Hacker News Reader

Comment by craigyk | Hacker News Reader

Yes, at least in medical settings, I think it's just as much about accountability and CYA than actually improving overall real-world security. If that person's action results in a leak than they can be personally sued and fined. Doesn't matter if they did it out of frustration with obstacles that made it very difficult to "get stuff done".

View on HN

> Yes, at least in medical settings, I think it's just as much about accountability and CYA than actually improving overall real-world security.

I don't think your wrong, but an awful lot of system admins have ended up dealing with lawyers and courts. Your system admin having had a prior talk with the lawyers about security, HIPA, and who is liable will do wonders for their willingness to bend the rules for you.

Totally agree with all of the above - when sysadmins end up in court it isn't usually due to HIPAA itself.

According to both HIPAA and the major revisions in the American Reinvestment Act (aka Hurricane Sandy Bill), all HIPAA requires is non-cleartext data. It does not recommend or even define a cipher or crypto standard anywhere in the legislation. Legally speaking (IANAL), a zip file with password is fine according to HIPAA since it's non-cleartext.

So when those admins were in court it is usually due breach of contract (job spec says protect data, follow laws, etc.), heavy-handed tech illiterate lawyers, complete incompetence in hiring the sysadmin, or some other combination of madness - and not directly due to violation of Federal healthcare law.

Reply on news.ycombinator.com