Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

cs.dartmouth.edu

Post reply on HN
Print view View original

21–30 of 61 posts

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#21

Post by citelao »

jalapenos wrote: post #16

Have had some level of security farce, like described in this paper, in every org I've ever been in. The root cause is failing to hold security staff to a dual mandate: keeping the bad guys out AND keeping the good guys in. Because they don't get held to account for obstructing everyone else's work, they naturally do every ass-covering piece of security theatre they can - they don't suffer any consequences. The momen…

There’s actually published evidence of exactly that!

Where Do Security Policies Come From found that the websites with the most aggressive policies were those with the least incentive to make the system easy-to-use. Big sites like Facebook and Paypal somehow manage to be safe without the strict password requirements of . Likely because they have financial incentive to make their systems easy-to-use.

https://www.microsoft.com/en-us/research/wp-content/uploads/...

(Disclaimer: I know one of the authors)

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#22

Post by olliej »

Ah yes, the classic problems:

* log in/out take an unreasonable amount of time

* password rotation despite that being demonstrably worse for security across every metric

Followed up with some domain specifics:

* Failing to acknowledge a single system or device may be shared rapidly among many different users

* Delaying access due to excessive authentication steps can kill people

* Not understanding that a "quick action" is not quick if it requires another action that is not quick (surgery prep is not a 5 second task people)

The first set are inexcusable in any environment, especially password rotation, the latter just requires the people coming up with security policies to actually spend time in the environment their policies will apply.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#23

Post by Danjoe4 »

All healthcare employees have badges they carry everywhere. Just get new ones with chips in them and an associated pin. Add the card scanner dongles for the computers. Access to rooms and supplies that don't need tight security is simply a card tap. Require the pin as well for more important stuff (computer login). Require a biometric as well for really important stuff.

Make sure employees know they must report lost/stolen cards within 1 hour or they will be fired.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#24

Post by akira2501 »

gustavus wrote: post #6

It really seems to me that at least for healthcare the solution is just to go back to paper and then just take the paper and do data entry on it after it's out of the workflow on a daily or bidaily basis or something. Honestly I'm also going to go out on a limb and guess that if most of the EHR portals screens were replaced with flat org files things would also work better.

The "paper security model" leaves quite a bit to be desired and has a lot of efficiency issues itself, but parts of it carried into an EMR wouldn't be terrible.

You might have a terminal that allows anyone to use it if an employee credential/bade is within a certain proximity of the device. You might setup terminals in access controlled areas don't even need this measure of security and are always logged in and available.

Automatic logoff might only happen if an actual security alert is issued for that floor or section. Then you might have a manager who can reopen specific terminals or wait for the security situation to end and have the terminals automatically reopen.

Then all you might need is the terminal to do constant "auditing" of user actions. It could take photographs and do facial recognition of hospital staff when a patient record or action is requested, it could alert internal IT when terminals or staff on one floor access patient information outside of their purview, it could record credential information from RFID badges near the terminal, it could store all this information in a log attached to the record and available to the internal audit team.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#25

Post by toomuchtodo »

gustavus wrote: post #20
toomuchtodo wrote: post #5

Earlier quoted context omitted.

Smartcard + faceid?

What if I misplaced my smart card what if I'm wearing mask or surgical hat.

I’ve seen rfid bracelets used for use cases where face and fingerprints are inaccessible, similar to contactless payments. Silicone straps for comfort.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#26

Post by youainti »

cfu28 wrote: post #12
Johnny555 wrote: post #8

Earlier quoted context omitted.

I thought the whole promise of electronic records was to avoid transcription errors -- if the doctor enters it into the record himself, there's less chance of someone misreading or mistyping his notes later.

I don’t have the source on hand, but during my clinical informatics rotation it was mentioned that many early EMR implementations actually increased drug errors

I wonder if that was a true rate change or a change in detection.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#27

Post by expertentipp »

jalapenos wrote: post #16

Have had some level of security farce, like described in this paper, in every org I've ever been in. The root cause is failing to hold security staff to a dual mandate: keeping the bad guys out AND keeping the good guys in. Because they don't get held to account for obstructing everyone else's work, they naturally do every ass-covering piece of security theatre they can - they don't suffer any consequences. The momen…

> keeping the bad guys out AND keeping the good guys in.

YES

> Because they don't get held to account for obstructing everyone else's work, they naturally do every ass-covering piece of security theatre they can - they don't suffer any consequences.

Every time you push back on some ridiculous policy they'll respond with ironic smirk or shrug (are you seriously forcing password change monthly and keeping hashes of the last 10 passwords?!). Nowadays basically every corporate security policy forces employees to install some kind of crappy DUO/whatever (FUCK YOU CISCO) app on a private phone, work phone is a rare occurence nowadays ("everyone have their own smartphone anyway"). It's never a TOTP which somehow works perfectly fine on many other crucial services. One might think we're all competent tech folks, but they're vicious malicious cunts.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#28

Post by Aeolun »

Danjoe4 wrote: post #23

All healthcare employees have badges they carry everywhere. Just get new ones with chips in them and an associated pin. Add the card scanner dongles for the computers. Access to rooms and supplies that don't need tight security is simply a card tap. Require the pin as well for more important stuff (computer login). Require a biometric as well for really important stuff. Make sure employees know they must report lost/…

Now you’ll have a bunch of scanners with the cards permanently on top, doors with a card hanging from the handle, and somehow all your staff is fired.

Mission accomplished?

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#29

Post by Aeolun »

cfu28 wrote: post #12
Johnny555 wrote: post #8

Earlier quoted context omitted.

I thought the whole promise of electronic records was to avoid transcription errors -- if the doctor enters it into the record himself, there's less chance of someone misreading or mistyping his notes later.

I don’t have the source on hand, but during my clinical informatics rotation it was mentioned that many early EMR implementations actually increased drug errors

Seeing my clinician fight the EMR to figure out what the stupid drug was called certainly didn’t help my impression of EMR systems anyway.

Re: Workarounds to Computer Access in Healthcare: Password or a Dead Patient? (2015)

#30

Post by Aeolun »

olliej wrote: post #22

Ah yes, the classic problems: * log in/out take an unreasonable amount of time * password rotation despite that being demonstrably worse for security across every metric Followed up with some domain specifics: * Failing to acknowledge a single system or device may be shared rapidly among many different users * Delaying access due to excessive authentication steps can kill people * Not understanding that a "quick acti…

I feel like the problem with security is the same as with HR. They’re so specialized they often have no other work, so spending a bunch of time on pointless policies just makes their job more secure for them.
Post reply on HN