25 ms·

I’ve been the IT vendor in this scenario. While I’m sure there are plenty of inept vendors not doing their part to ensure the systems they implement are secure,

I’ve been the IT vendor in this scenario. While I’m sure there are plenty of inept vendors not doing their part to ensure the systems they implement are secure, a big part of it is doctors and their work culture. Many doctors see themselves as too important to deal with security. They have an attitude of “I went to school for medicine, not computers! How dare you ask me to use a computer.” They are not only technologically inept, they are proud of it. And I’m not just talking about refusing to use complicated software. I’m talking about doctors that insist that they shouldn’t be forced to use passwords (not even complicated passwords; ANY passwords). And in most of the organizations I have dealt with, doctors are the most important people in the organization and have final say on anything, which often means that the security department’s efforts are all overridden by doctors that can’t be arsed to even type in a password before using their EMR, and don’t even dream of something more complicated like asking them to use multi-factor auth. I once worked at a hospital where a doctor was looking at porn at work, clicked a phishing link, and gave up his network credentials. An attacker then used those credentials to breach the network and siphoned several hundred thousand dollars from the financial system (wiring money to himself). Security detected this and disabled his account. 20 minutes later the doctor had called the CEO, yelled at him (“how dare you lock me out of my account!”) who then called security to yell at us and insist we re-enable his account. The doctor was never reprimanded (for falling for phishing or for the porn) meanwhile the security team got a stern talking to and was instructed to never disable a doctor’s account again. Healthcare is a different world for security. You have to acknowledge that yes, patient safety is more important than security, but oftentimes these doctors take it to an extreme and they are very difficult to work with. I have never met a group of people more elitist and “too important to be bothered” by security than doctors.

