6 ms·

Sending medical images to Microsoft seems like a major HIPAA violation.

Melting_Harps 3y ago
> Sending medical images to Microsoft seems like a major HIPAA violation. Without sounding to condescending: Bro... this entire Industry still relies on using fax or snailmail for records. Using slow, leaky, non-private/seure channels for sensitive information is not as much of a concern to this field than one thinks if you've been in the belly of the beast. Ask anyone who has spent anytime doing IT work at a hospital, or better yet a disgruntled nurse who works the counter after a 12 hour shift. You ever try requesting an MRI in the US? After needing several during COVID and being turned a way and having lots of time on my hands I've actually learned a hack to get it the same week (or in my case the same day recently) now that we're out of the pandemic because I knew who to press for a physical paper trail and get it submitted (via fax) and have it approved by all parties: it cost me a day off of work, and tons of leg work on the phone but it was done and I literately didn't care so long as it was done and prove my method was sound. I got it done after business hours, too! I'm starting to think that the issue with it being so archaic is not because a better solution doesn't exist, but because it's made this way in order for them to justify the long delays in procedures and increase membership duration on their policies and they use things like HIPPA and other acts to justify the lengthy process and obscene amounts of money needed to be able to modify the way things are done, which is why software people just move on and the same mediocrity continues to the detriment of us all.
- voldacar 3y ago
  What specifically did you do to get an MRI quickly? Your personal doctor didn't want to give you one? Or the hospital/MRI place didn't want to give you one?
- f1shy 3y ago
  Waaaaait! In the US also the FAX is still a thing?! Seriously?! I have heard terrible stories from Germany and Japan, but did not know that also the US…
  - kube-system 3y ago
    The US has a zillion healthcare providers. Some are so huge and well resourced that they literally have $100 million+ digital record systems. Some are so tiny that it's one doctor operating out of an old house with pen and paper. A fax machine is the least common denominator.
    - intelVISA 3y ago
      That fax is probably much more secure than the $100m system too...
  - JohnFen 3y ago
    > In the US also the FAX is still a thing?! Seriously?! Yep. My current employer, as well as the two prior to this one, all have and use fax machines despite being tech companies. Not because they want to, but because so many other companies out there still require it.
  - greedo 3y ago
    I work for an insurance company that for a long time didn't trust digital signatures. So we accepted docs from our agents via fax. They were there four decades ago, and they're still there (of course they're fax servers). They'll probably be there when I retire.
- hospitalJail 3y ago
  Try talking to healthcare workers too. They think there is some magic about faxes. >They are so fast(no they arent, something can be ahead of them) >They are safe compared to email(literally anyone can walk by the fax and take it) >They are faster than a phone call, because doctors don't pick up the phone. (What...) You can mention the US government has ultra high security communication that uses the internet, you can mention the value of finance information, you can talk about the secrets your billion dollar company sends over email/web. But noooo, patient information is too sensitive and urgent to be sent over email/web....
  - bombcar 3y ago
    To be fair to them, how many fax breaches have you heard about compared to email/website breaches?
    - hospitalJail 3y ago
      I know 3 people off the top of my head that have gotten in trouble for looking up people's health information because it was physically stored on premises. All 3 still work in the medical field to this day, one of them is a doctor... I imagine this is a huge issue in the medical field.
