First Ever HIPAA Fine Is $4.3M 197
Trailrunner7 writes "The health care industry's toothless tiger finally bared its teeth, as the US Department of Health and Human Services issued a $4.3M fine to a Maryland health care provider for violations of the HIPAA Privacy Rule. The action is the first monetary fine issued since the Act was passed in 1996. The US Department of Health and Human Services (HHS) issued a Notice of Final Determination to Cignet Health care of Temple Hills, Maryland on February 4. The notice followed a finding by HHS's Office of Civil Rights that Cignet failed to provide 41 patients with copies of their medical records and for failing to respond to requests from HHS's Office of Civil Rights for information related to the complaints."
FERPA (Score:2)
Next thing you know, the feds be enforcing FERPA [ed.gov].
Re: (Score:2)
I'm not sure what your point is. The schools where I have worked do follow FERPA, and to my knowledge record privacy and portability is well respected throughout the education system.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
My point is simply that there has never been an enforcement action for FERPA against any institution of higher education in the history of the legislation. Indeed the only penalty available to the FPCO for the enforcement of FERPA is the total withholding of federal funds.
Re: (Score:2)
If everyone is following the law voluntarily, no enforcement actions are necessary.
Re: (Score:2)
Re: (Score:3)
As someone who's both managed university systems and who's specifically requested that their directory information not be made public as per the Buckley amendment, I can tell you that it's taken very seriously.
The problem was, they were using people's SSNs as unique identifiers throughout the system. It was event printed on your student ID card. That's what needs to fixed -- the government needs to force companies/colleges/whatever to stop using and exposing people's SSNs all the damned time.
Re: (Score:3)
No, the real solution is that no one should expect SSN's to be a secret. It is not a password, and it should never be used as one.
Re: (Score:2)
No, the government should stop people accepting SSNs as authenticators.
They work just fine as ID numbers.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Your SSN is a 9-digit number. Range: 000-00-0000 to 999-99-9999. That's 1 billion combinations. There have been more than 1 billion SSNs issued.
That, right there, tells me there are duplicates.
Since a valid SSN can't have an area number (first 3 digits) between 734 and 749, we remove 15 million numbers; that leaves 985 million. Oh, the area number also can't be higher than 772. That removes another 228 million numbers from the pool, leaving us with 757 million numbers. We can rule out 000-**-** (1 million),
Re: (Score:2)
I do give RIT credit for switching to RIT-specific 9-digit numbers for that purpose; that change was affected a few years before I started there, I think.
I've heard some other mentions of "it's FERPA rules" before.
Then again, even if a law isn't (heavily) enforced, many entities follow it anyway.
Re: (Score:2)
The only time I saw it well applied was in college. If you sue a regular school district, they don't lose anything. They just raise taxes to cover the cost and move on, doi
More to come? (Score:5, Interesting)
I'm a med student who has worked in several hospitals, and have yet to see one where HIPAA is rigorously followed. Directives by management are common, but when HIPAA impedes patient care (it's a hassle and timekiller to comply completely), it is always worked around. Doctors by and large, in my experience, toss HIPAA aside the first time they have to decide what to do with their limited time - adhere to every last rule or take care of a patient.
I'm really surprised it's taken this long for a fine to come about.
Re: (Score:2)
Are there any studies out there about how much HIPAA compliance costs?
Re: (Score:3)
Are there any studies out there about how much HIPAA compliance costs?
Probably. They won't mean much. HIPAA is the new boogyman so any 'compliance cost' estimate will be full of untested assumptions, incorrect assumptions, wild ass guess and gonzo statistics. It's really NOT all that hard to follow most of the HIPAA rules. DHS has made it clear that they're not going after each and every little mistake that people make but are instead going after willful, major violations, such as the one in TFA.
The biggest problem with HIPAA, IMHO, is that the free pass it gives insure
Re: (Score:2)
Are there any studies out there about how much HIPAA compliance costs?
