4 ms·
"Separately, even if the two scenarios were subject to the same regulations, I would still expect the doctor's office scenario to be more secure. I think that a
by tssva 6y ago
"Separately, even if the two scenarios were subject to the same regulations, I would still expect the doctor's office scenario to be more secure. I think that any given patient's home network/device/security practices are more lax than those of most healthcare organizations."
For the most part security for healthcare systems is like security for government systems. A lot of checkbox marking and little real security. Just look at the large number of successful ransomware attacks against healthcare organizations. Having at one time worked in health informatics and from observing the practices at my healthcare providers I am not confident my data is anymore protected at a doctor's office.
- everly 6y agoYeah that’s fair, I do think organizational ineptitude is a concern. I guess it’s just different threat models. A medical office has locking file cabinets, password-protected devices/networks, more robust building security, the standards of hipaa, etc. (granted all of those are subject to proper implementation) If I needed to get one person’s medical information, I think I’d I have a higher likelihood of getting it from their medicine cabinet or snooping on their devices or search history. If I needed the information of many people, I’d target the doctor. But even then, the goal typically isn’t to leak anyone’s information, it’s to get money from the healthcare provider and the information stays secret, theoretically. Not really disagreeing with you just rambling.