      - bombcar 3y ago
        Oh, definitely. Anyone in the medical field who says they've never gossiped about people's health issues is either a saint or bending the truth a bit. But that's vastly different (though perhaps more invasive) than massive breaches like these: https://www.healthcaredive.com/news/cybersecurity-hacking-healthcare-breaches/643821/ https://www.healthcaredive.com/news/cybersecurity-hacking-he...
        hospitalJail 3y ago
        On the bright side, at least you know if you are affected! When an employee snoops, you will never know.
- SkyPuncher 3y ago
  Fax is still a magical thing in healthcare specifically because of how easy it is to use under HIPAA. HIPAA has all of these crazy rules for anything digital, but the second you switch to good ol’ telephony the rules all become “there’s no rule because hacking a telephony system would be a federal crime.” I’m not joking. Telephony is considered a “mere conduit” while the internet is not. It really is stupid. HIPAA has all of these controls, but phones are just fair game.
  - account42 3y ago
    It would be great if the US also considered internet to be a mere conduit and went after those messing with it. The we wouldn't need to break backwards compat for entirely static public content and waster energy in forcing everything under TLS.
brookst 3y ago
It's sending URL's, and it's not clear if it is also sending cookies or other auth info. I would think / hope that any images covered by HIPAA would not be leakable by URL alone.
- partiallypro 3y ago
  Yeah, since it's sending the URLs, Microsoft couldn't get to the actual images in question because they'd in a private network, behind a login, etc. If the images are hosting on a public domain or IP, that is not on Microsoft.
  - Drunk_Engineer 3y ago
    Under HIPAA, any scrap of "individually identifiable health information" that can be used to connect online data with a patient cannot be sent to a third party without consent.
  - sebosp 3y ago
    Just curious, how are images protected by login:password? The only way I know is htacess, which isn't really an easily scalable/usable feature... Many years ago, maybe 10 when I used Facebook I recall you could share a picture location with anybody regardless of login (i.e. Right click, copy image location, send over whatever), so the URL wouldn't be guessable or possible to predict, and the protection would be that you would get access to such url only when logged. I think in this context, the private network idea would only work if you are on vpn and you share urls that are only accesible vía vpn, is this a common setup for medical images? Is this expected? I wouldn't mind having a key or an image descrambler/decrypting/token but can't say the same about my grandma, my mother, my brother, my nephews...
    - tredre3 3y ago
      Images are like any other web asset and can be protected either by the web server (htpasswd) or the application's logic. I think you've been brainwashed by modern storage services (S3) where the URL is essentially always public and out of your control. It's trivial to password protect an image when it's on your server. I would assume any medical provider would protect their images by checking the session and not serve them via AWS.
msla 3y ago
Don't worry: If this all breaks, the fines levied on Microsoft won't be anywhere near their profits.
RoyGBivCap 3y ago
Maybe. Maybe not. I used to work in health insurance. HIPAA protected information is "Personally identifying information" (name, email, etc) plus a medical diagnosis, treatment, or cost of treatment. It might be PII. It might be sensitive. But if it's not both of those, it's not HIPAA protected. If you think about medical textbooks where there are pictures of patients and their maladies, but they are not identified this makes sense why both are required. Otherwise educating new doctors would be impossible.