Probably. They won't mean much. HIPAA is the new boogyman so any 'compliance cost' estimate will be full of untested assumptions, incorrect assumptions, wild ass guess and gonzo statistics. It's really NOT all that hard to follow most of the HIPAA rules. DHS has made it clear that they're not going after each and every little mistake that people make but are instead going after willful, major violations, such as the one in TFA.
I used to work for a medical facility and this very thing was rampant. The ladies thought they could read the law and instantly understand what was required. They would spend hours in the conference room conjuring up IP policies they knew nothing about, and expect me to my behind on the legal line. No thanks.
That's why I left.
- Dan.
Re:More to come? (Score:5, Interesting)
Ah, a med student. How quaint.
One of my former co-workers once got into an argument with her provider's office about a policy change of theirs. It just so happened that office was also a client of my employer's (answering service). So, the office took it upon themselves to put two-and-two together, and they managed to have her fired. Yes, fired because she had an argument off-the-clock in a situation where she was supposed to be the customer.
I think it's good that HIPAA is being enforced. If you med types want to arrogantly view yourselves as gods or even scientists because you know a little biology, you could at least use a bit of ethics in your daily lives. Dicking around with confidential information and using it for your own amusement/revenge is not ethical.
Re:More to come? (Score:4, Interesting)
If you med types want to arrogantly view yourselves as gods or even scientists because you know a little biology,
There isn't even much in the way of actual science or biology. For example, the well reputed author of Lies, Damned Lies, and Medical Science [theatlantic.com] claims that "as much as 90 percent of the published medical information that doctors rely on is flawed".
Re: (Score:2)
"as much as" is one of those awesome Humpty Dumpty phrases that doesn't mean much. It's like how stores have signs saying "Up to 80% off!" - except the only item that's actually 80% off is some piece of shit that was overpriced in the first place and is sold out already anyway.
Re: (Score:2, Interesting)
For example, progress notes must be written daily on each patient on a floor. At least one EMR system I've encountered has such a terrible UI that drafting and saving a note is functionally impossible, and the average resident is paged several times an hour to go do something. So most people save them in Word documents on a shared drive, accessible by anyone in the institution and blatantly violating HIPAA, and copy and paste when they're ready to put it in the chart.
Well, that's completely irresponsible, and I hope you guys get caught and fined for it.
There are only 24 hours in the day, and in a hospital, it's often the case that there is some patient care task to do literally every second you are there.
Boo hoo. Medical schools accept a ridiculously small number of students (I'm not talking about people who don't fit the bill, I'm talking about straight A students), in an attempt to maintain an artificial scarcity of doctors, in order to keep salaries high. That results in insanely high salaries for you guys, but it does also result in a ridiculous amount of work that you must do in order to earn that money. Honestly,
Re: (Score:2)
That includes rules like HIPAA that affect the privacy of the patient and rules like minimum amount of rest you need to get, which affects the safety of the patient.
Many doctors are not fans of minimum rest rules because it increases the number of handoffs of patients between teams that must be done. Every time there is a handoff, information is lost, and the next team is more likely to make a mistake. This is a bigger issue than lack of sleep, but it's not intuitive to the lay public, so people don't get as angry about it.
so learn to keep records properly.... [slashdot.org]
Re: (Score:2)
It's considerably easier to be a straight-A student than it is to be a good doctor.
Perhaps, although I'd debate that to some extent. What about being a doctor is actually that hard? It seems like the hardest part of it is not killing patients at the end of a 16 hour shift - something that is a result of medical tradition more than the nature of medicine.
Also - when a medical school has 10,000 applicants for 300 seats, I doubt that the selection criteria really picked the only 100 people who were actually going to end up being good doctors from the pool.
The system is clearly engineered t
Re: (Score:2)
Re: (Score:3)
I'm a med student who has worked in several hospitals, and have yet to see one where HIPAA is rigorously followed.
Probably because no one was getting fined.
