3 ms·
It's always the SOC 2 and HIPAA-compliant companies that get breached, but, of course, mostly compliant companies are lucrative targets.
by nikolay 2y ago
It's always the SOC 2 and HIPAA-compliant companies that get breached, but, of course, mostly compliant companies are lucrative targets.
- bearjaws 2y agoIt's because HIPAA is a joke and SOC2 is basically the bare minimum at this point. Too many little ways to manipulate your artifacts to pass SOC2 and no accountability when it goes wrong.
- gopher_space 2y agoSat in a hospital room with a relative for two weeks and saw staff repeatedly violate compliance directives in order to provide timely care. They clearly weren't being provided the resources needed to do so. Also, for the entrepreneurs out there, they seem to really need some kind of tubing that won't collect air bubbles. Something with a hydrophobic interior? I don't know. There's a related area regarding flushing IV systems that could use attention as well.
- nikolay 2y agoJust the fact that SOC 2 auditors are CPAs speaks enough. I remember working at a large e-commerce company, and the InfoSec offers told me that we didn't care about PCI compliance as we could only get fined, but we could get into orange jumpsuits for mishandling PII. And that was over a decade ago, talking only about names, addresses, emails, and phone numbers. With HIPAA leaks, it's tons more than just that, and I'm not sure what the consequences are, but back then, we didn't want to sell prescription eyewear only due to the HIPAA burden.