deleted 7y ago
[deleted]
endorphone 7y ago
This seems like a caricature or an exception. Doctors are very aware of HIPAA (and the equivalent in every other country), and the professional and monetary costs of non-compliance. Doctors didn't set up these systems. Doctors didn't expose them to the internet. As the other post said, vendors did. If those vendors couldn't properly communicate the needs, that's their problem. What I think is a more rational explanation for doctor (nurse, lab technologist, etc) resistance is that the industry is rife with incompetence and vendor balkanization. So much so that every healthcare professional deals with literally dozens of logins to try to do their job. Every one of those logins has its own bizarre password policies, rotation schedules, etc. Pretty soon there is rightly hostility to whatever scheme some small niche vendor has imagined up in the illusion of security.
- txcwpalpha 7y ago
  It may seem so, but I’ve done security consulting work for 10+ of the largest hospital chains and insurance providers in the country and I can assure you it isn’t an exception. Doctors don’t care about HIPAA (“that’s legal’s job”). They don’t care about the company’s finances (unless it’s a small private practice, “that’s the accountant’s job”). Some of the complexity is caused by the software itself being complex, yes, but that’s not what I’m talking about. In every organization I have worked with, doctors were always the biggest obstacle to even doing something as simple as requiring them to carry around a badge for physical access to the building. As a group, they are very resistant to anything that might add an extra step to their workflow. And yes, everyone hates and is resistant to stuff being added to their workflow, but I find most people are amenable to it as long as it’s a small interruption and it’s for a good reason (security). Doctors generally don’t have that attitude, though.
  - dkdklk 7y ago
    Sounds like someone has it in for doctors. I worked in healthcare IT for years, before than going to medical school, and now in residency. My experience really does not match yours. As mentioned earlier in the thread, I will agree that doctors in general are quite resistant to technology because they have been fucked over by implementations that are more concerned with billing and regulatory than either better patient care or improving physician quality of life/workload. Most medical facilities use badges for access. I think what you’re calling resistance is increased scrutiny, something you might not be used to dealing with in other fields. Based on your sweeping generalizations tinged with bitterness I can only imagine most doctors that have to work with you professionally are going to be a bit on edge. The reaction you’re getting from all these physicians you’re working with is probably related to what I can only imagine is a shitty attitude.
    - jcims 7y ago
      Also in security for a long time, spending a lot of that with hospitals and healthcare organizations. My experience matches the parents. Your points are very valid but doctors can definitely be dicks as well.
trhway 7y ago
>doctors that insist that they shouldn’t be forced to use passwords (not even complicated passwords; ANY passwords). well, it is a clear voice of customer. And it has good reason behind it - time and effort that the customer would like to avoid wasting. Instead of disparaging the customers and their needs how about listening to it and trying to really solve the issues. May be doctors for example would be more happy with having RFID microchip injected under the skin than typing password in? The security industry should start solving the issues for the benefit of users instead of pushing the crap down everybody throats under the disguise of holy cow of "Security!". >clicked a phishing link, and gave up his network credentials. and you still continue to think that password based solutions are suitable there? >I have never met a group of people more elitist and “too important to be bothered” than security IT. Your post is a prrety good example of it.
- txcwpalpha 7y ago
  In another company, we tried rolling out RFID badges that could be scanned at any workstation to log doctors in rather than passwords. This proved to be too inconvenient for doctors as well, and the system had to be rolled back within a month because doctors kept forgetting to keep their badge with them and would then throw a hissy fit because they wanted to go back to the old system where all workstations were permanently unlocked. Security IT is, in my experience, one of the most amenable in terms of trying to come up with new ways to serve customers because the customers require it (all customers require it, not just doctors), but doctors are on an entirely different level when it comes to resistance to change.
  - carbocation 7y ago
    In contrast to your experience, all VA physicians are obligated to use an ID card with a chip in order to login.
    - txcwpalpha 7y ago
      Indeed, other hospital chains do as well, which is why we viewed it as a good option and went down that path to begin with. In the case I'm referring to, everyone at the hospital already had badges and the thought was that removing password requirements and using the badges that everyone already had as a login would work well. It didn't work, not because of technical issues, but because we didn't anticipate the high number of doctors that apparently had lost their badges and had never faced consequences for it (the culture at this hospital was "oh you forgot your badge? no worries, I'll just open the door for you"). When we then asked the medical staff to keep better track of their badges (not just for the login system but also because of general campus security) we received incredible pushback, and that's when we had to roll back the program. IME, and as evidenced by the VA using a similar system as you mentioned, doctors are perfectly competent enough and able to use these systems and do just fine once they get used to the system. The issue is that they put up a fight more than anyone else when introducing something new, and oftentimes IME the new system never gets a chance before it's shot down.
PakG1 7y ago
This is a little off-topic, but I work in a school and sometimes get the same feeling from teachers. I imagine CEOs of companies that get breached because of stupid preventable reasons are also similar. My point is that I don't think this mindset is limited to doctors, though doctors may take it to another level.
- endorphone 7y ago
  It really applies to every industry -- people push back against things that they see as impediments to their work. Many/most HN visitors are software developers, and if you've worked in a Fortune 500 virtually all of us have gone to war with IT. "Don't they understand that we're special and we need special rights and privileges" etc. And often we have legitimate grievances because often arbitrary, counter-productive, productivity-sapping restrictions weigh us down. Often they're illusions of security. And I'm sure on some IT admin board they talk about all of those entitled developers and this one time this one developer did something really stupid, ergo all developers are god-complex dummies.
  - JamesBarney 7y ago
    Have you worked with doctor's? When I did I'd routinely sit in a room with 10-25 people and wait for hours on a doctor to show up to a meeting they'd schedule onlu to be told by a secretary he was busy. Everyone I know who has worked with doctor's has similar stories. This hasn't happened to me with any other position in any other organization, including vice presidents of Fortune 500 companies.
    - endorphone 7y ago
      I'm not claiming that doctors are interchangeable with other careers. Doctors often have higher priorities that can absolutely intrude at any time: An emergent medical situation is far more important than a meeting about document retention, for instance. For that VP, or CEO for that matter, those meetings are a major priority of their job. Instead I was pointing out that there are many fields where people resist IT-style policies, and many special snowflakes that believe (often rightly) that they are a unique situation. Often in tales like this the worst scenarios arise because some people aren't equipped at managing expectations and communicating reasons and benefits. If yet another vendor comes in with yet another system and yet another set of demands and obligations, to someone who sees it as a hindrance to their work product there will be resistance. Understanding and communicating in a way that, to use lame corporate speak, aligns goals makes things go much smoother.
prostheticvamp 7y ago