Re: (Score:2)
Yea, well patients seemed to think it was important enough to pass a law because we already established they were more concerned about 'patient care' (translation, making sure you couldn't take your records elsewhere ensuring you would stay rather than get retested for everything AGAIN at an additional cost).
The law exists because 'they' clearly aren't concerned and we 'the patients' are fucking concerned.
They lost their right to make a decision in this matter when they clearly illustrated they weren't trus
Re: (Score:3)
Try going into a restaurant sometime and have them say "we're more concerned about getting your food out in a timely fashion than cleaning the place, so we're just going to serve you food on dirty dishes."
Re: (Score:3)
I fail to see how allowing patients to have a copy of records of medical diagnosis and treatment is bad for the patient or creates more work for a doctor.
Yes, I can understand how additional paperwork and rules for HIPAA can impede doctors. I don't see how that applies in this case.
The given article makes it seem like the healthcare provider was not providing copies of records that they were keeping anyway.
Re: (Score:2)
Frankly I'd go one step further.
I'd require the patient to receive a copy of all records generated within 24 hours of them being generated. At the very least not a penny could be paid by ANYBODY towards medical care before the patient received a copy of their records.
The patient is of course welcome to throw them in the recycling bin after getting them if they don't want them.
I'm sure the number of trees that die as a result of this will be a fraction of those who die from routine credit card receipts that
Re: (Score:2)
to be "exact" hippa is 45CFR 160 162 and 164
three entire SECTIONS of dense laws.
anybody that can actually understand HIPPA (even from limited sense) IS FLIPPING NUTS
Re: (Score:2)
Re:More to come? (Score:5, Insightful)
HIPPA violations are usually identified either by patient complaints to the state department of health or a Joint Commission survey. Of course they happen routinely (daily, in my experience) but only violations that are reported are actionable. And, in those cases, the concern has been correcting the deficiency, not punishing the mistake. In this particular case, Cignet Health Care ignored repeated requests for information and only under a court order did they release the records. This isn't a slip-up, it's gross negligence:
When the health care provider was ordered by a court to respond to the requests, it disgorged not just the patient records in question, but 59 boxes of original medical records to the U.S. Department of Justice, which included the records of 11 individuals listed in the Office of Civil Rights Subpoena, 30 other individuals who had complained about not receiving their medical records from Cignet, as well as records for 4,500 other individuals whose information was not requested by OCR.
Re: (Score:2)
Re: (Score:2)
This is one of the few times where
Re: (Score:2)
Modern H.I.T. is about safety before anything else. Paper based medicine is very error prone.
Re: (Score:2)
Also Spartacus (Score:2)
Obviously there's regional variation for this. I'm also a med student who has worked in several hospitals, and I've yet to find one where HIPAA is *not* rigorously followed, even when this creates weird and novel situations. Such as when a white board for patient names, details, and staff assignments is visible to patient or public areas, and gets changed to entire list of last name's first two letters plus first initial. So everyone is Le or Je or Su or Ma, and basically it looks like the entire patient po
Re: (Score:2)
Why isn't it? We've made LAWS saying that this stuff IS important.
And also having worked in government public health, it is something taken very seriously. Lifes ARE on the line. Example: A database with aids patient information being 'leaked' in the wrong part of the wrong state/country to the wrong people very well might end up with people being beat to a bloody pulp because some ignorant fuck finds out some guy has AIDS and assumes that means he's also gay AND deserves a beating.
Theres of course all
Re: (Score:2)
Again. YOU DON'T GET TO DECIDE WHICH LAWS TO FOLLOW AND WHEN YOU FOLLOW THEM, but you do get to vote for the people who make the laws. Change the laws or follow them, nothing else is acceptable.
Yes, I do. The court may decide to punish me for breaking a law, but it is always my decision whether or not I will follow a law. See the concepts of civil disobedience [wikipedia.org] and free will [wikipedia.org]. An unjust law should never be followed, and even a just law should not be followed blindly.
Re: (Score:2)
Re: (Score:2)
Agreed. The basis of civil disobedience is that by disobeying an unjust law, you serve (by example) to bring to light what is wrong with the law.
