3 ms·
I once worked for a medical records software company. We received a bug report that a particular patient's record could not be viewed. Our support engineer re
by ShabbyDoo 14y ago
I once worked for a medical records software company. We received a bug report that a particular patient's record could not be viewed. Our support engineer remoted into the client's site and asked the secretary for the patient's name. It was Bobby Null. You can imagine what sort of underlying assumption about String serialization led to this issue. [A preemptive aside: We had proper confidentiality agreements in place. No HIPAA rules were violated.]
- jsprinkles 14y agoDoesn't telling us the patient's name violate HIPAA in itself?
- eblume 14y agoIn this case, probably yes. Might want to remove the post, it's a fairly major violation. Often, names alone wouldn't necessarily constitute a violation as names are generally not sufficient to count as personally identifiable information... but a name like 'Bobby Null' is, I think, quite unique. When I was being trained on HIPAA compliance I was told that sole first names are generally perfectly fine, and sole last names can often be fine but should be avoided for very common names. But I should also say that I am not an expert on HIPAA compliance.
- YuriNiyazov 14y agoFor very _common_ or very _uncommon_ ?
- AgentConundrum 14y agoI don't know the ins and outs of HIPAA, largely because I don't have to deal with them at all, but I don't see how this should be a violation. That's not to say that it's not, but rather that it seems like an odd rule. All the post tells us is that a person named "Bobby Null" exists and has medical records, as do most people. It doesn't say anything about this persons medical issues/history at all. I could learn more about someone by sitting a touch too close to the reception area at a doctor's office.
- mkopinsky 14y agoAlso not an expert, but I agree. The violation is only if there is PHI - personal health information released. Stating that John Doe was present at X Clinic is a problem; stating that he exists is not.
- fl3tch 14y agoHaving a record implies that you were present at X Clinic. If it's a specialist clinic, then confirming the existence of patient record could allow someone to infer the condition or a range of conditions. Most clinics won't confirm or deny that a patient is there (or has records) without a release. In this case, though, we don't know where the record was stored.
- eblume 14y agoGood point. My training said no full names, but that was because we were directly associated with a specific product/analysis, so any full names would associate the patient with a particular health... thing. A name by itself, you are quite right, is not PHI. Thanks for the reminder!
- kijin 14y agoMethinks the "Bobby" part is fictional. Probably a reference to Bobby Tables.
- ShabbyDoo 14y agoGood question. I recall having done a Google search and noting that there were not an insignificant number of people with the last name Null in the US, so I wasn't too concerned about posting this. Probably a HIPAA violation, but not a major one.
- jvrossb 14y agoAccording to howmanyofme.com there are 9 Bobby Nulls in the U.S.
- deleted 14y ago[deleted]