People are constantly targeting every aspect of the physician workflow, from CMS and private payors constantly changing their documentation requirements (which differ between payors and CMS, and results in hospitals trying to teach their docs to document everything to meet everyone's requirements - which are made intentionally lengthy and obtuse so as to justify denials of payment), quality improvement people and vendors populating the EMR with shit-tons of Alerts! meant to prevent medical errors (but, due to specific medical contexts justifying deviations from the textbook standard, the false positives vastly outweigh true positives, to the point where the alerts as a whole are utterly ignored), etc. It's easy to complain doctors resist (this particular workflow change), which is SO important because it affects PATIENT LIVES (because it's in the healthcare setting, so EVERYTHING DOES) damn entitled doctors. Then recall that every single time a doctor asks a nurse to do something that nurse will say "oh, just enter a communication order." And because your security set up your RFID to only work on a computer where you've already logged in earlier, and you're running around the hospital constantly, those badges aren't worth shit >half the time. It's easy to complain about doctors' resistance to various evolutions of their digital workflow, until you realize that nearly every evolution adds complexity and time-burden to their workload in a way that does not directly improve patient care, but slows down their work, increases complexity (which does adversely impact patient care), and lengthens their workday (because their patient workload isn't reduced in the slightest by this.) I don't know a single doc that doesn't do significant unpaid after-hours work catching up to their digital bullshit; you also would resist non-mission-critical additions to your unpaid workload. It's easy to treat physicians as entitled and resisting "just to resist", rather than understanding that the physician workflow is constantly changing, from every possible angle, and most often for reasons wildly unrelated to the immediate task of "taking care of the patient in front of me". You'd resist under those circumstances, too. There's a reason about half of physicians nationwide (https://www.medscape.com/slideshow/2019-lifestyle-burnout-depression-6011056#1 https://www.medscape.com/slideshow/2019-lifestyle-burnout-de...) are burned out. HALF. That's what happens when your ability to do your job is constantly fucked with. Perhaps you should consider what that means, and how that relates to what you're saying, rather than asserting doctors are just too damn self-important to change.
- Scoundreller 7y ago
Gatsky 7y ago
It goes both ways. I keep telling the IT people at my hospital to stop using SMS 2-factor and they blow me off and treat me like an idiot. Anyway, ‘Doctors’ are a pretty diverse bunch, and most of them aren’t arrogant porn-fiends.
- dvtrn 7y ago
  From experience, users who come to IT and simply demand we do something because 'reasons' usually aren't prioritized for follow up. Managers who come to IT and demand we do something and show us how it affects their work/department and perhaps the rest of the business and offer to be part of the solution making process often get first class attention. Could it be IT is blowing you off because of how you're delivering your complaint about SMS 2FA without regard for their existing workload? They likely have more than enough on their plates as it is to simply do something because someone from a department said something about it, and IT doesn't exactly pivot on lithium battery, especially in hospitals. That doesn't mean they don't care about your issue or request, but like every other department they have objectives and goals that were likely set well before your 2FA conversation even began.
  - Gatsky 7y ago
    You realise what you just did there right, without a hint of irony?
- txcwpalpha 7y ago
  I hear you and I’m sure it’s frustrating, but I’d be curious to know if the security team has any reasons for sticking with SMS 2FA. I’d be willing to bet money that the reason they blow you off is because it’s a sore spot for them. They probably have tried to implement other MFA methods but were reprimanded by the medical staff because anything other than SMS is too complicated (I’m harping on doctors a lot, but I legitimately do cringe at the thought of even asking a typical MD to download an MFA app or carry around a physical token).
  - Gatsky 7y ago
fencepost 7y ago
This is why in starting up my own little IT services company I'm planning on not serving medical clients. "HIPAA? I'm sure we're just fine, and no you can't take away my Windows 7 PCs."
- Scoundreller 7y ago
  I get the feeling big law is just as bad.
  - indyz 7y ago
    I never worked for big law, but medium law is terrible. Partners can just order the IT department to do anything. We had a new head of IT that tried to implement some common sense changes for an organization that handles sensitive data. Basic stuff: Block websites that tend to be malware vectors, don't let users be admins on their own machines, restrict USB storage to certain users, etc. We were forced to override it on the partners machines almost immediately.
    - wolco 7y ago
      Restricting partners usb access? Restricting websites and restricting install permissions. Overkill and probably the opposite of what they envision an IT department doing.
  - heartbreak 7y ago
    In my experience with biglaw (a single top 10 firm), their IT and in particular information security was top notch. Having a lot of available capital to work with probably helps.
    - whitepoplar 7y ago
      Which firm?
pmarreck 7y ago
I am horrified... at how plausible this sounds. Like many IT people, I google the heck out of a medical condition when I see doctors. Once I must have asked enough pertinent pointed questions that the doctor asked with a mix of sincerity AND condescension, “have you ever worked in a medical field?” No but like any curious individual I utilize the systems accumulating all human knowledge at our fingertips to inform myself... Doesn’t mean I can’t ultimately rely on your professional judgment, Sir
- Consultant32452 7y ago
  99% of the time doctors are annoyed by anyone who has researched and informed themselves on what their medical problems might be. The notable exception is when the doctor has repeatedly failed to accurately determine what's wrong. Then you're "allowed" to bring up your own ideas. I can't wait until the majority of work done by doctors is replaced with a small shell script. They will fight VERY hard to stop that from happening, and they're rich. So it will be a tough fight.
sizzle 7y ago
"An attacker then used those credentials to breach the network and siphoned several hundred thousand dollars from the financial system (wiring money to himself)." You're telling me the CEO was unfazed when they learned this was the reason you were locking down the system due to the doctor's own ineptitude and breaking company policy looking at porn and exposing them to direct financial loss and liability (lawsuits from PII data being breached and exfiltrated, etc)? The doctor put the whole hospital at risk and could have cost them millions and got that cryptolocker attack holding their data hostage indefinitely. The CEO should be thanking you guys for catching these huge security ($$$) breaches.
- txcwpalpha 7y ago
  I wouldn't say unfazed, but as I recall the reaction was more that the doctor wasn't to be blamed and that it was security's fault for not only "allowing" the breach to happen, but also for inconveniencing the doctor. At the organizations I worked with, doctors really have carte blanche privilege to get away with anything as long as they claim "it's for a patient". Even the C-suite will bend over backwards for MDs.
ssss11 7y ago
That exact attitude the doctors have is so common in other occupations, I’ve experienced it with lawyers.
bsder 7y ago
> I have never met a group of people more elitist and “too important to be bothered” by security than doctors. In my opinion, they're the only bunch that gets it right. Security should work correctly and not bother me. Period. The fact that it doesn't is laziness on the part of the security vendors. The bigger problem is that if security ever allows a user to make an incorrect security decision, it's probably worse than no security at all.
gambiting 7y ago
On the other hand(and I'm really not trying to excuse this behaviour) some doctors are almost daily in situations where "if I had a little bit more time or did this thing a day earlier maybe the patient would still be alive". If you run into those kinds of situations frequently, then obviously any slowdown(like having to remember or type in a password) is obviously stupid. And only they understand it, no IT employee ever would.
- jacquesm 7y ago
  That is why plenty of medical systems have an override in place for emergency situations allowing you to bypass all but the most basic authentication and segmentation. You will usually need to explain your override afterwards.
  - gambiting 7y ago
