7 ms·

> HIPAA my left foot. That was my experience as well - training documentation for fresh college grads (i.e. me) directed new engineers to just... send SQL quer

by saulrh 2y ago

> HIPAA my left foot. That was my experience as well - training documentation for fresh college grads (i.e. me) directed new engineers to just... send SQL queries to production to learn. There was a process for gaining permissions, there were audit logs, but the only sign-off you needed was your manager, permission lasted 12 months, and the managers just rubber-stamped everyone. That was ten years ago. Every time I think about it I find myself hoping that things have gotten better and knowing they haven't.

bick_nyers 2y ago
... you didn't have a UAT environment?
- saulrh 2y ago
  There were a couple "not prod" environments, but they were either replicated directly from prod or so poorly maintained that they were unusable (empty tables, wrong schemas, off by multiple DB major versions, etc), no middle ground. So institutional culture was to just run everything against prod (for bare selects that could be copied and pasted into the textbox in the prod-access web tool) or a prod replica (for anything that needed a db connection). The training docs actually did specify Real Production, and first-week tasks included gaining Real Production access. If I walked in and was handed that training documentation today I'd raise hell and/or quit on the spot, but that was my first job out of college - it was basically everyone's first job out of college, they strongly preferred hiring new graduates - and I'd just had to give up on my PhD so I didn't have the confidence, energy, or pull to do anything about it, even bail out. That was also the company where prod pushes happened once a month, over the weekend, and were all hands on deck in case of hiccups. It was an extraordinarily strong lesson in how not to organize software development. (edit: if what you're really asking is "did every engineer have write access to production", the answer was, I believe, that only managers did, and they were at least not totally careless with it. not, like, actually responsible, no "formal post-mortem for why we had to use break-glass access", but it generally only got brought out to unbreak prod pushes. Still miserable.)
- roughly 2y ago
  There’s an old joke that everyone’s got a testing environment, but some people are lucky enough to have a separate production environment.
jollofricepeas 2y ago
So… Is it surprising that Engineers in healthcare dont read the actual HIPAA documentation? Use of health data is permitted so long as it’s for payment, treatment or operations. Disclosures and patient consent are not required. There are helpful summaries on the US Department of Health and Humans Services website of the various rules (Security, Privacy & Notification) Source: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/guidance... This allowance is permitted to covered entities and by extension their vendors (business associates) by HIPAA. If it wasn’t then, theoretically the US healthcare industry would grind to a halt considering the number of intermediaries for a single transaction. Example: Doctor writes script -> EHR -> Pharmacy -> Switch -> Clearinghouse —> PA Processing -> PBM/Plan makes determination Along this flow there are other possible branches and vendors. It’s beyond complex.
- aiforecastthway 2y ago
  > If it wasn’t then, theoretically the US healthcare industry would grind to a halt considering the number of intermediaries for a single transaction. It just occurred to me that cleaning up our country's data privacy / data ownership mess might have extraordinarily positive second-order effects on our Kafkaesque and criminally expensive healthcare "system". Maybe making it functionally impossible for there to be hundreds of middlemen between me and my doctor would be a... good thing?
  - throwaway936r8 2y ago
    I think it would have the opposite effect. We could end up with a few all-in-one systems that would dominate the market and have little incentive to improve or compete on usability and price.
  - Spooky23 2y ago
    Only if your mortgage isn’t paid by such a middleman.
  - specialist 2y ago

by saulrh 2y ago

bick_nyers 2y ago

... you didn't have a UAT environment?

saulrh 2y ago
There were a couple "not prod" environments, but they were either replicated directly from prod or so poorly maintained that they were unusable (empty tables, wrong schemas, off by multiple DB major versions, etc), no middle ground. So institutional culture was to just run everything against prod (for bare selects that could be copied and pasted into the textbox in the prod-access web tool) or a prod replica (for anything that needed a db connection). The training docs actually did specify Real Production, and first-week tasks included gaining Real Production access. If I walked in and was handed that training documentation today I'd raise hell and/or quit on the spot, but that was my first job out of college - it was basically everyone's first job out of college, they strongly preferred hiring new graduates - and I'd just had to give up on my PhD so I didn't have the confidence, energy, or pull to do anything about it, even bail out. That was also the company where prod pushes happened once a month, over the weekend, and were all hands on deck in case of hiccups. It was an extraordinarily strong lesson in how not to organize software development. (edit: if what you're really asking is "did every engineer have write access to production", the answer was, I believe, that only managers did, and they were at least not totally careless with it. not, like, actually responsible, no "formal post-mortem for why we had to use break-glass access", but it generally only got brought out to unbreak prod pushes. Still miserable.)
roughly 2y ago
There’s an old joke that everyone’s got a testing environment, but some people are lucky enough to have a separate production environment.

jollofricepeas 2y ago

So… Is it surprising that Engineers in healthcare dont read the actual HIPAA documentation? Use of health data is permitted so long as it’s for payment, treatment or operations. Disclosures and patient consent are not required. There are helpful summaries on the US Department of Health and Humans Services website of the various rules (Security, Privacy & Notification) Source: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/guidance... This allowance is permitted to covered entities and by extension their vendors (business associates) by HIPAA. If it wasn’t then, theoretically the US healthcare industry would grind to a halt considering the number of intermediaries for a single transaction. Example: Doctor writes script -> EHR -> Pharmacy -> Switch -> Clearinghouse —> PA Processing -> PBM/Plan makes determination Along this flow there are other possible branches and vendors. It’s beyond complex.

aiforecastthway 2y ago
> If it wasn’t then, theoretically the US healthcare industry would grind to a halt considering the number of intermediaries for a single transaction. It just occurred to me that cleaning up our country's data privacy / data ownership mess might have extraordinarily positive second-order effects on our Kafkaesque and criminally expensive healthcare "system". Maybe making it functionally impossible for there to be hundreds of middlemen between me and my doctor would be a... good thing?
- throwaway936r8 2y ago
  I think it would have the opposite effect. We could end up with a few all-in-one systems that would dominate the market and have little incentive to improve or compete on usability and price.
- Spooky23 2y ago
  Only if your mortgage isn’t paid by such a middleman.
- specialist 2y ago