In the US, this would be a HIPAA violation but I'm not sure of the Canadian law. We still use pages at my hospital, but no PHI, only room numbers in the ER for admissions are paged and then you log into the EMR. We use HIPAA compliant texting apps to communicate PHI.
I think aspects of it could definitely be improved. I see HIPAA violations at doctor's offices all the time - but they are usually still fairly minor, and doctors and nurses grow concerned quickly as soon as you mention a possible violation.
One cool thing I remember is that the phone lines within the building had to be in armored cable, so they couldn’t be tapped without leaving a huge mess.
https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/ad...
To tackle the problem HIPPA tries to solve, that is making sure that data sharing is secure and only with the intended parties, I want to see stronger enforcement of liability. Granted, the US doesn't have a great track record on that, seeing Equifax get away with what their doing. But I think that's the system that needs to be improved.
Instead of government dictating what "secure" means, different approaches can be experimented with on the market with strong enforcement of liability providing the necessary incentives.
Then Facebook would become a Business Associate and would have to protect information in a variety of very strict ways and could face a fine of up to $10,000 per patient record, per violation. If they had 25 million health records and decided to target advertising to those people on two separate occasions, then they are liable for a fine of up to $500 billion. So sure, let Facebook get into health, it wouldn’t take long for them to run afoul of the law given their move-fast-break-things attitude.
It’s very likely your aren’t seeing actual violations. These “violations” are likely considered incidental uses and disclosures. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...
The idea that whispering in the waiting room was an important attack vector while whitelisting us IT people is hilarious. (For lack of a better adjective.)
For a middle ground example:
My SO did clinical trials at the local research hospital. She went to ANOTHER hospital for some surgery, because she knows her coworkers look up people's records, and she didn't want them knowing about her troubles.
Like the systems I created, of course there were access logs. But like our systems, no one ever reviewed or audited them.
Hopefully things have gotten better.
I worked on some exchanges in the mid-2000s. 5 exchanges, 80 orgs, 100s of data feeds, including govts.
We had to do HIPAA "training" every year. It was just corporate CYA.
Those of us working on the systems resigned ourselves to the fact that disclosures were inevitable. Even if we could technically secure stuff (encrypt all data at rest, PKI for all access, RBAC, audits, etc), we'd never be able to get all our partners up to speed.