    I'm not talking about emergencies - I'm talking about situations where someone comes in for a "routine" blood test, but it shows they have cancer, and you as a doctor end up blaming yourself for not spending 10 minutes more to look at the test the day before, and the most obvious thing to blame for not having those 10 extra minutes is anything in IT that slows you down and takes those 10 minutes away. Even if it's irrational(maybe that person would have died even if you did look at the test slightly earlier) the guilt can be very real.
    - spinningslate 7y ago
      This. I don't know enough about the econo-political situation gp mentions, but the idea that doctors are somehow irresponsible for not wanting to enter passwords is a perfect example of a usability fail. It's too easy to gloss over - "it's only a password". But think of your own situation: ever been a bit frustrated when your desktop/laptop times out and locks, just as you were about to start typing again? Objectively it takes seconds to enter your password again. Subjectively it's broken your flow. Convenience has a non-linear decay curve. Now take that out of your work environment, where your normal context is sitting/standing at a desk. And put it in a hospital where a doctor is mobile by default: on their rounds/attending to patients/whatever. The answer isn't "make the doctors change and accept the inconvenience". The answer is "find a solution that actually helps them rather than hindering". Yes, there will always be recalcitrant users who stubbornly refuse to use systems irrespective of usability and/or utility. But I'd wager most aren't in this category. Most will be only too ready to use something that actually helps them. If passwords are a barrier to use, find a better solution.
usr1987 7y ago
Most business and schools are the same. Ignorance and self importance prevails over common sense!
matz1 7y ago
Its the IT job to provide security without having to inconvenience the user. you can't just add extra layer of inconvenience for the sake of security. Your ultimate goal should be to provide security without adding additional inconvenience to the user or without having the user to notice it at all.
- tagreene92 7y ago
  Just curious, are you joking, or are you serious?
  - matz1 7y ago
    Serious
- vageli 7y ago
  > Its the IT job to provide security without having to inconvenience the user. you can't just add extra layer of inconvenience for the sake of security. Your ultimate goal should be to provide security without adding additional inconvenience to the user or without having the user to notice it at all. We trade convenience for security every single day. Ever get locked out of your house because you forgot your keys? Why is that level of inconvenience (requiring keys on doors) okay but it's up to a security team to only implement security solutions which are frictionless and require zero change to workflows? Further, if we require keys on our doors, why wouldn't we require similar measures on software systems? If they are inconvenient, they are inconvenient compared to what? No security?
  - matz1 7y ago
    >We trade convenience for security every single day Which is totally sucks. >Ever get locked out of your house because you forgot your keys? Why is that level of inconvenience (requiring keys on doors) okay I would not say that is okay, that is sucks too
Gatsky 7y ago
Putting obviously unprofessional behaviour aside, there are good reasons why they have this attitude, although it is disappointing. First of all, as we all know, passwords are actually not a good solution to the problem of authentication. So we are asking people to participate in a system which we don't think is great and has serious usability issues for the non-technical. I know this isn't what doctors are actually thinking explicitly, but the point still needs to be made. Secondly, doctors are busy and have unpredictable workloads. They also have limited ability to delegate or ask for help if they are oversubscribed. This means if you add 10 minutes to their day, it will actually extend their working day by 10 minutes, and the things they have to do may take them until 10pm at night or worse (I semi-regularly finish documenting things after midnight, and I am not working night shift). They are understandably allergic to things which seem to increase the amount of stuff they have to do. Unfortunately, if you are a small IT vendor trying to introduce a service or a product to a large hospital (the bigger it is, the bigger the problem), you are going to have a difficult time. This is just the reality, which we can complain about, but there it is. There are strategies which can improve uptake and reduce resistance, but they only really work for large well-resourced vendors who are doing large projects: 1. Get the hospital to create a role for a doctor to be the clinical lead of whatever IT infrastructure you are trying to implement. 2. Bundle a large number of changes together, including obviously beneficial ones which save time (like an integrated EMR or paperless ordering) with important ones (like proper auth). 3. Make sure the institution has a lot of skin in the game, usually due to a large financial investment, or meeting some performance indicator, or keeping up with another competing institution. 4. Get the institution to reduce the workload when new systems are being implemented. This might sound obvious, but it makes a difference if you give doctors a bit of breathing room to adapt to a new service. 5. Publish some metric of how well each group of doctors is using a service in an email each week that gets sent to everyone. 6. Constantly remind everyone of why things are better after something has been implemented. I get hospital wide emails all the time about bake sales and other useless stuff, nobody sends emails celebrating or outlining why a recent change in IT infrastructure is making a positive difference. The only IT emails that get sent are when something is broken. Not surprisingly, this makes everyone sceptical of any new IT system. 7. Avoid direct face to face contact between doctors and the IT vendors. Doctors don't want to talk to the IT people, and IT people don't want to talk to the doctors. It just isn't useful, and everyone leaves feeling unsatisfied. Disconnect the technical expertise from people that don't understand why it matters. Find some other way to interact, through support staff, clinical leads etc. This stuff is part of the moat which large EMR providers have, they can actually do this stuff. I have seen it at play with Epic, whatever you think about the software, they have worked out some of the sociological aspects, and they understand that once the EMR is delivered, the process doesn't end.
nine_k 7y ago
> patient safety is more important than security Ultimately these are linked; imagine ransomware blocking a medical device necessary to save lives, or tampering with settings of an x-ray machine.
neuro_image3 7y ago
Physician here (neuroradiologist) and after working at several hospitals in the US and abroad, let me be really clear about this: 1) I have never seen a health care organization ANYWHERE where the physicians determine the IT policy (including and especially the IT security policy). 2) Universally, healthcare organizations use the bloated garbage that gets passed off as EMRs and affiliated garbage software. None of this is up to physicians. It's up to the administrative and bureaucratic parasites that have infested healthcare at every level and based largely (I assume) on crony relationships, because it's certainly not based on competence. 3)Healthcare IT is the most abysmal software anyone anywhere has ever devised to perform any task. Systems like EPIC are bloated, barely functional trash that systems have wasted billions of dollars on. The various components of departmental IT do not co-ordinate with one another, crash on a daily basis, are not fit for purpose and would embarrass engineers in any other industry. It comes as no surprise that security for these systems is piss-poor, just like everything else about these systems. Blaming doctors for this administrative mess, whilst not unexpected, is disingenuous at best (of course this is what healthcare administration excel at - making a mess and blaming physicians).
neuro_image3 7y ago
The example you site is so egregious (and unlikely) that there isn't a hospital in the US today where a physician who did anything remotely close to what you describe wouldn't immediately be fired (appropriately I might add). The bigger issue is how did the vendor or IT department responsible for the network allow routine internet access to interface with critical healthcare or financial infrastructure? (You don't have to be looking at porn to be on the wrong side of a phishing scam). Clearly you've had bad experiences with (some) doctors - generalizing that experience and extrapolating it to the issue of IT security is deeply flawed reasoning.

