5 ms·

I have a portal account that my (autofilled!) password wasn't working for. I contacted the doctor's office, and they sent me back the plaintext password. That

by sfink 5y ago

I have a portal account that my (autofilled!) password wasn't working for. I contacted the doctor's office, and they sent me back the plaintext password. That's when I knew.

primitivesuave 5y ago
This is the perfect anecdote. Either you get lucky with a healthcare provider that has signed a BAA with a company where someone happens to know how to use bcrypt for passwords, or you don't - there is really no way to know until you send that password reset email.
perl4ever 5y ago
I logged on to a medical practice's portal and was able to access all of the provider's notes from my visits. I didn't read them or investigate to see whether it was just my own that were available, but I'm pretty sure it was a mistake in setting permissions. Some time later the whole portal disappeared, except for a bill pay page. Also the provider suddenly quit with no warning; I don't recall the sequencing. Nobody ever sent me a letter fessing up to anything.
- JshWright 5y ago
  The provider's notes about your visit are part of your medical record, and something that would be very reasonable for you to see (in most cases they are legally required to provide access to your compete record). What would they need to "fess up" about?
  - perl4ever 5y ago
    >in most cases they are legally required to provide access to your complete record Yes, I'm aware and I have requested my records in the past. I can even spell HIPAA, unlike a lot of people. This is irrelevant to my anecdote about the screwed up portal, since I would be aware and have mentioned it if I made such a request, which I did not. >What would they need to "fess up" about? Like I said, I didn't investigate to find out the full story, because we all know what happens if you "hack" a broken system.
    - notwedtm 5y ago
      Yeah, I don't follow this line either. My doctors portal has my providers notes readily available to me without me asking. Are you sure you aren't just expecting to have to request it, and are being surprised by the fact that you don't?
      - perl4ever 5y ago
        Yes, I am. I have a primary care doctor whose portal has the sort of thing you're referring to. That's different.
        JshWright 5y ago
        What's the difference between these two portals that means sharing your records with you is good in one case and bad in the other?
    - JshWright 5y ago
      But they were _your_ records. Are you saying they should only be available to you upon request? I'm not following you to the conclusion that it must be broken because it gave you access to your own records.
      - perl4ever 5y ago
        >Are you saying they should only be available to you upon request? No.
        JshWright 5y ago
        Then I'm not following what you think was wrong here...
bashonly 5y ago
i used to work in health care, and the website for a certain medical board stores all of its licensees' passwords in plaintext. i am no longer licensed with that board, but i can't remove any of my data. a breach seems inevitable.

by sfink 5y ago

I have a portal account that my (autofilled!) password wasn't working for. I contacted the doctor's office, and they sent me back the plaintext password. That's when I knew.

primitivesuave 5y ago

This is the perfect anecdote. Either you get lucky with a healthcare provider that has signed a BAA with a company where someone happens to know how to use bcrypt for passwords, or you don't - there is really no way to know until you send that password reset email.

perl4ever 5y ago

I logged on to a medical practice's portal and was able to access all of the provider's notes from my visits. I didn't read them or investigate to see whether it was just my own that were available, but I'm pretty sure it was a mistake in setting permissions. Some time later the whole portal disappeared, except for a bill pay page. Also the provider suddenly quit with no warning; I don't recall the sequencing. Nobody ever sent me a letter fessing up to anything.

JshWright 5y ago
The provider's notes about your visit are part of your medical record, and something that would be very reasonable for you to see (in most cases they are legally required to provide access to your compete record). What would they need to "fess up" about?
- perl4ever 5y ago
  >in most cases they are legally required to provide access to your complete record Yes, I'm aware and I have requested my records in the past. I can even spell HIPAA, unlike a lot of people. This is irrelevant to my anecdote about the screwed up portal, since I would be aware and have mentioned it if I made such a request, which I did not. >What would they need to "fess up" about? Like I said, I didn't investigate to find out the full story, because we all know what happens if you "hack" a broken system.
  - notwedtm 5y ago
    Yeah, I don't follow this line either. My doctors portal has my providers notes readily available to me without me asking. Are you sure you aren't just expecting to have to request it, and are being surprised by the fact that you don't?
    - perl4ever 5y ago
      Yes, I am. I have a primary care doctor whose portal has the sort of thing you're referring to. That's different.
      - JshWright 5y ago
        What's the difference between these two portals that means sharing your records with you is good in one case and bad in the other?
  - JshWright 5y ago
    But they were _your_ records. Are you saying they should only be available to you upon request? I'm not following you to the conclusion that it must be broken because it gave you access to your own records.
    - perl4ever 5y ago
      >Are you saying they should only be available to you upon request? No.
      - JshWright 5y ago
        Then I'm not following what you think was wrong here...

bashonly 5y ago

i used to work in health care, and the website for a certain medical board stores all of its licensees' passwords in plaintext. i am no longer licensed with that board, but i can't remove any of my data. a breach seems inevitable.