The idea doesn't exactly apply here... I'd be hard pressed to imagine a doctor disobeying HIPA to deliberately show what is wrong with it. I could however very easily imagine a doctor ignoring HIPA when it interferes with their ability to treat a patient -and then just moving on with their day.
Re: (Score:2)
You're looking at it through a tiny instant in time through a tiny pinhole and ignoring everything else trying to come up with an instance to justify your reaction to his statement, the problem is that you are completely unqualified (I say that based on the fact that you raised the question alone) to make that decision, which is why it isn't your decision and there are laws relating to it.
No. I am looking at poster #1 who offered a very specific situation. Poster #2 then offered a very general and somewhat tangential response that could be interpreted several ways due to its vagueness. I pointed this out to poster #2, offering one interpretation that he probably did not intend and suggested he elaborate to avoid this miscommunication.
Your hysteria is causing you to see things that are not there.
Re: (Score:2)
Well, you do, at risk of being fined, arrested, shot (while fleeing), ending up as Bubba's "wife" in the cell...
Re: (Score:2)
He said "HIPAA is not more important than a patient's life" and you responded "government workers take it seriously, regardless of the patient's health." If that's not your intention, then you made an error. Insisting that's not what you meant won't change how it comes across. Just say "I was wrong" and move on.
Re: (Score:2)
Re: (Score:2)
And please, (Score:2)
Nothing but hot air puffing up some ego.
Re: (Score:2)
You will actually reap the benefits of those fines by having a lower federal debt, or possibly lower taxes in the future.
Meanwhile, the customers of the fined company will suffer, but not as much as they do by continuing to use them as a service provider.
Re: (Score:2)
http://www.usdebtclock.org/ [usdebtclock.org]
Where are they? Fffft - gone!
First it will get paid out of corporate funds - reduces profit, taxes and, since profitability is a must - stockholders want their cut - the customers will come up for it.
Size of company/revenue in relation to penalty is unknown, which would be interesting, is it even worth a scratch?
Maybe lawyers are making more on it challenging the whole thing.
Re: (Score:3)
The company.
If they try to pass that on to their customers, their customers will leave them; there is ample competition for that to be an effective punishment that can't simply be fobbed off.
Re: (Score:2)
Re: (Score:2)
True, but the prices get dictated by insurance companies based on what is reasonable and customary and all that (or likely whatever medicare pays).
If a doctor's office calls up blue cross and tells them that they're raising rates by $10 to cover a fine, blue cross will tell them that they'll keep paying what they've been paying all along, and they don't have to accept it if they don't want it.
The reality is more of a balance of power as conglomerates of doctors negotiate with mega-insurers. However, no sin
Re: (Score:2)
You don't have any incentive to schedule unecessary follow up visits....you get paid the same no matter how many times you see me. If I feel like you are putting me off or avoiding treating me...I go find another doctor and you don't get a
Re: (Score:2)
Re: (Score:2)
Massachusetts has been studying this approach to cost-management for a couple of years now, and the Governor introduced a bill last week to switch all patients paid for by the Commonwealth to capitation. See:
http://www.boston.com/news/local/massachusetts/articles/2011/02/18/patrick_unveils_plan_to_curb_health_care_costs/ [boston.com]
cut off nose to spite face (Score:2)
I just love it.
to send a large middle finger to the feds by burying them in discovery (this seems fairly common, more info than needed is sent in the hopes that it is too large a task), and in response to a HIPPA complaint about their non compliance with patient medical record access, Cigna violates nearly every portion of the privacy sections of HIPPA.
I think the fine should be 10X
Re: (Score:3)
Cignet != Cigna
Re: (Score:3)
Just 4.3? (Score:2)
Re: (Score:2)
Which is worse here - take your pick! (Score:2)
Mystery (Score:2)
You can read the entire Penalty notice [hhs.gov], which lays out a good timeline of what went on. HHS sent them letters, phone calls, sign and return receipt requested letters, then subpoenaed them and after all that Cignet didn't even bother to show up in court. When the judge threatened penalties, they gave thousands of patient charts over, even though the subpoena was for only 30 records.
