28 ms·

An odd line from the article, wherein it states that security researchers don’t blame vendors, but the physicians and hospitals that fail to properly secure the

An odd line from the article, wherein it states that security researchers don’t blame vendors, but the physicians and hospitals that fail to properly secure the software. I have never, in all my years of working in healthcare, seen a hospital or physicians office directly install and manage PACS. They pay a third-party - usually the vendor - to install, configure, and walk them through it. Maybe a behemoth system like Northwell has the IT bench to do it themselves, but that would be the exception. So allow me to rephrase slightly: “technologically inept organization pays vendor to make machine go vroom. Vendor leaves keys in ignition. Damn that technologically inept organization.” To take a 10,000-foot view of the situation, though: Healthcare-related technologically was largely pushed on the industry via legislation. Said legislation was almost entirely stick, no carrot. The result was healthcare organizations with a gun to their head to buy from a handful of vendors, with no real ROI to be seen from it - aka, the government outsourcing its costs to private industry, and throwing pork to some major health IT firms along the way. When a technology is forced on you at a loss, from a vendor with little incentive to optimize ease of use or utility, you get a terrible piece of shit that no one wants to invest more time and money into than absolutely needed. That’s going to show itself in a myriad of ways.

christophilus 7y ago
I completely agree. I have friends in the medical field, and they hate their computer systems. One of them spends almost as much time on data entry as he does with his patients. He has to double and sometimes triple enter data. He’s probably going to end up hiring someone to do that full time, which is so obviously a totally broken system.
- blueboo 7y ago
  > One of them spends almost as much time on data entry as he does with patients ...then he’s one of the lucky ones! One study found that for every hour a physician spends with a patient, she spends two on processing health records. https://www.jwatch.org/fw111995/2016/09/06/half-physician-time-spent-ehrs-and-paperwork https://www.jwatch.org/fw111995/2016/09/06/half-physician-ti...
  - brianwawok 7y ago
    I mean, for every hour I spend writing production code - I spend an hour in agile meetings, and 2 hours chasing down obscure bugs in javascript libraries. Not that many professions are "do visible part of work 100%". Heck, I hear bricklayers need to spend some time mixing cement and getting bricks off the truck, not just scooping mud and sticking bricks. Health records ARE a big part of the product of a doctor. Keeping a good chart and finding trends over time is a bit part of the service you need.
    - 1996 7y ago
      > Health records ARE a big part of the product of a doctor I long for practices that would keep no record of my issues, except what I volunteer to them at the beginning of the consult. Many countries do that just fine, but for some reason in the US I am asked to fill pages on insignificant trivia to cover their ass or follow some weird law or tradition maybe? I don't want perfect healthcare. Good enough is fine! So now I just see doctors when traveling. Simpler, faster, and cheaper too.
      - brianwawok 7y ago
        Hum. So much about healthcare is about trends. How your blood pressure is today vs a month ago matters a lot more than holding up your number to a chart. Having actual good medical history would be super helpful.
        1996 7y ago
        Then I will keep the records, or my smart watch or smart phone.
    - egocodedinsol 7y ago
      Your analogies would make more sense if you spent 2 hours on documentation for every hour you spent coding or bug finding.
      - 7y ago
trackofalljades 7y ago
This was my immediate thought at the headline, doctors-who-what-now? This feels informed from the technology side, and profoundly ignorant of how health care IT actually works (especially in the United States).
- prostheticvamp 7y ago
  When it comes to healthcare, everything is always the doctor's fault. It's convenient to have a single target to blame for everything that goes wrong in the industry. Never mind that most physicians are just employees, with plenty of layers of management, in massive organizations, with extremely heavy regulatory oversight. If an organization that runs three hospitals can't put together the IT to secure their PACS system with a decent password, that's the fault of the physician about as much as it's the fault of the nurse, the janitor, the cafeteria chef, etc. WTF is with people blaming doctors for literally everything related to healthcare? Do they not understanding we haven't been in charge of anything for a couple of decades now? Since the combined rise of HMOs and Medicare/Medicaid, and the massive hospital M&A splurge, we're just line workers. We try to do our best by patients, but we ain't in charge of anything.
txcwpalpha 7y ago
I’ve been the IT vendor in this scenario. While I’m sure there are plenty of inept vendors not doing their part to ensure the systems they implement are secure, a big part of it is doctors and their work culture. Many doctors see themselves as too important to deal with security. They have an attitude of “I went to school for medicine, not computers! How dare you ask me to use a computer.” They are not only technologically inept, they are proud of it. And I’m not just talking about refusing to use complicated software. I’m talking about doctors that insist that they shouldn’t be forced to use passwords (not even complicated passwords; ANY passwords). And in most of the organizations I have dealt with, doctors are the most important people in the organization and have final say on anything, which often means that the security department’s efforts are all overridden by doctors that can’t be arsed to even type in a password before using their EMR, and don’t even dream of something more complicated like asking them to use multi-factor auth. I once worked at a hospital where a doctor was looking at porn at work, clicked a phishing link, and gave up his network credentials. An attacker then used those credentials to breach the network and siphoned several hundred thousand dollars from the financial system (wiring money to himself). Security detected this and disabled his account. 20 minutes later the doctor had called the CEO, yelled at him (“how dare you lock me out of my account!”) who then called security to yell at us and insist we re-enable his account. The doctor was never reprimanded (for falling for phishing or for the porn) meanwhile the security team got a stern talking to and was instructed to never disable a doctor’s account again. Healthcare is a different world for security. You have to acknowledge that yes, patient safety is more important than security, but oftentimes these doctors take it to an extreme and they are very difficult to work with. I have never met a group of people more elitist and “too important to be bothered” by security than doctors.