deleted 7y ago

[deleted]

endorphone 7y ago

This seems like a caricature or an exception. Doctors are very aware of HIPAA (and the equivalent in every other country), and the professional and monetary costs of non-compliance. Doctors didn't set up these systems. Doctors didn't expose them to the internet. As the other post said, vendors did. If those vendors couldn't properly communicate the needs, that's their problem. What I think is a more rational explanation for doctor (nurse, lab technologist, etc) resistance is that the industry is rife with incompetence and vendor balkanization. So much so that every healthcare professional deals with literally dozens of logins to try to do their job. Every one of those logins has its own bizarre password policies, rotation schedules, etc. Pretty soon there is rightly hostility to whatever scheme some small niche vendor has imagined up in the illusion of security.

txcwpalpha 7y ago
It may seem so, but I’ve done security consulting work for 10+ of the largest hospital chains and insurance providers in the country and I can assure you it isn’t an exception. Doctors don’t care about HIPAA (“that’s legal’s job”). They don’t care about the company’s finances (unless it’s a small private practice, “that’s the accountant’s job”). Some of the complexity is caused by the software itself being complex, yes, but that’s not what I’m talking about. In every organization I have worked with, doctors were always the biggest obstacle to even doing something as simple as requiring them to carry around a badge for physical access to the building. As a group, they are very resistant to anything that might add an extra step to their workflow. And yes, everyone hates and is resistant to stuff being added to their workflow, but I find most people are amenable to it as long as it’s a small interruption and it’s for a good reason (security). Doctors generally don’t have that attitude, though.
- dkdklk 7y ago
  Sounds like someone has it in for doctors. I worked in healthcare IT for years, before than going to medical school, and now in residency. My experience really does not match yours. As mentioned earlier in the thread, I will agree that doctors in general are quite resistant to technology because they have been fucked over by implementations that are more concerned with billing and regulatory than either better patient care or improving physician quality of life/workload. Most medical facilities use badges for access. I think what you’re calling resistance is increased scrutiny, something you might not be used to dealing with in other fields. Based on your sweeping generalizations tinged with bitterness I can only imagine most doctors that have to work with you professionally are going to be a bit on edge. The reaction you’re getting from all these physicians you’re working with is probably related to what I can only imagine is a shitty attitude.
  - jcims 7y ago
    Also in security for a long time, spending a lot of that with hospitals and healthcare organizations. My experience matches the parents. Your points are very valid but doctors can definitely be dicks as well.

trhway 7y ago

>doctors that insist that they shouldn’t be forced to use passwords (not even complicated passwords; ANY passwords). well, it is a clear voice of customer. And it has good reason behind it - time and effort that the customer would like to avoid wasting. Instead of disparaging the customers and their needs how about listening to it and trying to really solve the issues. May be doctors for example would be more happy with having RFID microchip injected under the skin than typing password in? The security industry should start solving the issues for the benefit of users instead of pushing the crap down everybody throats under the disguise of holy cow of "Security!". >clicked a phishing link, and gave up his network credentials. and you still continue to think that password based solutions are suitable there? >I have never met a group of people more elitist and “too important to be bothered” than security IT. Your post is a prrety good example of it.

txcwpalpha 7y ago
In another company, we tried rolling out RFID badges that could be scanned at any workstation to log doctors in rather than passwords. This proved to be too inconvenient for doctors as well, and the system had to be rolled back within a month because doctors kept forgetting to keep their badge with them and would then throw a hissy fit because they wanted to go back to the old system where all workstations were permanently unlocked. Security IT is, in my experience, one of the most amenable in terms of trying to come up with new ways to serve customers because the customers require it (all customers require it, not just doctors), but doctors are on an entirely different level when it comes to resistance to change.
- carbocation 7y ago
  In contrast to your experience, all VA physicians are obligated to use an ID card with a chip in order to login.
  - txcwpalpha 7y ago
    Indeed, other hospital chains do as well, which is why we viewed it as a good option and went down that path to begin with. In the case I'm referring to, everyone at the hospital already had badges and the thought was that removing password requirements and using the badges that everyone already had as a login would work well. It didn't work, not because of technical issues, but because we didn't anticipate the high number of doctors that apparently had lost their badges and had never faced consequences for it (the culture at this hospital was "oh you forgot your badge? no worries, I'll just open the door for you"). When we then asked the medical staff to keep better track of their badges (not just for the login system but also because of general campus security) we received incredible pushback, and that's when we had to roll back the program. IME, and as evidenced by the VA using a similar system as you mentioned, doctors are perfectly competent enough and able to use these systems and do just fine once they get used to the system. The issue is that they put up a fight more than anyone else when introducing something new, and oftentimes IME the new system never gets a chance before it's shot down.

