3 ms·

I'm not surprised. I'm a security consultant in France, and hospitals are amongst the most insecure organizations we work with (along with big industrials that

I'm not surprised. I'm a security consultant in France, and hospitals are amongst the most insecure organizations we work with (along with big industrials that don't need much IT). Low/no budget, insane requirements (very high availability, low/no barrier to access records, while abiding by GDPR), obsolete machines that just work(TM). However, that "can't accept emergency patients" is surprising. I don't care if the lights are out or if I can't digitally sign their papers: hospitals should be able to run even with no machines at all. Ideas for next time: - Paper docs available (already printed) in case everything goes under (banks do that for example, for generic papers, like opening an account, etc.) - Air-gapped backup machines that can be used on the MRI/scanner/ultrasound/whatever machine (that hardware hardly ever changes, so it's not like those air-gapped machines would be a pain to manage) - Backup 4G-enabled laptop that can read the vitim's Carte Vitale (or equivalent [0]) (and which doesn't connect to the hospitals network whatsoever) - Backup hardware (Scanner, Ultrasound machine) in case someone actually fries the regular ones thanks to their horrible security (we've had plenty of such articles on HN) - Read-only machines. Once it works, unless it's for a patch, the OS and applications shoudln't be changed, at all. - User awareness training. Ransomware rarely happens by accident: someone clicked a bad document in a phishing mail. (Unless, you know, Wannacry, but that's not the norm) [0] https://en.wikipedia.org/wiki/Carte_Vitale https://en.wikipedia.org/wiki/Carte_Vitale

gommm 6y ago
I also don't understand this, my father died last month because of the same reason. He had an aortic dissection and in those cases time is critical (especially given that he was under anti coagulant). But they took 12 hours before they finally started treating him and claim a computer failure is the reason for that. By the time they started treating him, it was too late. I don't understand the sheer incompetence involved. He had his prescriptions with him, he was lucid enough in the first 10 hours (my mother couldn't be in the emergency with him due to covid regulation but he communicated with her by phone) to explain his medical history. They had all the elements to actually do something but they didn't because "our computer systems were not working" Hospitals should be able to run without computer systems and the budget for maintaining those same systems should be high enough to ensure things work. I can't fathom that it's not the case and I would never have expected something like this to happen. It's hard dealing both with the death of a close family member and the anger at the incompetence displayed by the French hospital system.
- zimpenfish 6y ago
  > Hospitals should be able to run without computer systems I suspect that they can -but- they're probably concerned about legal issues - if everything isn't logged in or authorised by the system and something goes wrong, someone (and I by no means mean to imply you here!) at some point will launch a legal claim over that mistake. [Edit: Which is also not mean to defend the hospitals for taking this position - I think it's daft but I can understand there may be reasons for it.]
  - gommm 6y ago
    Well in this case, they only told us about the computer issue as a justification after the fact, they never told my father when he was in the emergency. If my father had been redirected to another hospital instead of being left there to wait for hours until his situation became critical, I would have been happier with them..
  - userbinator 6y ago
    I suspect that they can -but- they're probably concerned about legal issues Then the law should have a "best effort" provision. I believe aviation regulations have a similar thing, where the pilot doing anything possible in a best-effort attempt to survive or minimise casualties, including violating other regulations, is itself explicitly permitted.
    - zimpenfish 6y ago
      > Then the law should have a "best effort" provision. Yep, I'd probably agree with that.
  - srtjstjsj 6y ago
    OK but killing a patient by refusing treatment is also a legal risk.
    - zimpenfish 6y ago
      > OK but killing a patient by refusing treatment is also a legal risk. Sure but I think a lot of people would not see "we're not sure it's safe to do the surgery, let's wait" as "killing a patient" especially when you're probably going to find it hard to find anyone who'll say it was safe to do at the time.
fefe23 6y ago
Your perspective is all wrong. It's a hospital attached to a university. They were already operating at a loss before Covid made things worse. If they find 1 million bucks on the street, the first priority will be to fund repairs for essential medical equipment, basic hygiene, make sure the broken toilet is being repaired, fix the elevator, etc pp. If they found enough money eventually it would go to a sensible IT infrastructure, but these people don't view themselves as IT administrators. They view themselves as doctors trying to save lives, not computers. It takes an event like this to drive home the point that these have become the same thing. You can't be a doctor without also caring for your IT infrastructure. To you that may sound obvious, but consider the other way around. You can't be an IT guy without caring for your own health. Equally obvious, right? Now look around you how many unhealthy IT guys you can see who always prioritize their computer time over going out and doing some sports.

gommm 6y ago

I also don't understand this, my father died last month because of the same reason. He had an aortic dissection and in those cases time is critical (especially given that he was under anti coagulant). But they took 12 hours before they finally started treating him and claim a computer failure is the reason for that. By the time they started treating him, it was too late. I don't understand the sheer incompetence involved. He had his prescriptions with him, he was lucid enough in the first 10 hours (my mother couldn't be in the emergency with him due to covid regulation but he communicated with her by phone) to explain his medical history. They had all the elements to actually do something but they didn't because "our computer systems were not working" Hospitals should be able to run without computer systems and the budget for maintaining those same systems should be high enough to ensure things work. I can't fathom that it's not the case and I would never have expected something like this to happen. It's hard dealing both with the death of a close family member and the anger at the incompetence displayed by the French hospital system.

zimpenfish 6y ago
> Hospitals should be able to run without computer systems I suspect that they can -but- they're probably concerned about legal issues - if everything isn't logged in or authorised by the system and something goes wrong, someone (and I by no means mean to imply you here!) at some point will launch a legal claim over that mistake. [Edit: Which is also not mean to defend the hospitals for taking this position - I think it's daft but I can understand there may be reasons for it.]
- gommm 6y ago
  Well in this case, they only told us about the computer issue as a justification after the fact, they never told my father when he was in the emergency. If my father had been redirected to another hospital instead of being left there to wait for hours until his situation became critical, I would have been happier with them..
- userbinator 6y ago
  I suspect that they can -but- they're probably concerned about legal issues Then the law should have a "best effort" provision. I believe aviation regulations have a similar thing, where the pilot doing anything possible in a best-effort attempt to survive or minimise casualties, including violating other regulations, is itself explicitly permitted.
  - zimpenfish 6y ago
    > Then the law should have a "best effort" provision. Yep, I'd probably agree with that.
- srtjstjsj 6y ago
  OK but killing a patient by refusing treatment is also a legal risk.
  - zimpenfish 6y ago
    > OK but killing a patient by refusing treatment is also a legal risk. Sure but I think a lot of people would not see "we're not sure it's safe to do the surgery, let's wait" as "killing a patient" especially when you're probably going to find it hard to find anyone who'll say it was safe to do at the time.

fefe23 6y ago

Your perspective is all wrong. It's a hospital attached to a university. They were already operating at a loss before Covid made things worse. If they find 1 million bucks on the street, the first priority will be to fund repairs for essential medical equipment, basic hygiene, make sure the broken toilet is being repaired, fix the elevator, etc pp. If they found enough money eventually it would go to a sensible IT infrastructure, but these people don't view themselves as IT administrators. They view themselves as doctors trying to save lives, not computers. It takes an event like this to drive home the point that these have become the same thing. You can't be a doctor without also caring for your IT infrastructure. To you that may sound obvious, but consider the other way around. You can't be an IT guy without caring for your own health. Equally obvious, right? Now look around you how many unhealthy IT guys you can see who always prioritize their computer time over going out and doing some sports.