- deleted 7y ago
  [deleted]
- endorphone 7y ago
  This seems like a caricature or an exception. Doctors are very aware of HIPAA (and the equivalent in every other country), and the professional and monetary costs of non-compliance. Doctors didn't set up these systems. Doctors didn't expose them to the internet. As the other post said, vendors did. If those vendors couldn't properly communicate the needs, that's their problem. What I think is a more rational explanation for doctor (nurse, lab technologist, etc) resistance is that the industry is rife with incompetence and vendor balkanization. So much so that every healthcare professional deals with literally dozens of logins to try to do their job. Every one of those logins has its own bizarre password policies, rotation schedules, etc. Pretty soon there is rightly hostility to whatever scheme some small niche vendor has imagined up in the illusion of security.
humaniania 7y ago
A brand new account posting scathing anti-government anti-regulation content? HIPAA and HITECH and the other legislation that you're likely referring to pushed a stagnant industry in the right direction. Yes there is pain with growth but patients are far better off for it, which is what the end goal was.
- pjmorris 7y ago
  At my annual physical, as my doctor was typing away at data entry on a laptop in the exam room, I asked him whether he felt the new electronic systems had freed up his time to spend more time on patients, or whether they had taken time away from patients. He felt the later. I realize that anecdote is not data, and I'm not sure what metric of 'better' you're using, but I wouldn't be too hasty to claim technology as an unalloyed good in health care.
  - Scoundreller 7y ago
    Thing is, people will overlook the elements that are faster and focus on the slower. Lab results for any patient at a click or two? Ignored. Changing a med order to be stopped in 27 hours? Guaranteed to be flagged to the nurse at the exact right time. As much as I complain about Google’s changes (stop ignoring my double quotes!), it’s probably improved overall despite its constant attacks.
- prostheticvamp 7y ago
  Yes, because I am a lurker that was moved to post by the degree to which I disagreed with the article. Please restrict yourself to actually arguing with the content of my posts, and not going ad hominem. It's both against the rules of HN, and just shitty. You say "pushed a stagnant industry", I say "hostility to small practices." Large hospitals were already moving onto EMR to better handle the volume of their data, if not already having done so. It's small practices that couldn't afford things like EPIC, and were forced to move onto free, ad-revenue-driven crap like PracticeFusion that just made everything slower and worse, without improving shit for patients. Are some patients better off for it? I think so. I appreciate web portals, which wouldn't have existed otherwise. I don't appreciate the death of small practices, the majority of whom are now selling out at cost to large hospital chains.
aivosha 7y ago
how about those health care professionals not logging out of their sessions, writing up their passwords on the stickit notes and just generally leaving their computers unlocked for anybody to just browse through. Its always easy to blame the "maker" and say Im an idiot, make this idiot proof. Do you really want people to treat you, being in a mindset of an idiot ? If there is one field in all of universe that you cant not blame the tools for your own idiocracy is the health care ! I want you, the doctor, bend backwards to be at the top of your game ALWAYS, not just when you are doing a brain surgery. I want you to be the ONE that i can have 100% trust that you have my interests in mind instead of playing blame games.
lostlogin 7y ago
> no real ROI to be seen from it. I just did a brief Google, and the situation seems to be the same as always - there isn’t a clear win financially when a PACS is installed. They are expensive to buy, to run and to maintain and the gains are often hard to measure financially. Having a minimum wage worker sort old films and carry them to where they are needed was cheap compared to the wages and hardware a large hospital needs to pay for when a large PACS goes in. The number of people who miss hard copy film must be very small however, that world was archaic.
hhas01 7y ago
Inasmuch as “Caveat Emptor” is the Latin to live by, physicians and hospitals are indeed responsible for making sure what they’ve just bought is safe and fit for purpose. Especially with HIPAA et al already breathing down their necks. The big problem is that tech grifters, just like AltMed scamsters, are just way quicker and better at burying all their shit than surgeons and scientists are at digging it out again. And, to be fair, doctors do already have far more pressing things to be digging out: wood spales, fence railings, guinea worms, and so on. Hence the need to hire in [ostensible] specialists in the first place. Still, be consoled that us countries with socialized heathcare are just as adept at Medical IT disasters as yours are. :/ -- “A lie can travel halfway around the world before the truth can get its boots on.” Of course, this was before we invented the networked computer.
hannob 7y ago
You're right, this is a very irritating take. From what I understand these DICOM-devices are insecure by default, you can just connect to them and download data, and they expect their users to make them secure with network separation etc. That's not a realistic expectation if your customers aren't IT security professionals. And there's no reason to create such a flawed design, a simple password would be a huge improvement. In such a case the blame should fully go to the vendor.
chapium 7y ago
If a physicians office installed something like this on their own I'd be horrified.