PakG1 7y ago

This is a little off-topic, but I work in a school and sometimes get the same feeling from teachers. I imagine CEOs of companies that get breached because of stupid preventable reasons are also similar. My point is that I don't think this mindset is limited to doctors, though doctors may take it to another level.

endorphone 7y ago
It really applies to every industry -- people push back against things that they see as impediments to their work. Many/most HN visitors are software developers, and if you've worked in a Fortune 500 virtually all of us have gone to war with IT. "Don't they understand that we're special and we need special rights and privileges" etc. And often we have legitimate grievances because often arbitrary, counter-productive, productivity-sapping restrictions weigh us down. Often they're illusions of security. And I'm sure on some IT admin board they talk about all of those entitled developers and this one time this one developer did something really stupid, ergo all developers are god-complex dummies.
- JamesBarney 7y ago
  Have you worked with doctor's? When I did I'd routinely sit in a room with 10-25 people and wait for hours on a doctor to show up to a meeting they'd schedule onlu to be told by a secretary he was busy. Everyone I know who has worked with doctor's has similar stories. This hasn't happened to me with any other position in any other organization, including vice presidents of Fortune 500 companies.
  - endorphone 7y ago
    I'm not claiming that doctors are interchangeable with other careers. Doctors often have higher priorities that can absolutely intrude at any time: An emergent medical situation is far more important than a meeting about document retention, for instance. For that VP, or CEO for that matter, those meetings are a major priority of their job. Instead I was pointing out that there are many fields where people resist IT-style policies, and many special snowflakes that believe (often rightly) that they are a unique situation. Often in tales like this the worst scenarios arise because some people aren't equipped at managing expectations and communicating reasons and benefits. If yet another vendor comes in with yet another system and yet another set of demands and obligations, to someone who sees it as a hindrance to their work product there will be resistance. Understanding and communicating in a way that, to use lame corporate speak, aligns goals makes things go much smoother.

prostheticvamp 7y ago

People are constantly targeting every aspect of the physician workflow, from CMS and private payors constantly changing their documentation requirements (which differ between payors and CMS, and results in hospitals trying to teach their docs to document everything to meet everyone's requirements - which are made intentionally lengthy and obtuse so as to justify denials of payment), quality improvement people and vendors populating the EMR with shit-tons of Alerts! meant to prevent medical errors (but, due to specific medical contexts justifying deviations from the textbook standard, the false positives vastly outweigh true positives, to the point where the alerts as a whole are utterly ignored), etc. It's easy to complain doctors resist (this particular workflow change), which is SO important because it affects PATIENT LIVES (because it's in the healthcare setting, so EVERYTHING DOES) damn entitled doctors. Then recall that every single time a doctor asks a nurse to do something that nurse will say "oh, just enter a communication order." And because your security set up your RFID to only work on a computer where you've already logged in earlier, and you're running around the hospital constantly, those badges aren't worth shit >half the time. It's easy to complain about doctors' resistance to various evolutions of their digital workflow, until you realize that nearly every evolution adds complexity and time-burden to their workload in a way that does not directly improve patient care, but slows down their work, increases complexity (which does adversely impact patient care), and lengthens their workday (because their patient workload isn't reduced in the slightest by this.) I don't know a single doc that doesn't do significant unpaid after-hours work catching up to their digital bullshit; you also would resist non-mission-critical additions to your unpaid workload. It's easy to treat physicians as entitled and resisting "just to resist", rather than understanding that the physician workflow is constantly changing, from every possible angle, and most often for reasons wildly unrelated to the immediate task of "taking care of the patient in front of me". You'd resist under those circumstances, too. There's a reason about half of physicians nationwide (https://www.medscape.com/slideshow/2019-lifestyle-burnout-depression-6011056#1 https://www.medscape.com/slideshow/2019-lifestyle-burnout-de...) are burned out. HALF. That's what happens when your ability to do your job is constantly fucked with. Perhaps you should consider what that means, and how that relates to what you're saying, rather than asserting doctors are just too damn self-important to change.

Scoundreller 7y ago

Gatsky 7y ago

It goes both ways. I keep telling the IT people at my hospital to stop using SMS 2-factor and they blow me off and treat me like an idiot. Anyway, ‘Doctors’ are a pretty diverse bunch, and most of them aren’t arrogant porn-fiends.

dvtrn 7y ago
From experience, users who come to IT and simply demand we do something because 'reasons' usually aren't prioritized for follow up. Managers who come to IT and demand we do something and show us how it affects their work/department and perhaps the rest of the business and offer to be part of the solution making process often get first class attention. Could it be IT is blowing you off because of how you're delivering your complaint about SMS 2FA without regard for their existing workload? They likely have more than enough on their plates as it is to simply do something because someone from a department said something about it, and IT doesn't exactly pivot on lithium battery, especially in hospitals. That doesn't mean they don't care about your issue or request, but like every other department they have objectives and goals that were likely set well before your 2FA conversation even began.
- Gatsky 7y ago
  You realise what you just did there right, without a hint of irony?
txcwpalpha 7y ago
I hear you and I’m sure it’s frustrating, but I’d be curious to know if the security team has any reasons for sticking with SMS 2FA. I’d be willing to bet money that the reason they blow you off is because it’s a sore spot for them. They probably have tried to implement other MFA methods but were reprimanded by the medical staff because anything other than SMS is too complicated (I’m harping on doctors a lot, but I legitimately do cringe at the thought of even asking a typical MD to download an MFA app or carry around a physical token).
- Gatsky 7y ago

fencepost 7y ago

This is why in starting up my own little IT services company I'm planning on not serving medical clients. "HIPAA? I'm sure we're just fine, and no you can't take away my Windows 7 PCs."