Looks like they had it coming, or else someone really badly has to fire their office administrator.
Re: (Score:2)
Not the office administrator, the lawyers.
Well (Score:2)
If I were a hospital or clinic, I would interpret this the opposite. This is the first time anyone has EVER been fined, and it's for blatant refusals to give medical records to dozens of people or respond to mail. Given what it takes to actually be fined, I would stop harassing people with useless HIPAA notices and using it to obstruct anything from getting accomplished whenever convenient.
Re: (Score:2)
Re: (Score:2)
It may be the first fine but I've worked at a hospital where they were investigating a complaint and it is an extremely major hassle to deal with. I'm guessing it would compare nicely to an IRS tax audit.
Also, like the vast majority of cases in the legal system, most HIPAA violations are settled out-of-court and I'm sure money has been paid, but it's only considered a fine if a court has to order it.
Until, like the FCC... (Score:3)
tm
HAHA 4.3M is a slap in the face to us, not them! (Score:2, Informative)
This doesnt faze them one bit... of the 4 hospitals they run, they have 925 beds between the 4 of them... they're racking in $$$... especially when 99% of Maryland facilities only negotiate 2% discounts.. even on a $51K bill. blasphemy!
i checked their site and found this...
HOSPITAL AFFILIATION: Southern Maryland Hospital, Clinton, MD, Doctors Community Hospital, Lanham, MD, Laurel Hospital, Laurel, MD, Prince Georges Hospital, Cheverly, MD*
then i searched the 4 hospitals...
Prince George's Hospital Center -
Don't diss Big Brother (Score:2)
Also seriously: One of the HIPAA loopholes that patients aren't always told about is that HIPAA privacy rules don't necessarily apply when the government gets involved. One could easily argue that Cignet shouldn't have released those 4,500 unneeded records, you bet...but one could also argue that the release of those records didn't automatically trigger a HIPAA violation, as the
-1, offtopic (Score:2)
"The health care industry's toothless tiger finally bared its teeth [...]"
Congratulations on writing one of the worst sentences ever.
Violation #2 - Mass General Hospital (Score:2)
Mass General agreed to pay a $1 million fine this past week for a HIPAA violation. One of its staff members left the records for 192 patients on a subway train. They were never recovered.
http://www.hhs.gov/news/press/2011pres/02/20110224b.html [hhs.gov]
These are the kinds of practices HIPAA was designed to prevent. I, for one, am glad to see HHS enforcing these rules. Just the fact that someone could be carrying the records for 192 patients around with them while commuting shows how cavalierly some medical staff
It'll be voided (Score:2)
Don't worry the "Conservative" courts will void it on appeal. You have to protect the corporations, the economy depends on them. All people are created equal, but some are more equal than others....
Re:Dentists... (Score:4, Informative)
Sounds like exactly what this lawsuit was about. Not giving patients their records.
Re:Dentists... (Score:4, Informative)
Yeah, and I never looked into HIPAA enough to realize until now that it included protecting the patient's right to access, not just privacy. Good ammo for my next visit.
Get your medical imaging in DICOM (Score:2)
The data is in DICOM http://en.wikipedia.org/wiki/Digital_Imaging_and_Communications_in_Medicine [wikipedia.org] format. There are free viewers for Linux, Mac, and Windows.
I had a CT done of my head. Pretty cool to watch in 3D.
My Dad has a stint in his aorta. Wa
Re: (Score:3)
It's morons like you that know just enough to be dangerous that make medical providers shudder.
What you fail to explain is how the fact that the poster as seen CT images of his head or his dad's heart makes him dangerous. I don't recall him saying that he plans to perform home surgery based on these pictures.
Re: (Score:2)
The point is it isn't such an example since there was statement or implication of involvement in the decision making process - it was a post about getting to look at the pretty pictures.
