5 ms·

I just spent some time with someone trying to recruit me back to writing medical software. The entire interview was dominated with HIPAA related questions, whic

I just spent some time with someone trying to recruit me back to writing medical software. The entire interview was dominated with HIPAA related questions, which were mostly the interviewer justifying why the software sucked. And the software in question sucked in every way it could: bad UX, terrible limits on integration, data could not be exported without copy pasta magic, etc... Some of these issues really are dangerous because clinicians have to spend so much time fighting to make things work or doing immense amounts of double and triple data entry. Oh, and every time the justification was because of HIPAA requirements or infosec. It made me realize that we do not know how to make software well enough to regulate it safely, and no, I do not want to go work in a sector where prioirity one is complying with some privacy regulation when the top priority should be accuracy of diagnostic, reliability of a system or eliminating operator error.

maxerickson 6y ago
What's wrong with and? Obviously you can't literally have 4 top priorities, but patient privacy isn't some dumb irrelevancy.
- indymike 6y ago
  When you are making software that is used to make life and death decisions, privacy should not be the top priority.
  - tylerrobinson 6y ago
    I also work on software in the medical industry. Maybe you were talking about the specific firm you were interviewing with, but patient safety (accuracy) is absolutely the highest concern in my team. That doesn’t mean we cut corners on security and privacy, it means that all must be done correctly to be successful.
  - maxerickson 6y ago
    The idea that there is a single "top priority" is the problem. There's inevitably going to be a list of primary criteria, with the specific situation driving how they are balanced.
    - indymike 6y ago
      Man who hunts two rabbits starves.
      - maxerickson 6y ago
        Chases maybe. Putting a snare where two rabbits are active is just as good or better than putting it where one rabbit is active.
cmiles74 6y ago
I've worked in medical software and I want to second indymike on this, because I think it is important. The requirements for security or privacy are used as excuses to make only the smallest and most moderate of improvements to these applications. Year after year the UI stays the same and the product stays the same and the pain points for the customer's employees stays the same (remember that doctors in hospitals have some say but the business-side of the organization buy this software). IMHO, this is one of the big excuses they use to push off interoperability. The lack of interoperability combined with the big vendors controlling the standards (i.e. HL7 or whatever) are freezing smaller vendors who might have dramatically better products out of the market. Mark my words, the big consulting firms will use security compliance as another way to keep smaller and more agile companies (some with dramatically better products) out of the market.

maxerickson 6y ago

What's wrong with and? Obviously you can't literally have 4 top priorities, but patient privacy isn't some dumb irrelevancy.

indymike 6y ago
When you are making software that is used to make life and death decisions, privacy should not be the top priority.
- tylerrobinson 6y ago
  I also work on software in the medical industry. Maybe you were talking about the specific firm you were interviewing with, but patient safety (accuracy) is absolutely the highest concern in my team. That doesn’t mean we cut corners on security and privacy, it means that all must be done correctly to be successful.
- maxerickson 6y ago
  The idea that there is a single "top priority" is the problem. There's inevitably going to be a list of primary criteria, with the specific situation driving how they are balanced.
  - indymike 6y ago
    Man who hunts two rabbits starves.
    - maxerickson 6y ago
      Chases maybe. Putting a snare where two rabbits are active is just as good or better than putting it where one rabbit is active.

cmiles74 6y ago

I've worked in medical software and I want to second indymike on this, because I think it is important. The requirements for security or privacy are used as excuses to make only the smallest and most moderate of improvements to these applications. Year after year the UI stays the same and the product stays the same and the pain points for the customer's employees stays the same (remember that doctors in hospitals have some say but the business-side of the organization buy this software). IMHO, this is one of the big excuses they use to push off interoperability. The lack of interoperability combined with the big vendors controlling the standards (i.e. HL7 or whatever) are freezing smaller vendors who might have dramatically better products out of the market. Mark my words, the big consulting firms will use security compliance as another way to keep smaller and more agile companies (some with dramatically better products) out of the market.