christophilus 7y ago

I completely agree. I have friends in the medical field, and they hate their computer systems. One of them spends almost as much time on data entry as he does with his patients. He has to double and sometimes triple enter data. He’s probably going to end up hiring someone to do that full time, which is so obviously a totally broken system.

blueboo 7y ago
> One of them spends almost as much time on data entry as he does with patients ...then he’s one of the lucky ones! One study found that for every hour a physician spends with a patient, she spends two on processing health records. https://www.jwatch.org/fw111995/2016/09/06/half-physician-time-spent-ehrs-and-paperwork https://www.jwatch.org/fw111995/2016/09/06/half-physician-ti...
- brianwawok 7y ago
  I mean, for every hour I spend writing production code - I spend an hour in agile meetings, and 2 hours chasing down obscure bugs in javascript libraries. Not that many professions are "do visible part of work 100%". Heck, I hear bricklayers need to spend some time mixing cement and getting bricks off the truck, not just scooping mud and sticking bricks. Health records ARE a big part of the product of a doctor. Keeping a good chart and finding trends over time is a bit part of the service you need.
  - 1996 7y ago
    > Health records ARE a big part of the product of a doctor I long for practices that would keep no record of my issues, except what I volunteer to them at the beginning of the consult. Many countries do that just fine, but for some reason in the US I am asked to fill pages on insignificant trivia to cover their ass or follow some weird law or tradition maybe? I don't want perfect healthcare. Good enough is fine! So now I just see doctors when traveling. Simpler, faster, and cheaper too.
    - brianwawok 7y ago
      Hum. So much about healthcare is about trends. How your blood pressure is today vs a month ago matters a lot more than holding up your number to a chart. Having actual good medical history would be super helpful.
      - 1996 7y ago
        Then I will keep the records, or my smart watch or smart phone.
  - egocodedinsol 7y ago
    Your analogies would make more sense if you spent 2 hours on documentation for every hour you spent coding or bug finding.
    - 7y ago

