Dude, you'd be surprised how much data your average company leaks in logging.
Ask any HIPPA compliant company how they scrub their logs from errors that include medical data and you'll truly see how bad things are.
Ask any HIPPA compliant company how they scrub their logs from errors that include medical data and you'll truly see how bad things are.
Fwiw none of this is necessarily a breach of hipaa laws.
I've never dealt with medical data, but do deal with credit card data so have to deal with PCI. With credit card data we run into customers who send emails, or use online chat, or leave voice mails telling us they have a new card and giving the number. We never ask for them to do this, and indeed everything we tell them says never to send us a credit card by such means, but they do it anyway.
That brings all those systems into scope for PCI, which is a pain in the ass.
We use helpdesk and support chat software licensed from a third party. We had to write scripts that understand its DB schema and data formats and can find and remove credit card information, and keep them up to date as the helpdesk and chat software is updated.
A few years ago, the vendor tried to discontinue the stand-alone version and move its users to their cloud service version, but had to drop that plan when they found out that a lot of their customers were doing the same thing we were, and absolutely could not move to a cloud service unless that cloud service handled PCI issues. Apparently they didn't want to deal with making their cloud service handle that, and there had been no talk since then of dropping the stand alone version.
Do people dealing with HIPPA run into similar issues?