4 ms·

> The hospital couldn’t accept emergency patients because of the attack Yes they could.

by bzb5 6y ago

unionpivo 6y ago
I work at a firm that does a lot of contracting in medical field including hospitals. We are currently working with some equipment in radiology. Devices need to be connected to network, so that they can display data on proprietary viewing device connected to the network. Some devices (and viewers) are using old versions of windows (win2000 and linux, still see RH4 ) as a base. You don't have control/access over the windows machines only vendors do, and a lot of them are obsolete versions. Windos 2k is still common. Network dies (or is inaccessible) for any reason, and device is unusable, because you cant control it or see the results. I spoke to their systems guys, they are aware of risk, but their hands are often tied.
- croon 6y ago
  That practice should be illegal. It's a form of ransomware in itself, as well as negligence in not updating it. Either have it old and offline, or connected and updated. Preferably offline and updated though. Forcing an online "subscription" and not keeping up their end of the bargain infuriates me.
  - srtjstjsj 6y ago
    They do the subscription+lockdown so that the liability is clear if the system malfunctions... hmm...
INTPenis 6y ago
Yeah I'm a bit skeptical to this. What exactly about a computer system prevents them from admitting a person? Just pick up a piece of paper and write down whatever you'd write down later in the computer once it's back up. It's not that hard. I could understand if a particular machine that goes ping couldn't be used because of the computer system being down. But that's a very specific issue.
- StreamBright 6y ago
  Have you worked in an ICU a lot?
  - INTPenis 6y ago
    No but one of my clients is a major health care provider with over 35000 employees. I don't manage their MT systems but I know about them and I hear about them from co-workers. And just going on common sense I don't see how a computer could prevent a hospital from admitting a patient. We're talking about admission, not any special treatment. So it's an honest question to the community, not trying to be dogmatic here. I'm honestly asking, what in a computer system could prevent a patient from being admitted for care? As far as I can reason, no drugs are being held hostage by a computer. Doctors can still use their training without a computer. Humans have been treating ailments for thousands of years without the aide of computers. It would be really sad if this woman died because hospital staff felt hopeless without computers. Edit: Going beyond just the human dependence on computers, it would be a good exercise in society readiness to be able to treat patients during a blackout for example.
    - unionpivo 6y ago
      Its not that they cant be admitted for care, its that they can't provide care, if devices that they need to provide the care don't work. A lot of devices in hospitals work on vendor provided machines that are not up to date. If anything happens on either end, you can't use device. I am talking about CT, MRI, endoscopy, and other devices. If you have integrated single sign on with access cards, and AD dies, you can't login, and if you can't login you cant use the device. The reason I am pointing AD out, is because I am working in integrating such device in our software as we speak. more here: https://news.ycombinator.com/item?id=24514441 https://news.ycombinator.com/item?id=24514441
    - afarrell 6y ago
      > just going on common sense I don't see how a computer could prevent a hospital from admitting a patient. Common sense is knowledge gained by experience. Thats' why kids "don't have any". > I'm honestly asking, what in a computer system could prevent a patient from being admitted for care? This is a good question for us to have more detailed understanding of.
capableweb 6y ago
I understand your point, just because they are not internet connected doesn't mean they can't just treat people anyways ("just write down their name on paper for now"). I think the issue here is not bureaucracy around if they can on paper accept patients or not, I think it's more about that a lot of the equipment is connected to the internet (let's for now ignore the question if it should/should not be connected to the internet, as the answer is obvious) and if hit by the ransomware attack, it might not be able to be used. So while they could take in the patient, a lot of the equipment wouldn't work. So it's better to reject the patient and send them to a facility where they could be treated properly, instead of dealing with faulty equipment.
- srtjstjsj 6y ago
  The equipment isn't online. The EMR and logistics systems are.
foolmeonce 6y ago
Digital patient data creates an interesting ethics problem. A patient could have information like a deadly allergy risk on their record, which maybe you can't read, but 999 other patients are going to benefit from the same care.
- moring 6y ago
  Is this really a novel problem? Most treatmments have some risk associated with them, and a 1/1000 chance seems acceptable if the alternative is death or serious health consequences. I think if the story went like "we treated the patient immediately, but she had a rare allergy which we couldn't look up in time because a ransomware attack took our network down", it would be much more of an everyday story.
  - foolmeonce 6y ago
    It's not novel that hospitals make these choices and review them. It's novel that one of a thousand ransom attacks on hospitals has resulted in the murder threat that makes a ransom attack on a hospital work better than on a hotel or school. We want medical data because not having it might play a role in our death. Assuming the hospital must have had a better triage response is like assuming authorities should have taken some murder threat seriously and stopped it. Maybe.. depends on frequency and other outcomes and doesn't really absolve the murderer either way.
- moviuro 6y ago
  Was the patient alone? Do their companions know of such things? Why doesn't the hospital have a special laptop with only 3/4G connectivity and a card reader for this purpose? BTW, use the emergency info of your phone: https://www.androidcentral.com/how-add-emergency-information-your-android-phone; https://www.androidcentral.com/how-add-emergency-information... https://support.apple.com/en-us/HT207021 https://support.apple.com/en-us/HT207021
StreamBright 6y ago
And how can you claim that?