And apparently the AC thinks that letting people do that will be the end of the world.
Re: (Score:3)
It's idiots like you that are dragging the medical profession the same direction as lawyers.
GP said s/he had a CT, and his/her father had a radioactive contrast scan. Now, sure, contrast for a CT scan isn't normally radioactive. But it is in a PET scan, though specialists may call it a tracer. Same for SPECT, V/Q, and scintigraphs. And a few of those would be useful for checking out a stent.
Yes, there are dangerous patients who think they know more than doctors do. There are also patients who spot thing
Re: (Score:2)
There is also a class of people called 'nerds' who really dig stuff like seeing a CT scan of their head. Many of them, in fact, frequent this site.
Re: (Score:2)
Re: (Score:2)
If it weren't for assholes like you who wish to keep a patient's own data from them, perhaps more people would understand these things. Maybe if the doctors actually TALKED TO THEIR PATIENTS instead of just treating them like some lab animal, more people would understand these things. Maybe, just maybe, people aren't as dumb as you think they are.
Re: (Score:2)
And if you are a "health care professional", you're a pretty good counterexample.
Re: (Score:2)
Any employer who is not paying attention to HIPAA is going to (eventually) get in trouble. It's not just healthcare providers and doctors who have to worry about it. It's anyone who handles medical records and/or medical information. Drug test results, results of pre-employment physicals, DOT testing results, etc, etc. All of these are HIPAA related b
Re: (Score:2)
I did RTFA, and I'm not sure if the fine was for the denial of access, or for the extra 4500 people submitted to HHS's office of civil rights.
Re: (Score:2)
I doubt many are billing outright fraudulently...but they might bill a code that implied that the doctor had seen you directly for 30 minutes...when he had actually been in the room for about 3. There is a cheaper rate for that. Since almost nobody ever looks at this, it never gets caught. Except if you were that provider that didn't know I had that level of acess to my insurance claims...and that understanding of what the procedu
Re: (Score:3)
Me: "Could you email me a copy of my (digital) xrays?" Them: "Sorry, that would be a HIPAA violation."
That would be since your name is one them and, as we all know, email is basically and electronic postcard. You certainly can make secure email systems and larger health care organizations often have them. Smaller places just don't want to bother with it yet. Keep whining at them.
Me: "Could you copy them to my flash drive then?" Them: "Sorry, that would be a HIPAA violation."
That's not a HIPAA violation, that's a obvious security issue. Nobody in their right mind would let you plug some random flash drive into the hospital network.
Me: "Okay fine, could you print me a copy?" Them: "Sorry, we can't print from this system. We set it up that way to save the rainforests." ...
If that's really true, then the health care provider is bullshitting
Re: (Score:2)
Re: (Score:2)
Funny you should say that. Recently I was talking to someone who works in a clinic. They have centralized virus scanning, and he was notified when one of the machines in the patient intake area reported finding some item of malware. Turned out a patient
Re: (Score:2)
The ability for someone to see the contents of those records in transit is irrelevant because the owner of the information has requested it be sent that way.
While the patient has requested that they see their records, they did not request that anybody that can pick off the email in transit can see them.
Nice try, but that argument is roughly the same as telling the patient they won't understand them so its dangerous to give them to the patient. The user has requested them, you are required to supply them, period.
I have no idea why you think that requiring secure email is connected with whether on not the patient understands their medical records. It's simply using an insecure method of communication for material that by nature is intensely private is not a good idea. Yes, you have to give the records to the patient (that was the issue in TFA) but the medical provider d
Re: (Score:2)
Re: (Score:3)
Re: (Score:3)
I'm surprised that the first fine is due to the portability aspect of the law, not the security portions of the law.
I'm not. Anyone familiar with medical records and computer security issues considers the security portions of HIPAA a joke.
The primary reason is that medical records are pretty much universally kept on MS Windows systems. There are several reasons why this makes data security a joke. The main one has been discussed here at /. several times: Windows has an automatic update feature, which you can turn off for "application" level software. However, it can't be turned off for "system" level software. MS
Re: (Score:2)
I'm not. Anyone familiar with medical records and computer security issues considers the security portions of HIPAA a joke.
