Hacker News Reader

Comment by craftyguy | Hacker News Reader

Does HIPAA motivate hospitals to take security seriously? The recent outbreaks in cryto-ransomware seem to suggest the answer is 'no.'

View on HN

Having experience with hospital IT working for an outside vendor before HIPAA had much impacted practice (though after it was adopted), yes, I think it's made them take it much more seriously. That's not to say it's good now, but if you hadn't experienced it you probably can't imagine how bad it used to be.

They take HIPAA seriously (because there are fines), but that is definitely not the same thing as taking security seriously.

That's a big thing that many don't seem to understand: there is a massive gulf between compliance and security.

Yes--HIPAA provides a mechanism for fines to be levied against (most) healthcare organizations that suffer data breaches through the office of civil rights (OCR), with a public reporting of organizations that have been penalized.

https://www.hhs.gov/hipaa/for-professionals/compliance-enfor...

> Yes--HIPAA provides a mechanism for fines to be levied against (most) healthcare organizations that suffer data breaches through the office of civil rights (OCR), with a public reporting of organizations that have been penalized.

Unfortunately, HIPAA is an incredibly rigid, incredibly broad law, and it's applied to a field in which security practices are incredibly inconsistent.

As a result, HIPAA violations are pretty commonplace, and the vast majority are never reported to HHS, let alone penalized.

Reply on news.ycombinator.com