This is the perfect anecdote. Either you get lucky with a healthcare provider that has signed a BAA with a company where someone happens to know how to use bcrypt for passwords, or you don't - there is really no way to know until you send that password reset email.

i used to work in health care, and the website for a certain medical board stores all of its licensees' passwords in plaintext. i am no longer licensed with that board, but i can't remove any of my data. a breach seems inevitable.

I logged on to a medical practice's portal and was able to access all of the provider's notes from my visits.

I didn't read them or investigate to see whether it was just my own that were available, but I'm pretty sure it was a mistake in setting permissions.

Some time later the whole portal disappeared, except for a bill pay page. Also the provider suddenly quit with no warning; I don't recall the sequencing.

Nobody ever sent me a letter fessing up to anything.

The provider's notes about your visit are part of your medical record, and something that would be very reasonable for you to see (in most cases they are legally required to provide access to your compete record). What would they need to "fess up" about?

>in most cases they are legally required to provide access to your complete record

Yes, I'm aware and I have requested my records in the past. I can even spell HIPAA, unlike a lot of people.

This is irrelevant to my anecdote about the screwed up portal, since I would be aware and have mentioned it if I made such a request, which I did not.

>What would they need to "fess up" about?

Like I said, I didn't investigate to find out the full story, because we all know what happens if you "hack" a broken system.

Yeah, I don't follow this line either. My doctors portal has my providers notes readily available to me without me asking.

Are you sure you aren't just expecting to have to request it, and are being surprised by the fact that you don't?

Yes, I am.

I have a primary care doctor whose portal has the sort of thing you're referring to. That's different.

What's the difference between these two portals that means sharing your records with you is good in one case and bad in the other?

But they were _your_ records. Are you saying they should only be available to you upon request?

I'm not following you to the conclusion that it must be broken because it gave you access to your own records.

>Are you saying they should only be available to you upon request?

No.

Then I'm not following what you think was wrong here...