4 ms·

So the breach involved their portal. I HATE those portals. I wish healthcare providers would just send an email, rather than "you have a new message on our po

So the breach involved their portal. I HATE those portals. I wish healthcare providers would just send an email, rather than "you have a new message on our portal". I think (hope?) my email is more secure than these portals..

somethoughts 5y ago
Yes I wish there was a way to opt out and just rely on phone support. At least with phone support the attackers would have to social engineer things at an individual records level versus just being able to brute force huge bulk data records out.
- JshWright 5y ago
  Most doctors offices are effectively overworked and understaffed small businesses. Shifting all that support to the phone would not be reasonable, from a workload perspective.
  - curryst 5y ago
    Just to expand on that, patients aren't the only ones with a legitimate reason to access that data. Insurance companies need copies as well, so they would still want some kind of mass-data portal even if customers don't use it. If you change doctors, they want copies of your old medical records. If you see a specialist, if you go to the hospital, etc, etc. Pharmacies might call and ask if they think there's something weird about a prescription. Direct patient contacts are a vanishingly small percentage of records requests for a doctor. Doctors could likely handle those via phone, but it doesn't solve the issue of needing an EMR.
Skunkleton 5y ago
Technically, your email may have been transmitted in plain text over the open internet. Most email doesn't go through unencrypted connections, but it isn't guaranteed. Email also doesn't do much to establish the authenticity of the sender, at least not as part of its specification.
jonas21 5y ago
As I understand it, HIPAA requires that health information is secured in transit and at rest. This is difficult to do over email, since email is not always encrypted in transit, so the general recommendation is to use a portal instead. There's some additional information here: https://www.securitymetrics.com/static/resources/orange/HIPAA_Compliant_Emails_White_Paper.pdf https://www.securitymetrics.com/static/resources/orange/HIPA...
- tsol 5y ago
  These patient portals are required by law now, for all medical offices large and small. Part of it is also just shifting work into the portal one is required to have anyways Source: have worked in a medical office

somethoughts 5y ago

Yes I wish there was a way to opt out and just rely on phone support. At least with phone support the attackers would have to social engineer things at an individual records level versus just being able to brute force huge bulk data records out.

JshWright 5y ago
Most doctors offices are effectively overworked and understaffed small businesses. Shifting all that support to the phone would not be reasonable, from a workload perspective.
- curryst 5y ago
  Just to expand on that, patients aren't the only ones with a legitimate reason to access that data. Insurance companies need copies as well, so they would still want some kind of mass-data portal even if customers don't use it. If you change doctors, they want copies of your old medical records. If you see a specialist, if you go to the hospital, etc, etc. Pharmacies might call and ask if they think there's something weird about a prescription. Direct patient contacts are a vanishingly small percentage of records requests for a doctor. Doctors could likely handle those via phone, but it doesn't solve the issue of needing an EMR.

Skunkleton 5y ago

Technically, your email may have been transmitted in plain text over the open internet. Most email doesn't go through unencrypted connections, but it isn't guaranteed. Email also doesn't do much to establish the authenticity of the sender, at least not as part of its specification.

jonas21 5y ago

As I understand it, HIPAA requires that health information is secured in transit and at rest. This is difficult to do over email, since email is not always encrypted in transit, so the general recommendation is to use a portal instead. There's some additional information here: https://www.securitymetrics.com/static/resources/orange/HIPAA_Compliant_Emails_White_Paper.pdf https://www.securitymetrics.com/static/resources/orange/HIPA...

tsol 5y ago
These patient portals are required by law now, for all medical offices large and small. Part of it is also just shifting work into the portal one is required to have anyways Source: have worked in a medical office