Scoundreller 7y ago
I get the feeling big law is just as bad.
- indyz 7y ago
  I never worked for big law, but medium law is terrible. Partners can just order the IT department to do anything. We had a new head of IT that tried to implement some common sense changes for an organization that handles sensitive data. Basic stuff: Block websites that tend to be malware vectors, don't let users be admins on their own machines, restrict USB storage to certain users, etc. We were forced to override it on the partners machines almost immediately.
  - wolco 7y ago
    Restricting partners usb access? Restricting websites and restricting install permissions. Overkill and probably the opposite of what they envision an IT department doing.
- heartbreak 7y ago
  In my experience with biglaw (a single top 10 firm), their IT and in particular information security was top notch. Having a lot of available capital to work with probably helps.
  - whitepoplar 7y ago
    Which firm?

pmarreck 7y ago

I am horrified... at how plausible this sounds. Like many IT people, I google the heck out of a medical condition when I see doctors. Once I must have asked enough pertinent pointed questions that the doctor asked with a mix of sincerity AND condescension, “have you ever worked in a medical field?” No but like any curious individual I utilize the systems accumulating all human knowledge at our fingertips to inform myself... Doesn’t mean I can’t ultimately rely on your professional judgment, Sir

Consultant32452 7y ago
99% of the time doctors are annoyed by anyone who has researched and informed themselves on what their medical problems might be. The notable exception is when the doctor has repeatedly failed to accurately determine what's wrong. Then you're "allowed" to bring up your own ideas. I can't wait until the majority of work done by doctors is replaced with a small shell script. They will fight VERY hard to stop that from happening, and they're rich. So it will be a tough fight.

sizzle 7y ago

"An attacker then used those credentials to breach the network and siphoned several hundred thousand dollars from the financial system (wiring money to himself)." You're telling me the CEO was unfazed when they learned this was the reason you were locking down the system due to the doctor's own ineptitude and breaking company policy looking at porn and exposing them to direct financial loss and liability (lawsuits from PII data being breached and exfiltrated, etc)? The doctor put the whole hospital at risk and could have cost them millions and got that cryptolocker attack holding their data hostage indefinitely. The CEO should be thanking you guys for catching these huge security ($$$) breaches.

txcwpalpha 7y ago
I wouldn't say unfazed, but as I recall the reaction was more that the doctor wasn't to be blamed and that it was security's fault for not only "allowing" the breach to happen, but also for inconveniencing the doctor. At the organizations I worked with, doctors really have carte blanche privilege to get away with anything as long as they claim "it's for a patient". Even the C-suite will bend over backwards for MDs.

ssss11 7y ago

That exact attitude the doctors have is so common in other occupations, I’ve experienced it with lawyers.

bsder 7y ago

> I have never met a group of people more elitist and “too important to be bothered” by security than doctors. In my opinion, they're the only bunch that gets it right. Security should work correctly and not bother me. Period. The fact that it doesn't is laziness on the part of the security vendors. The bigger problem is that if security ever allows a user to make an incorrect security decision, it's probably worse than no security at all.

gambiting 7y ago

On the other hand(and I'm really not trying to excuse this behaviour) some doctors are almost daily in situations where "if I had a little bit more time or did this thing a day earlier maybe the patient would still be alive". If you run into those kinds of situations frequently, then obviously any slowdown(like having to remember or type in a password) is obviously stupid. And only they understand it, no IT employee ever would.

jacquesm 7y ago
That is why plenty of medical systems have an override in place for emergency situations allowing you to bypass all but the most basic authentication and segmentation. You will usually need to explain your override afterwards.
- gambiting 7y ago
  I'm not talking about emergencies - I'm talking about situations where someone comes in for a "routine" blood test, but it shows they have cancer, and you as a doctor end up blaming yourself for not spending 10 minutes more to look at the test the day before, and the most obvious thing to blame for not having those 10 extra minutes is anything in IT that slows you down and takes those 10 minutes away. Even if it's irrational(maybe that person would have died even if you did look at the test slightly earlier) the guilt can be very real.
  - spinningslate 7y ago
    This. I don't know enough about the econo-political situation gp mentions, but the idea that doctors are somehow irresponsible for not wanting to enter passwords is a perfect example of a usability fail. It's too easy to gloss over - "it's only a password". But think of your own situation: ever been a bit frustrated when your desktop/laptop times out and locks, just as you were about to start typing again? Objectively it takes seconds to enter your password again. Subjectively it's broken your flow. Convenience has a non-linear decay curve. Now take that out of your work environment, where your normal context is sitting/standing at a desk. And put it in a hospital where a doctor is mobile by default: on their rounds/attending to patients/whatever. The answer isn't "make the doctors change and accept the inconvenience". The answer is "find a solution that actually helps them rather than hindering". Yes, there will always be recalcitrant users who stubbornly refuse to use systems irrespective of usability and/or utility. But I'd wager most aren't in this category. Most will be only too ready to use something that actually helps them. If passwords are a barrier to use, find a better solution.

usr1987 7y ago

Most business and schools are the same. Ignorance and self importance prevails over common sense!

