Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A billion medical images are exposed online

techcrunch.com

Post reply on HN
Print view View original

191–200 of 201 posts

Re: A billion medical images are exposed online

#191

Post by thomasfedb »

wolco wrote: post #125
hhas01 wrote: post #119

Earlier quoted context omitted.

Growing complexity. Struggling scalability. Overspecialization. Balkanization. Failures of accountability. OP’s firsthand observation on the awful state of programmer-produced medical software, the original linked article, and notoriously lethal software disasters such as Therac-25 provide frightening cases in point. These things are not accidents. Programmers who only know how to program are as much use as managers…

I've never seen a programmer produced medical system. Do you realize these systems are designed by respected doctors and product managers? They tell the programmers exactly what to do. When something vague comes up the product manager talks to his stakeholders and decides how to proceed. When the project is done the doctor/project manager group go over everything and make changes. They decide things like how it looks…

This is an interesting point.

In fact the few medical IT systems I've seen that were actually built by doctors - that meaning doctors who code actually coded these systems themselves - are among the nicest (and most easy to use in a non-insane, secure, reasonable way) systems I've seen.

I think the important difference here is that it's very hard to "design" software if you are a doctor who knows a lot about medicine, and your existing paper processes, but know very little about software. It is important to understand the medium (software) as well as the domain (medicine) to build the right product.

Re: A billion medical images are exposed online

#192

Post by OnlineGladiator »

hhas01 wrote: post #170
wolco wrote: post #125

Earlier quoted context omitted.

I've never seen a programmer produced medical system. Do you realize these systems are designed by respected doctors and product managers? They tell the programmers exactly what to do. When something vague comes up the product manager talks to his stakeholders and decides how to proceed. When the project is done the doctor/project manager group go over everything and make changes. They decide things like how it looks…

“Do you realize these systems are designed by respected doctors and product managers? They tell the programmers exactly what to do.” And here, in a nutshell, is EVERYTHING wrong in modern software development. Doctors are NOT programmers. If they were, they wouldn’t need to hire programmers: they’d write the solution themselves! Doctors are the domain experts. They understand medicine, and procedures in its current p…

> And, it pains me to say, software development is the first (and still only) career in my half-century of life where I’ve NOT felt crippled with Impostor Syndrome. Because the impostor, I realized, was everyone else.

Can you expand on this?

Re: A billion medical images are exposed online

#193

Post by ryanlol »

ethbro wrote: post #140
ryanlol wrote: post #124

Earlier quoted context omitted.

> I keep telling the IT people at my hospital to stop using SMS 2-factor and they blow me off and treat me like an idiot. Well... yeah. Nobody is sim swapping hospital staff. It’s not great, but this isn’t a real threat they’re facing.

You'd be surprised how much money flows through the medical system. And how much of that flows through automated systems. And how little of the total is actually audited on a detailed level.

>You'd be surprised how much money flows through the medical system

I wouldn’t, I just know that the crowd targeting hospitals for wire fraud is very different from the sim swappers.

It’s possible that this may change at some point, but that hasn’t happened yet and probably isn’t going to. Phishing is so easy and successful that SIM swapping just doesn’t make sense for these targets.

Re: A billion medical images are exposed online

#194

Post by brianwawok »

1996 wrote: post #107
brianwawok wrote: post #78

Earlier quoted context omitted.

I mean, for every hour I spend writing production code - I spend an hour in agile meetings, and 2 hours chasing down obscure bugs in javascript libraries. Not that many professions are "do visible part of work 100%". Heck, I hear bricklayers need to spend some time mixing cement and getting bricks off the truck, not just scooping mud and sticking bricks. Health records ARE a big part of the product of a doctor. Keepi…

> Health records ARE a big part of the product of a doctor I long for practices that would keep no record of my issues, except what I volunteer to them at the beginning of the consult. Many countries do that just fine, but for some reason in the US I am asked to fill pages on insignificant trivia to cover their ass or follow some weird law or tradition maybe? I don't want perfect healthcare. Good enough is fine! So n…

Hum. So much about healthcare is about trends. How your blood pressure is today vs a month ago matters a lot more than holding up your number to a chart. Having actual good medical history would be super helpful.

Re: A billion medical images are exposed online

#195

Post by brianwawok »

egocodedinsol wrote: post #121
brianwawok wrote: post #78

Earlier quoted context omitted.

I mean, for every hour I spend writing production code - I spend an hour in agile meetings, and 2 hours chasing down obscure bugs in javascript libraries. Not that many professions are "do visible part of work 100%". Heck, I hear bricklayers need to spend some time mixing cement and getting bricks off the truck, not just scooping mud and sticking bricks. Health records ARE a big part of the product of a doctor. Keepi…

Your analogies would make more sense if you spent 2 hours on documentation for every hour you spent coding or bug finding.

If that documentation includes user manuals, sign me up!

A mostly functional program with amazing docs beats a more functional black box.

Re: A billion medical images are exposed online

#196

Post by TurkishPoptart »

thomasfedb wrote: post #53
endorphone wrote: post #38

Earlier quoted context omitted.