trackofalljades 7y ago

This was my immediate thought at the headline, doctors-who-what-now? This feels informed from the technology side, and profoundly ignorant of how health care IT actually works (especially in the United States).

prostheticvamp 7y ago
When it comes to healthcare, everything is always the doctor's fault. It's convenient to have a single target to blame for everything that goes wrong in the industry. Never mind that most physicians are just employees, with plenty of layers of management, in massive organizations, with extremely heavy regulatory oversight. If an organization that runs three hospitals can't put together the IT to secure their PACS system with a decent password, that's the fault of the physician about as much as it's the fault of the nurse, the janitor, the cafeteria chef, etc. WTF is with people blaming doctors for literally everything related to healthcare? Do they not understanding we haven't been in charge of anything for a couple of decades now? Since the combined rise of HMOs and Medicare/Medicaid, and the massive hospital M&A splurge, we're just line workers. We try to do our best by patients, but we ain't in charge of anything.

txcwpalpha 7y ago

I’ve been the IT vendor in this scenario. While I’m sure there are plenty of inept vendors not doing their part to ensure the systems they implement are secure, a big part of it is doctors and their work culture. Many doctors see themselves as too important to deal with security. They have an attitude of “I went to school for medicine, not computers! How dare you ask me to use a computer.” They are not only technologically inept, they are proud of it. And I’m not just talking about refusing to use complicated software. I’m talking about doctors that insist that they shouldn’t be forced to use passwords (not even complicated passwords; ANY passwords). And in most of the organizations I have dealt with, doctors are the most important people in the organization and have final say on anything, which often means that the security department’s efforts are all overridden by doctors that can’t be arsed to even type in a password before using their EMR, and don’t even dream of something more complicated like asking them to use multi-factor auth. I once worked at a hospital where a doctor was looking at porn at work, clicked a phishing link, and gave up his network credentials. An attacker then used those credentials to breach the network and siphoned several hundred thousand dollars from the financial system (wiring money to himself). Security detected this and disabled his account. 20 minutes later the doctor had called the CEO, yelled at him (“how dare you lock me out of my account!”) who then called security to yell at us and insist we re-enable his account. The doctor was never reprimanded (for falling for phishing or for the porn) meanwhile the security team got a stern talking to and was instructed to never disable a doctor’s account again. Healthcare is a different world for security. You have to acknowledge that yes, patient safety is more important than security, but oftentimes these doctors take it to an extreme and they are very difficult to work with. I have never met a group of people more elitist and “too important to be bothered” by security than doctors.

deleted 7y ago
[deleted]
endorphone 7y ago
This seems like a caricature or an exception. Doctors are very aware of HIPAA (and the equivalent in every other country), and the professional and monetary costs of non-compliance. Doctors didn't set up these systems. Doctors didn't expose them to the internet. As the other post said, vendors did. If those vendors couldn't properly communicate the needs, that's their problem. What I think is a more rational explanation for doctor (nurse, lab technologist, etc) resistance is that the industry is rife with incompetence and vendor balkanization. So much so that every healthcare professional deals with literally dozens of logins to try to do their job. Every one of those logins has its own bizarre password policies, rotation schedules, etc. Pretty soon there is rightly hostility to whatever scheme some small niche vendor has imagined up in the illusion of security.