matz1 7y ago

Its the IT job to provide security without having to inconvenience the user. you can't just add extra layer of inconvenience for the sake of security. Your ultimate goal should be to provide security without adding additional inconvenience to the user or without having the user to notice it at all.

tagreene92 7y ago
Just curious, are you joking, or are you serious?
- matz1 7y ago
  Serious
vageli 7y ago
> Its the IT job to provide security without having to inconvenience the user. you can't just add extra layer of inconvenience for the sake of security. Your ultimate goal should be to provide security without adding additional inconvenience to the user or without having the user to notice it at all. We trade convenience for security every single day. Ever get locked out of your house because you forgot your keys? Why is that level of inconvenience (requiring keys on doors) okay but it's up to a security team to only implement security solutions which are frictionless and require zero change to workflows? Further, if we require keys on our doors, why wouldn't we require similar measures on software systems? If they are inconvenient, they are inconvenient compared to what? No security?
- matz1 7y ago
  >We trade convenience for security every single day Which is totally sucks. >Ever get locked out of your house because you forgot your keys? Why is that level of inconvenience (requiring keys on doors) okay I would not say that is okay, that is sucks too

Gatsky 7y ago

Putting obviously unprofessional behaviour aside, there are good reasons why they have this attitude, although it is disappointing. First of all, as we all know, passwords are actually not a good solution to the problem of authentication. So we are asking people to participate in a system which we don't think is great and has serious usability issues for the non-technical. I know this isn't what doctors are actually thinking explicitly, but the point still needs to be made. Secondly, doctors are busy and have unpredictable workloads. They also have limited ability to delegate or ask for help if they are oversubscribed. This means if you add 10 minutes to their day, it will actually extend their working day by 10 minutes, and the things they have to do may take them until 10pm at night or worse (I semi-regularly finish documenting things after midnight, and I am not working night shift). They are understandably allergic to things which seem to increase the amount of stuff they have to do. Unfortunately, if you are a small IT vendor trying to introduce a service or a product to a large hospital (the bigger it is, the bigger the problem), you are going to have a difficult time. This is just the reality, which we can complain about, but there it is. There are strategies which can improve uptake and reduce resistance, but they only really work for large well-resourced vendors who are doing large projects: 1. Get the hospital to create a role for a doctor to be the clinical lead of whatever IT infrastructure you are trying to implement. 2. Bundle a large number of changes together, including obviously beneficial ones which save time (like an integrated EMR or paperless ordering) with important ones (like proper auth). 3. Make sure the institution has a lot of skin in the game, usually due to a large financial investment, or meeting some performance indicator, or keeping up with another competing institution. 4. Get the institution to reduce the workload when new systems are being implemented. This might sound obvious, but it makes a difference if you give doctors a bit of breathing room to adapt to a new service. 5. Publish some metric of how well each group of doctors is using a service in an email each week that gets sent to everyone. 6. Constantly remind everyone of why things are better after something has been implemented. I get hospital wide emails all the time about bake sales and other useless stuff, nobody sends emails celebrating or outlining why a recent change in IT infrastructure is making a positive difference. The only IT emails that get sent are when something is broken. Not surprisingly, this makes everyone sceptical of any new IT system. 7. Avoid direct face to face contact between doctors and the IT vendors. Doctors don't want to talk to the IT people, and IT people don't want to talk to the doctors. It just isn't useful, and everyone leaves feeling unsatisfied. Disconnect the technical expertise from people that don't understand why it matters. Find some other way to interact, through support staff, clinical leads etc. This stuff is part of the moat which large EMR providers have, they can actually do this stuff. I have seen it at play with Epic, whatever you think about the software, they have worked out some of the sociological aspects, and they understand that once the EMR is delivered, the process doesn't end.

nine_k 7y ago

> patient safety is more important than security Ultimately these are linked; imagine ransomware blocking a medical device necessary to save lives, or tampering with settings of an x-ray machine.

neuro_image3 7y ago

Physician here (neuroradiologist) and after working at several hospitals in the US and abroad, let me be really clear about this: 1) I have never seen a health care organization ANYWHERE where the physicians determine the IT policy (including and especially the IT security policy). 2) Universally, healthcare organizations use the bloated garbage that gets passed off as EMRs and affiliated garbage software. None of this is up to physicians. It's up to the administrative and bureaucratic parasites that have infested healthcare at every level and based largely (I assume) on crony relationships, because it's certainly not based on competence. 3)Healthcare IT is the most abysmal software anyone anywhere has ever devised to perform any task. Systems like EPIC are bloated, barely functional trash that systems have wasted billions of dollars on. The various components of departmental IT do not co-ordinate with one another, crash on a daily basis, are not fit for purpose and would embarrass engineers in any other industry. It comes as no surprise that security for these systems is piss-poor, just like everything else about these systems. Blaming doctors for this administrative mess, whilst not unexpected, is disingenuous at best (of course this is what healthcare administration excel at - making a mess and blaming physicians).

neuro_image3 7y ago

The example you site is so egregious (and unlikely) that there isn't a hospital in the US today where a physician who did anything remotely close to what you describe wouldn't immediately be fired (appropriately I might add). The bigger issue is how did the vendor or IT department responsible for the network allow routine internet access to interface with critical healthcare or financial infrastructure? (You don't have to be looking at porn to be on the wrong side of a phishing scam). Clearly you've had bad experiences with (some) doctors - generalizing that experience and extrapolating it to the issue of IT security is deeply flawed reasoning.