News for hackers. Stuff that matters.

A comment on Zuckerberg Takes Steps to Calm Facebook Employees. Parent comment

Re:Zuckerberg Takes Steps to Calm Facebook Employees by sulam on Sunday March 25, 2018 @10:23PM (#16676130)
HITRUST CSF is a framework for auditably proving HIPPA compliance. It prescribes controls such as encrypting data at rest. If you have a business relationship with a company which provides you PHI without explicit user consent you must have an agreement (a BAA) with the third party which puts them under the same requirements (backed up with third party audits).

Everything you’re describing sounds like it’s either incredibly fly by night, not in the US, or substantially out of date. If the last two aren’t true, you have a situation that is literally illegal.

[ Parent | on HN ]
Re:Zuckerberg Takes Steps to Calm Facebook Employees by ubernostrum on Monday March 26, 2018 @01:25AM (#16676812)
I've worked in health care a couple of times now. And while the companies I've worked for have gone well beyond the minimum required for legal compliance, the scary bit really is the sorts of things you could, if you were lazy enough, do and still legally be compliant.
[ Parent | on HN ]
Re:Zuckerberg Takes Steps to Calm Facebook Employees by sulam on Monday March 26, 2018 @10:01AM (#16678928)
Yeah, HIPPA has some holes you could drive a truck through. I also hate OAuth (so much focus on access, so little focus on what gets done with that access).
[ Parent | on HN ]
Re:Zuckerberg Takes Steps to Calm Facebook Employees by specialist on Monday March 26, 2018 @10:28AM (#16679146)
Uh huh. We were the first to market with portable electronic medical records. "Fly by night." Sounds about right.

In the USA, there is no way to encrypt medical records at rest and permit data interchange. Because in the USA we do not have universal MRNs (PIDs, GUIDs, whatever). Meaning that if demographic data is encrypted, the system cannot match records across org boundaries, meaning care providers aren't 100% sure they have the correct medical history for the patient, meaning prescription errors, cutting off the wrong arm, misdiagnosis, etc.

Some enclaves like Medicare and VA can encrypt their own data for their own usage, but that protection is moot the moment data is shared with other orgs. It's been a while since I've checked, but I doubt they do encrypt, because that's a bottom up design decision.

[ Parent | on HN ]
Re:Zuckerberg Takes Steps to Calm Facebook Employees by aianus on Sunday March 25, 2018 @10:46PM (#16676222)
Surprise: regulating and legislating doesn’t actually make bad behaviour go away. I too have had the experience of interning at a medical software company where security and patient privacy were a joke.
[ Parent | on HN ]
Re:Zuckerberg Takes Steps to Calm Facebook Employees by sulam on Sunday March 25, 2018 @10:56PM (#16676270)
That sucks, but you might consider next time talking to people and seeing if they are working to improve things and, if not, being a whistleblower.
[ Parent | on HN ]
Re:Zuckerberg Takes Steps to Calm Facebook Employees by jacquesm on Sunday March 25, 2018 @11:19PM (#16676362)
You might as well connect that whistle to an aircompressor if my experience is anything to go by. Very few companies have their house in order, and healthcare is definitely not an exception to this.
[ Parent | on HN ]