4 ms·
For every disclosed HIPAA violation, there are at least 10x the number of violations that go unnoticed and unreported. When you give data to a hospital or clini
by primitivesuave 5y ago
For every disclosed HIPAA violation, there are at least 10x the number of violations that go unnoticed and unreported. When you give data to a hospital or clinic, it is being shared in unredacted form with third parties that have signed Business Associate Agreements with the healthcare provider. There is no oversight or concrete regulation that comes with a BAA, there is no "HIPAA inspection" similar to an OSHA or FDA surprise inspection, while the ramifications of leaking your health data have become far more consequential (to the point that you might need to pay into the Experian protection racket when it happens).
Source: I work in the industry.
- sfink 5y agoI have a portal account that my (autofilled!) password wasn't working for. I contacted the doctor's office, and they sent me back the plaintext password. That's when I knew.
- primitivesuave 5y agoThis is the perfect anecdote. Either you get lucky with a healthcare provider that has signed a BAA with a company where someone happens to know how to use bcrypt for passwords, or you don't - there is really no way to know until you send that password reset email.
- perl4ever 5y agoI logged on to a medical practice's portal and was able to access all of the provider's notes from my visits. I didn't read them or investigate to see whether it was just my own that were available, but I'm pretty sure it was a mistake in setting permissions. Some time later the whole portal disappeared, except for a bill pay page. Also the provider suddenly quit with no warning; I don't recall the sequencing. Nobody ever sent me a letter fessing up to anything.
- JshWright 5y agoThe provider's notes about your visit are part of your medical record, and something that would be very reasonable for you to see (in most cases they are legally required to provide access to your compete record). What would they need to "fess up" about?
- perl4ever 5y ago>in most cases they are legally required to provide access to your complete record Yes, I'm aware and I have requested my records in the past. I can even spell HIPAA, unlike a lot of people. This is irrelevant to my anecdote about the screwed up portal, since I would be aware and have mentioned it if I made such a request, which I did not. >What would they need to "fess up" about? Like I said, I didn't investigate to find out the full story, because we all know what happens if you "hack" a broken system.
- notwedtm 5y agoYeah, I don't follow this line either. My doctors portal has my providers notes readily available to me without me asking. Are you sure you aren't just expecting to have to request it, and are being surprised by the fact that you don't?
- JshWright 5y agoBut they were _your_ records. Are you saying they should only be available to you upon request? I'm not following you to the conclusion that it must be broken because it gave you access to your own records.
- bashonly 5y agoi used to work in health care, and the website for a certain medical board stores all of its licensees' passwords in plaintext. i am no longer licensed with that board, but i can't remove any of my data. a breach seems inevitable.
- deleted 5y ago[deleted]