> Sending medical images to Microsoft seems like a major HIPAA violation. Without sounding to condescending: Bro... this entire Industry still relies on using fax or snailmail for records. Using slow, leaky, non-private/seure channels for sensitive information is not as much of a concern to this field than one thinks if you've been in the belly of the beast. Ask anyone who has spent anytime doing IT work at a hospital, or better yet a disgruntled nurse who works the counter after a 12 hour shift. You ever try requesting an MRI in the US? After needing several during COVID and being turned a way and having lots of time on my hands I've actually learned a hack to get it the same week (or in my case the same day recently) now that we're out of the pandemic because I knew who to press for a physical paper trail and get it submitted (via fax) and have it approved by all parties: it cost me a day off of work, and tons of leg work on the phone but it was done and I literately didn't care so long as it was done and prove my method was sound. I got it done after business hours, too! I'm starting to think that the issue with it being so archaic is not because a better solution doesn't exist, but because it's made this way in order for them to justify the long delays in procedures and increase membership duration on their policies and they use things like HIPPA and other acts to justify the lengthy process and obscene amounts of money needed to be able to modify the way things are done, which is why software people just move on and the same mediocrity continues to the detriment of us all.

voldacar 3y ago
What specifically did you do to get an MRI quickly? Your personal doctor didn't want to give you one? Or the hospital/MRI place didn't want to give you one?
f1shy 3y ago
Waaaaait! In the US also the FAX is still a thing?! Seriously?! I have heard terrible stories from Germany and Japan, but did not know that also the US…
- kube-system 3y ago
  The US has a zillion healthcare providers. Some are so huge and well resourced that they literally have $100 million+ digital record systems. Some are so tiny that it's one doctor operating out of an old house with pen and paper. A fax machine is the least common denominator.
  - intelVISA 3y ago
    That fax is probably much more secure than the $100m system too...
- JohnFen 3y ago
  > In the US also the FAX is still a thing?! Seriously?! Yep. My current employer, as well as the two prior to this one, all have and use fax machines despite being tech companies. Not because they want to, but because so many other companies out there still require it.
- greedo 3y ago
  I work for an insurance company that for a long time didn't trust digital signatures. So we accepted docs from our agents via fax. They were there four decades ago, and they're still there (of course they're fax servers). They'll probably be there when I retire.
hospitalJail 3y ago
Try talking to healthcare workers too. They think there is some magic about faxes. >They are so fast(no they arent, something can be ahead of them) >They are safe compared to email(literally anyone can walk by the fax and take it) >They are faster than a phone call, because doctors don't pick up the phone. (What...) You can mention the US government has ultra high security communication that uses the internet, you can mention the value of finance information, you can talk about the secrets your billion dollar company sends over email/web. But noooo, patient information is too sensitive and urgent to be sent over email/web....
- bombcar 3y ago
  To be fair to them, how many fax breaches have you heard about compared to email/website breaches?
  - hospitalJail 3y ago
    I know 3 people off the top of my head that have gotten in trouble for looking up people's health information because it was physically stored on premises. All 3 still work in the medical field to this day, one of them is a doctor... I imagine this is a huge issue in the medical field.
    - bombcar 3y ago
      Oh, definitely. Anyone in the medical field who says they've never gossiped about people's health issues is either a saint or bending the truth a bit. But that's vastly different (though perhaps more invasive) than massive breaches like these: https://www.healthcaredive.com/news/cybersecurity-hacking-healthcare-breaches/643821/ https://www.healthcaredive.com/news/cybersecurity-hacking-he...
      - hospitalJail 3y ago
        On the bright side, at least you know if you are affected! When an employee snoops, you will never know.
SkyPuncher 3y ago
Fax is still a magical thing in healthcare specifically because of how easy it is to use under HIPAA. HIPAA has all of these crazy rules for anything digital, but the second you switch to good ol’ telephony the rules all become “there’s no rule because hacking a telephony system would be a federal crime.” I’m not joking. Telephony is considered a “mere conduit” while the internet is not. It really is stupid. HIPAA has all of these controls, but phones are just fair game.
- account42 3y ago
  It would be great if the US also considered internet to be a mere conduit and went after those messing with it. The we wouldn't need to break backwards compat for entirely static public content and waster energy in forcing everything under TLS.

brookst 3y ago

It's sending URL's, and it's not clear if it is also sending cookies or other auth info. I would think / hope that any images covered by HIPAA would not be leakable by URL alone.

partiallypro 3y ago
Yeah, since it's sending the URLs, Microsoft couldn't get to the actual images in question because they'd in a private network, behind a login, etc. If the images are hosting on a public domain or IP, that is not on Microsoft.
- Drunk_Engineer 3y ago
  Under HIPAA, any scrap of "individually identifiable health information" that can be used to connect online data with a patient cannot be sent to a third party without consent.
- sebosp 3y ago
  Just curious, how are images protected by login:password? The only way I know is htacess, which isn't really an easily scalable/usable feature... Many years ago, maybe 10 when I used Facebook I recall you could share a picture location with anybody regardless of login (i.e. Right click, copy image location, send over whatever), so the URL wouldn't be guessable or possible to predict, and the protection would be that you would get access to such url only when logged. I think in this context, the private network idea would only work if you are on vpn and you share urls that are only accesible vía vpn, is this a common setup for medical images? Is this expected? I wouldn't mind having a key or an image descrambler/decrypting/token but can't say the same about my grandma, my mother, my brother, my nephews...
  - tredre3 3y ago
    Images are like any other web asset and can be protected either by the web server (htpasswd) or the application's logic. I think you've been brainwashed by modern storage services (S3) where the URL is essentially always public and out of your control. It's trivial to password protect an image when it's on your server. I would assume any medical provider would protect their images by checking the session and not serve them via AWS.

msla 3y ago

Don't worry: If this all breaks, the fines levied on Microsoft won't be anywhere near their profits.

RoyGBivCap 3y ago

Maybe. Maybe not. I used to work in health insurance. HIPAA protected information is "Personally identifying information" (name, email, etc) plus a medical diagnosis, treatment, or cost of treatment. It might be PII. It might be sensitive. But if it's not both of those, it's not HIPAA protected. If you think about medical textbooks where there are pictures of patients and their maladies, but they are not identified this makes sense why both are required. Otherwise educating new doctors would be impossible.