> The hospital couldn’t accept emergency patients because of the attack Yes they could.

by bzb5 6y ago

> The hospital couldn’t accept emergency patients because of the attack Yes they could.

I work at a firm that does a lot of contracting in medical field including hospitals. We are currently working with some equipment in radiology. Devices need to be connected to network, so that they can display data on proprietary viewing device connected to the network. Some devices (and viewers) are using old versions of windows (win2000 and linux, still see RH4 ) as a base. You don't have control/access over the windows machines only vendors do, and a lot of them are obsolete versions. Windos 2k is still common. Network dies (or is inaccessible) for any reason, and device is unusable, because you cant control it or see the results. I spoke to their systems guys, they are aware of risk, but their hands are often tied.

croon 6y ago
That practice should be illegal. It's a form of ransomware in itself, as well as negligence in not updating it. Either have it old and offline, or connected and updated. Preferably offline and updated though. Forcing an online "subscription" and not keeping up their end of the bargain infuriates me.
- srtjstjsj 6y ago
  They do the subscription+lockdown so that the liability is clear if the system malfunctions... hmm...

INTPenis 6y ago

Yeah I'm a bit skeptical to this. What exactly about a computer system prevents them from admitting a person? Just pick up a piece of paper and write down whatever you'd write down later in the computer once it's back up. It's not that hard. I could understand if a particular machine that goes ping couldn't be used because of the computer system being down. But that's a very specific issue.

StreamBright 6y ago
Have you worked in an ICU a lot?
- INTPenis 6y ago
  No but one of my clients is a major health care provider with over 35000 employees. I don't manage their MT systems but I know about them and I hear about them from co-workers. And just going on common sense I don't see how a computer could prevent a hospital from admitting a patient. We're talking about admission, not any special treatment. So it's an honest question to the community, not trying to be dogmatic here. I'm honestly asking, what in a computer system could prevent a patient from being admitted for care? As far as I can reason, no drugs are being held hostage by a computer. Doctors can still use their training without a computer. Humans have been treating ailments for thousands of years without the aide of computers. It would be really sad if this woman died because hospital staff felt hopeless without computers. Edit: Going beyond just the human dependence on computers, it would be a good exercise in society readiness to be able to treat patients during a blackout for example.
  - unionpivo 6y ago
    Its not that they cant be admitted for care, its that they can't provide care, if devices that they need to provide the care don't work. A lot of devices in hospitals work on vendor provided machines that are not up to date. If anything happens on either end, you can't use device. I am talking about CT, MRI, endoscopy, and other devices. If you have integrated single sign on with access cards, and AD dies, you can't login, and if you can't login you cant use the device. The reason I am pointing AD out, is because I am working in integrating such device in our software as we speak. more here: https://news.ycombinator.com/item?id=24514441 https://news.ycombinator.com/item?id=24514441
  - afarrell 6y ago
    > just going on common sense I don't see how a computer could prevent a hospital from admitting a patient. Common sense is knowledge gained by experience. Thats' why kids "don't have any". > I'm honestly asking, what in a computer system could prevent a patient from being admitted for care? This is a good question for us to have more detailed understanding of.

capableweb 6y ago

I understand your point, just because they are not internet connected doesn't mean they can't just treat people anyways ("just write down their name on paper for now"). I think the issue here is not bureaucracy around if they can on paper accept patients or not, I think it's more about that a lot of the equipment is connected to the internet (let's for now ignore the question if it should/should not be connected to the internet, as the answer is obvious) and if hit by the ransomware attack, it might not be able to be used. So while they could take in the patient, a lot of the equipment wouldn't work. So it's better to reject the patient and send them to a facility where they could be treated properly, instead of dealing with faulty equipment.

srtjstjsj 6y ago
The equipment isn't online. The EMR and logistics systems are.

foolmeonce 6y ago

Digital patient data creates an interesting ethics problem. A patient could have information like a deadly allergy risk on their record, which maybe you can't read, but 999 other patients are going to benefit from the same care.

moring 6y ago
Is this really a novel problem? Most treatmments have some risk associated with them, and a 1/1000 chance seems acceptable if the alternative is death or serious health consequences. I think if the story went like "we treated the patient immediately, but she had a rare allergy which we couldn't look up in time because a ransomware attack took our network down", it would be much more of an everyday story.
- foolmeonce 6y ago
  It's not novel that hospitals make these choices and review them. It's novel that one of a thousand ransom attacks on hospitals has resulted in the murder threat that makes a ransom attack on a hospital work better than on a hotel or school. We want medical data because not having it might play a role in our death. Assuming the hospital must have had a better triage response is like assuming authorities should have taken some murder threat seriously and stopped it. Maybe.. depends on frequency and other outcomes and doesn't really absolve the murderer either way.
moviuro 6y ago
Was the patient alone? Do their companions know of such things? Why doesn't the hospital have a special laptop with only 3/4G connectivity and a card reader for this purpose? BTW, use the emergency info of your phone: https://www.androidcentral.com/how-add-emergency-information-your-android-phone; https://www.androidcentral.com/how-add-emergency-information... https://support.apple.com/en-us/HT207021 https://support.apple.com/en-us/HT207021

StreamBright 6y ago

And how can you claim that?