3 ms·

Nurses told to BYOD after IT lay off

37 points by technion 4y ago

mc4ndr3 4y ago
That's a recipe for all manner of cybersecurity issues.
1970-01-01 4y ago
Only way to not get HIPPA involved is to shutdown all computers and move everything to paperwork
- KerrAvon 4y ago
  It’s genuinely stunning that we’ve found — on the internet — a scenario of actual potential HIPPA violations (as opposed to scenarios made up by mentally ill politicians to avoid answering questions, and ceaselessly parroted by their followers). But, yes, the time has come. Amazing.
  - zamadatix 4y ago
    HIPAA (not HIPPA) violations are common. Not all mandatory reports get made and even then ~2 of the largest >=500 class violations are reported each day totaling hundreds of millions of records per year. I spent ~10 years in healthcare IT infrastructure (mostly server and network) at various places. Even the well funded ones with competent management and established IT have occasional breaches. And a lot of healthcare places don't have either of those things.
hedora 4y ago
Correct response: Anonymously name + shame the hospital. Alternatively, whistle blower, or union time.
- toomuchtodo 4y ago
  https://www.hhs.gov/hipaa/filing-a-complaint/index.html https://www.hhs.gov/hipaa/filing-a-complaint/index.html
vmurthy 4y ago
The original post should go to /r/whatcouldgowrong :-( How is this anywhere close to legal? (Not the layoff but the BYOD policy for accessing sensitive patient data) .
gjsman-1000 4y ago
If you are an attacker, all that is necessary is to compromise one device. Super easy by comparison to a locked-down corporate device, and you are off to the races. All a vengeful IT staff member has to do is name and shame the hospital. It would be a sign screaming "attack me." It would probably be as easy as leaving some flash drives in the parking lot.
exabrial 4y ago
> told to... ...Download Cerner... This line is telling. I can assure all readers this is another reddit hoax. First, one does not simply "Download Cerner". This is software built in essentially visual basic, and requires an incredible amount of tinkering with Windows to run. Oh and it's "rewritten" at least 12 times before abandoned, but somebody sold it to a customer anyway. Most hospitals "run" Cerner software via Citrix because of it's immense sensitivity and finickiness. Simple renaming a folder on your desktop can break the software (if you think I'm joking, I'm not). So yeah, if you actually managed to get the software 'installed' you probably deserve a Turing award. It's not like you can download an MSI and bam, cerner. You're going to be copying files, hex editing, reg-editing, installing/removing hundreds of windows fixpacks, and reformatting frequently when you screw it up. Next, Cerner software is built in thousands of [ironically named] "solutions", all decided by the LPOW (loudest persons opinion wins) or HIPPO (highest paid persons opinion wins). A bunch of processing might be done on the client, in an obscure dll that a muppet built once and lost the source for, then some sort of passed to the server via some 15 year outdated IBM MQ series code, using a custom marshalling format some dolt invented and thousands of poeple have fiddled with and broke. The point being, even if managed to get the software installed, which would be a fucking miracle in itself, even Cerner employees can't get it to talk properly. More than likely because some clown invented a new IP protocol because he didn't like TCP or something, or OpenVMS explodes when sending UTF8 and your computer won't speak whatever charset it uses without installing a custom driver written in vb.net v1.3. So yeah, not even in the world of possibility. Arguably most secure hospital system on the planet because it's so crappy, nobody will use it, and no sensitive information ends up in it.
- aaaaaaaaata 4y ago
  > I can assure all readers this is another reddit hoax. They name the facility in the thread.
- ianhawes 4y ago
  This is such an accurate portrayal of Cerner. I recall doing an internship at a hospital when I was younger and seeing how finnicky Cerner was to administrate. No thanks. Wouldn’t go near that regardless of pay. What a terrible piece of software.

37 points by technion 4y ago

mc4ndr3 4y ago

That's a recipe for all manner of cybersecurity issues.

1970-01-01 4y ago

Only way to not get HIPPA involved is to shutdown all computers and move everything to paperwork

KerrAvon 4y ago
It’s genuinely stunning that we’ve found — on the internet — a scenario of actual potential HIPPA violations (as opposed to scenarios made up by mentally ill politicians to avoid answering questions, and ceaselessly parroted by their followers). But, yes, the time has come. Amazing.
- zamadatix 4y ago
  HIPAA (not HIPPA) violations are common. Not all mandatory reports get made and even then ~2 of the largest >=500 class violations are reported each day totaling hundreds of millions of records per year. I spent ~10 years in healthcare IT infrastructure (mostly server and network) at various places. Even the well funded ones with competent management and established IT have occasional breaches. And a lot of healthcare places don't have either of those things.

hedora 4y ago

Correct response: Anonymously name + shame the hospital. Alternatively, whistle blower, or union time.

toomuchtodo 4y ago
https://www.hhs.gov/hipaa/filing-a-complaint/index.html https://www.hhs.gov/hipaa/filing-a-complaint/index.html

vmurthy 4y ago

The original post should go to /r/whatcouldgowrong :-( How is this anywhere close to legal? (Not the layoff but the BYOD policy for accessing sensitive patient data) .

gjsman-1000 4y ago

If you are an attacker, all that is necessary is to compromise one device. Super easy by comparison to a locked-down corporate device, and you are off to the races. All a vengeful IT staff member has to do is name and shame the hospital. It would be a sign screaming "attack me." It would probably be as easy as leaving some flash drives in the parking lot.

exabrial 4y ago

> told to... ...Download Cerner... This line is telling. I can assure all readers this is another reddit hoax. First, one does not simply "Download Cerner". This is software built in essentially visual basic, and requires an incredible amount of tinkering with Windows to run. Oh and it's "rewritten" at least 12 times before abandoned, but somebody sold it to a customer anyway. Most hospitals "run" Cerner software via Citrix because of it's immense sensitivity and finickiness. Simple renaming a folder on your desktop can break the software (if you think I'm joking, I'm not). So yeah, if you actually managed to get the software 'installed' you probably deserve a Turing award. It's not like you can download an MSI and bam, cerner. You're going to be copying files, hex editing, reg-editing, installing/removing hundreds of windows fixpacks, and reformatting frequently when you screw it up. Next, Cerner software is built in thousands of [ironically named] "solutions", all decided by the LPOW (loudest persons opinion wins) or HIPPO (highest paid persons opinion wins). A bunch of processing might be done on the client, in an obscure dll that a muppet built once and lost the source for, then some sort of passed to the server via some 15 year outdated IBM MQ series code, using a custom marshalling format some dolt invented and thousands of poeple have fiddled with and broke. The point being, even if managed to get the software installed, which would be a fucking miracle in itself, even Cerner employees can't get it to talk properly. More than likely because some clown invented a new IP protocol because he didn't like TCP or something, or OpenVMS explodes when sending UTF8 and your computer won't speak whatever charset it uses without installing a custom driver written in vb.net v1.3. So yeah, not even in the world of possibility. Arguably most secure hospital system on the planet because it's so crappy, nobody will use it, and no sensitive information ends up in it.

aaaaaaaaata 4y ago
> I can assure all readers this is another reddit hoax. They name the facility in the thread.
ianhawes 4y ago
This is such an accurate portrayal of Cerner. I recall doing an internship at a hospital when I was younger and seeing how finnicky Cerner was to administrate. No thanks. Wouldn’t go near that regardless of pay. What a terrible piece of software.