This seems like a caricature or an exception. Doctors are very aware of HIPAA (and the equivalent in every other country), and the professional and monetary costs of non-compliance. Doctors didn't set up these systems. Doctors didn't expose them to the internet. As the other post said, vendors did. If those vendors couldn't properly communicate the needs, that's their problem. What I think is a more rational explanat…

I'm a student doctor with a CS undergrad. I'm constantly gobsmacked by how horrible the computer systems doctors are forced to use are. They're pretty much abusive to use. The hours and hours of physician time that are thrown away into mindless box-ticking, copy-pasting, button-pushing, and general head-banging is astounding. If doctors are resistant to new IT hurdles it is, at least in part, because they're already…

does this have anything to do with Epic systems software, in your opinion?

Re: A billion medical images are exposed online

#197

Post by moviuro »

arminiusreturns wrote: post #189
dopamean wrote: post #180

Earlier quoted context omitted.

From the man page -L, --location (HTTP) If the server reports that the requested page has moved to a different location (indicated with a Location: header and a 3XX response code), this option will make curl redo the request on the new place. If used together with -i, --include or -I, --head, headers from all requested pages will be shown. When authentication is used, curl only sends its credentials to the initial ho…

I read the man page and I understand what -L does, but I still don't understand why the -L is needed in this particular case when the request works ok without it. Is the user only wanting to curl from the original page and any redirects are considered bad?, etc.

When I tried to open the page on my machine (with chrome) it failed on a host I don't know (advertising.com). So I tried to see what happened: `curl -L` allows me to do that.

And yes, this kind of half-assed redirect is breaking, and a total disregard for my trying to trust the original host. This kind of behavior I expect from sites victim of an XSS, not a "normal" website.

Re: A billion medical images are exposed online

#198

Post by hhas01 »

thomasfedb wrote: post #191
wolco wrote: post #125

Earlier quoted context omitted.

I've never seen a programmer produced medical system. Do you realize these systems are designed by respected doctors and product managers? They tell the programmers exactly what to do. When something vague comes up the product manager talks to his stakeholders and decides how to proceed. When the project is done the doctor/project manager group go over everything and make changes. They decide things like how it looks…

This is an interesting point. In fact the few medical IT systems I've seen that were actually built by doctors - that meaning doctors who code actually coded these systems themselves - are among the nicest (and most easy to use in a non-insane, secure, reasonable way) systems I've seen. I think the important difference here is that it's very hard to "design" software if you are a doctor who knows a lot about medicine…

Yup. In an ideal world, all systems would be built by domain experts who are trained to program.

I cut my teeth as a self-taught scripter/automator before going professional and eventually becoming a writer/educator myself, so I’ve seen plenty of every combination (and produced all of them too;). And I would much rather teach professional doctors how to make their own solutions than teach professional programmers how to write software for doctors. Because one of these audiences has a massive self-interest in getting a product that also works for themselves, while the other satisfied in taking a paycheck while ticking some boxes†.

That is to say; Incentivization is Everything.

--

† Which is not to say you don’t need—and want—formally-educated full-time developers in the mix as well; because good ones bring important transferable experience and insight into the more abstract aspects of system development like scalability and security. And yes, there are great devs out there who understand it is Muhammad’s job to go to the mountain, and not vice-versa. But damn, is it hard to find ’em.

Re: A billion medical images are exposed online

#199

Post by 1996 »

brianwawok wrote: post #194
1996 wrote: post #107

Earlier quoted context omitted.

> Health records ARE a big part of the product of a doctor I long for practices that would keep no record of my issues, except what I volunteer to them at the beginning of the consult. Many countries do that just fine, but for some reason in the US I am asked to fill pages on insignificant trivia to cover their ass or follow some weird law or tradition maybe? I don't want perfect healthcare. Good enough is fine! So n…

Hum. So much about healthcare is about trends. How your blood pressure is today vs a month ago matters a lot more than holding up your number to a chart. Having actual good medical history would be super helpful.

Then I will keep the records, or my smart watch or smart phone.

Re: A billion medical images are exposed online

#200

Post by ageyfman »

toomuchtodo wrote: post #136
ageyfman wrote: post #130

In 2009 I was building an enterprise medical imaging SaaS for hospitals, and we would constantly come across hospital IT admins who were adamantly against trusting a cloud vendor with their sensitive healthcare data - even one that's audited, security-checked and whose sole responsibility is to take care of these images. We always thought it was a joke that these guys questioned us, when we knew how bad their interna…

Lots of open S3 buckets full of critical data not helping the counter argument. Security is hard, proving you’re secure to others more so. How do I know you’re not just storing my data in S3, abstracting away the mechanism, but your bucket policy or acls are garbage? I don’t. Cloud does not immediately mean more secure.

The point I was making isn't that the cloud is naturally more secure, it's that the company was 100% focused on medical imaging, not the 1000 projects a typical network/system admin at a hospital has to juggle.
Post reply on HN