humaniania 7y ago

A brand new account posting scathing anti-government anti-regulation content? HIPAA and HITECH and the other legislation that you're likely referring to pushed a stagnant industry in the right direction. Yes there is pain with growth but patients are far better off for it, which is what the end goal was.

pjmorris 7y ago
At my annual physical, as my doctor was typing away at data entry on a laptop in the exam room, I asked him whether he felt the new electronic systems had freed up his time to spend more time on patients, or whether they had taken time away from patients. He felt the later. I realize that anecdote is not data, and I'm not sure what metric of 'better' you're using, but I wouldn't be too hasty to claim technology as an unalloyed good in health care.
- Scoundreller 7y ago
  Thing is, people will overlook the elements that are faster and focus on the slower. Lab results for any patient at a click or two? Ignored. Changing a med order to be stopped in 27 hours? Guaranteed to be flagged to the nurse at the exact right time. As much as I complain about Google’s changes (stop ignoring my double quotes!), it’s probably improved overall despite its constant attacks.
prostheticvamp 7y ago
Yes, because I am a lurker that was moved to post by the degree to which I disagreed with the article. Please restrict yourself to actually arguing with the content of my posts, and not going ad hominem. It's both against the rules of HN, and just shitty. You say "pushed a stagnant industry", I say "hostility to small practices." Large hospitals were already moving onto EMR to better handle the volume of their data, if not already having done so. It's small practices that couldn't afford things like EPIC, and were forced to move onto free, ad-revenue-driven crap like PracticeFusion that just made everything slower and worse, without improving shit for patients. Are some patients better off for it? I think so. I appreciate web portals, which wouldn't have existed otherwise. I don't appreciate the death of small practices, the majority of whom are now selling out at cost to large hospital chains.

aivosha 7y ago

how about those health care professionals not logging out of their sessions, writing up their passwords on the stickit notes and just generally leaving their computers unlocked for anybody to just browse through. Its always easy to blame the "maker" and say Im an idiot, make this idiot proof. Do you really want people to treat you, being in a mindset of an idiot ? If there is one field in all of universe that you cant not blame the tools for your own idiocracy is the health care ! I want you, the doctor, bend backwards to be at the top of your game ALWAYS, not just when you are doing a brain surgery. I want you to be the ONE that i can have 100% trust that you have my interests in mind instead of playing blame games.

lostlogin 7y ago

> no real ROI to be seen from it. I just did a brief Google, and the situation seems to be the same as always - there isn’t a clear win financially when a PACS is installed. They are expensive to buy, to run and to maintain and the gains are often hard to measure financially. Having a minimum wage worker sort old films and carry them to where they are needed was cheap compared to the wages and hardware a large hospital needs to pay for when a large PACS goes in. The number of people who miss hard copy film must be very small however, that world was archaic.

hhas01 7y ago

Inasmuch as “Caveat Emptor” is the Latin to live by, physicians and hospitals are indeed responsible for making sure what they’ve just bought is safe and fit for purpose. Especially with HIPAA et al already breathing down their necks. The big problem is that tech grifters, just like AltMed scamsters, are just way quicker and better at burying all their shit than surgeons and scientists are at digging it out again. And, to be fair, doctors do already have far more pressing things to be digging out: wood spales, fence railings, guinea worms, and so on. Hence the need to hire in [ostensible] specialists in the first place. Still, be consoled that us countries with socialized heathcare are just as adept at Medical IT disasters as yours are. :/ -- “A lie can travel halfway around the world before the truth can get its boots on.” Of course, this was before we invented the networked computer.

hannob 7y ago

You're right, this is a very irritating take. From what I understand these DICOM-devices are insecure by default, you can just connect to them and download data, and they expect their users to make them secure with network separation etc. That's not a realistic expectation if your customers aren't IT security professionals. And there's no reason to create such a flawed design, a simple password would be a huge improvement. In such a case the blame should fully go to the vendor.

chapium 7y ago

If a physicians office installed something like this on their own I'd be horrified.