Sending medical images to Microsoft seems like a major HIPAA violation.
Without sounding to condescending: Bro... this entire Industry still relies on using fax or snailmail for records. Using slow, leaky, non-private/seure channels for sensitive information is not as much of a concern to this field than one thinks if you've been in the belly of the beast.
Ask anyone who has spent anytime doing IT work at a hospital, or better yet a disgruntled nurse who works the counter after a 12 hour shift.
You ever try requesting an MRI in the US?
After needing several during COVID and being turned a way and having lots of time on my hands I've actually learned a hack to get it the same week (or in my case the same day recently) now that we're out of the pandemic because I knew who to press for a physical paper trail and get it submitted (via fax) and have it approved by all parties: it cost me a day off of work, and tons of leg work on the phone but it was done and I literately didn't care so long as it was done and prove my method was sound. I got it done after business hours, too!
I'm starting to think that the issue with it being so archaic is not because a better solution doesn't exist, but because it's made this way in order for them to justify the long delays in procedures and increase membership duration on their policies and they use things like HIPPA and other acts to justify the lengthy process and obscene amounts of money needed to be able to modify the way things are done, which is why software people just move on and the same mediocrity continues to the detriment of us all.
Yep. My current employer, as well as the two prior to this one, all have and use fax machines despite being tech companies. Not because they want to, but because so many other companies out there still require it.
>They are so fast(no they arent, something can be ahead of them)
>They are safe compared to email(literally anyone can walk by the fax and take it)
>They are faster than a phone call, because doctors don't pick up the phone. (What...)
You can mention the US government has ultra high security communication that uses the internet, you can mention the value of finance information, you can talk about the secrets your billion dollar company sends over email/web. But noooo, patient information is too sensitive and urgent to be sent over email/web....
All 3 still work in the medical field to this day, one of them is a doctor...
I imagine this is a huge issue in the medical field.
But that's vastly different (though perhaps more invasive) than massive breaches like these: https://www.healthcaredive.com/news/cybersecurity-hacking-he...
When an employee snoops, you will never know.
HIPAA has all of these crazy rules for anything digital, but the second you switch to good ol’ telephony the rules all become “there’s no rule because hacking a telephony system would be a federal crime.” I’m not joking. Telephony is considered a “mere conduit” while the internet is not.
It really is stupid. HIPAA has all of these controls, but phones are just fair game.
I think you've been brainwashed by modern storage services (S3) where the URL is essentially always public and out of your control. It's trivial to password protect an image when it's on your server. I would assume any medical provider would protect their images by checking the session and not serve them via AWS.
We need to move away from this model where others are in control of our private data to one where it's owned and controlled by us, giving access to service providers as needed.
...unless there's a fence around it.
A lot of the nonsense around shredding hard drives is just the drive industry convincing people that they need to destroy perfectly good devices.
Unless you're facing state-level actors a simple zero-out or pipe from /dev/random will suffice. Or with a lot of modern drives where the data on the platter is encrypted by default, just send the "secure erase" command, causing the drive to roll over the controller's private key.
Unless you're willing to prove beyond a shadow of a doubt that each and every such hard drive does not in any shape or form contain sensitive information and pay hefty fines and jail time when you inevitably fail, the only nonsense here is you. It has been proven time and time again that data once written can be and will be recovered.
Any storage media that contains or contained sensitive information must be physically destroyed. That is the only surefire, foolproof way that we currently know of to securely and permanently delete sensitive information.
I'm not sure which part of "HIPAA says you can take an UNENCRYPTED hard drive and toss it in a dumpster provided it has a fence around it" you didn't understand.
> Any storage media that contains or contained sensitive information must be physically destroyed.
Not for federal data:
https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.s...
Not for classified defense department data:
https://www.dami.army.pentagon.mil/site/IndustSec/docs/DoD%2...
...and as previously mentioned: not for PII healthcare data.
The bit about "you can only be SURE if you destroy it" is pure hard drive manufacturer nonsense.
Find me a single case where someone has recovered data from a non-solid state (hybrid or otherwise) drive or tape that has undergone a SMART secure erase or NIST / DoD compliant wipe.
In decades, I have never heard of such an incident.
Now lets get purely logical. There is a non-zero chance of risk, and the best risk avoidance strategy is to not take the risk in the first place, so shred the drive.
So lets make a software, that would secure erase the drive and try to recover the data, and prove that you are not actually an elephant. But why?
Make a lot of money instead? Make a hard drive with a secure erase feature, and yes I know, but like put a spin on it, maybe a button, or better yet, you secure erase the drive backed by an industry grade non-recoverability warranty for a cheap $10/yr./drive subscription access to our secure erase service. We come to you next day, give a certificate and everything, you can put it in your HIPAA folder and show it to your risk committee.
Your market? Health care, gov, and problems that solely exist in between the keyboard and the screen.
Bonus points if You had a spot welder to secure a nut to the bolt.
Fun times.
Sharing the URL is equivalent to sharing the image in these cases.
medical-intranet.example.com/uploads/secure_link/adc83b19e793491b1c6ea0fd8b46cd9f32e592fc/john_doe_1987-04-23_chlamydia_1.jpg
<img src="https://siteunderattack.com/api/computationally-expensive-function/?image=cute_bunnies_####.jpg"/>
<img src="https://siteunderattack.com/api/function123/?name=Robert'); DROP TABLE students;--&image=cute_bunnies_####.jpg"/>It might be PII. It might be sensitive. But if it's not both of those, it's not HIPAA protected.
If you think about medical textbooks where there are pictures of patients and their maladies, but they are not identified this makes sense why both are required. Otherwise educating new doctors would be impossible.