The primary reason is that medical records are pretty much universally kept on MS Windows systems.
I guess I was lucky. Most of the medical software I've worked on has run on CentOS or RHEL systems.
There are several reasons why this makes data security a joke. The main one has been discussed here at /. several times: Windows has an automatic update feature, which you can turn off for "application" level software. However, it can't be turned off for "system" level software. MS has admitted that this has been true since XP. Their excuse is that kernel security issues are taken seriously, and updates are mandatory.
However, if you think about this for a few seconds, it obviously means that any time your Windows system is connected to the Internet, MS can silently install any new software they like. If your machine isn't reporting the contents of selected files to a .microsoft.com site now, it could be by the time you read this, and unless you're a real Windows security guru, you'd never suspect.
So if you're running Windows, you must assume that anyone who has "socially engineered" a connection at MS has access to all of your data.
And, less you think this is all spurious, you might look around in the records of the internet back in the 1990s when MS was first supplying systems with internet access. There are multiple reports of people getting curious about why their modem's lights were flickering when the machine was idle. Attaching a line monitor showed that the traffic was a list of the contents of the disk, being sent to a .microsoft.com address. The server on the other end could obviously also ask for the contents of files. This was ignored by the media and most managers, but it was noticed by the geeks among us with even minimal understanding of network security. Similar behavior has been reported for most releases of Windows.
This all has obvious application to HIPAA rules. My wife has worked with medical data for several decades now, at several employers. Every one of them worked exclusively on Windows systems. She has a Windows partition on her Mac "for work", and uses it a lot. She also has a work-supplied take-home Windows laptop. It's true that they use VPN to connect to the office computer systems. But this does nothing for the above issues. Since her Windows partition and laptop are connected to our home network, VPN just supplies an internet connection to her office machines, so their "silent upgrade" feature can work any time she's connected. This shoots down any claims that her office is protected from malicious sites (such as microsoft's ;-) by VPN. We've verified that both her Windows systems can easily access .microsoft.com web sites while connected via VPN, showing that there is a data path for MS's silent update software to work.
This is hardly a secret. We've discussed it here on /., and it's been discussed in lots of other forums. Microsoft has a clear and obvious silent path to any medical data stored on their systems, any time they have an internet connection, which is almost all medical systems in the US. Anyone who can bribe the right people at MS also has such access.
So the fact that HIPAA rules don't forbid the use of MS Windows makes those rules a joke. I'd bet that many medical records people understand all this. It should be no surprise that they treat HIPAA data security as a joke.
Oh, that's actually pretty simple. Block Microsoft's sites via firewall rules (not on a per-machine basis, that would be silly, but at the point of entry). You can still have machines outside of the network download all the security updates that a machine might need, put them on a DVD, and make that available to the workstations (via IT reps or whatever), but this way you control the flow of data.
It's interesting to consider non-MS systems in this light. Fully open-source systems are probably immune to such problems, since they'd be exposed fairly quickly. Apple systems are about half open-source, but most of the kernel and the UI have hidden source. Apple systems haven't been documented to have any behavior like those described above, so there's a good chance that such backdoors don't exist on Macs. But we can't prove this, because we aren't permitted access to the low-level source. Macs apparently don't do silent updates, but we can't prove that, either. Is there a way to either expose such backdoors or prove they don't exist on Macs?
Sure. Route
Re: (Score:2)
Sounds like... (Score:2)
Re: (Score:2)
Correct. Government: "We have all the time and manpower we need. After all we're paid by...*drumroll*... YOU!"
I pity the fool who doesn't understand this.
A lot of good it's going to do (Score:2)
All they'll do is pass the cost to patients. If you want the law to have teeth, you threaten to throw their officers' sorry asses into pound-me-in-the-ass prison. That'll get their undivided attention and obedience.