-industry-need-ove... Side note: LifeLabs is owned by the OMERS pension fund.

aguyfromnb 7y ago

>Did you know you cannot choose where to take these tests? Welcome to the Canadian Healthcare system. It's free, but not without issue, even ignoring the long wait times and inability to get a doctor in most places in the country. Did you know I'm not allowed to go get my blood tested privately, even if I pay for it? That I require a requisition from a doctor (which I don't have, so I have to go to a walk-in clinic and take up the time of a doctor who could care less what they are signing)? And that the results then get shared back with said doctor, who's discretion it is what data he shares with me? It's bizarre. I often see Americans pointing to Canada's system as a shining example. I mean, sure, we don't have crushing medical debt, which is AWESOME. But our healthcare system has so many problems itself...

SketchySeaBeast 7y ago
What use case is there for getting your blood tested without getting a doctor involved?
- endorphone 7y ago
  If you're bio-hacking, taking steroids for `recreation' and monitoring testosterone, just curious, etc, it does seem reasonable that you should be able to pay for and get your own tests. There are options that facilitate that, though it's a burgeoning market given that the overwhelming majority are ordered, and paid for, through the public system.
- coralreef 7y ago
  Tracking your own health metrics when your curious to see how your diet, excercises, etc change
stanski 7y ago
Allowing private access to healthcare is a slippery slope. Anyone paying for a service is someone who is also taking the place of someone using that service as a basic right. I'm not saying it shouldn't be an option for blood tests in particular (as is your example) but there are multiple things to consider when you start opening those up to anyone willing/able to pay.