Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hospitals are a weak spot in U.S. cybersecurity

axios.com

Post reply on HN
Print view View original

141–150 of 166 posts

Re: Hospitals are a weak spot in U.S. cybersecurity

#141

Post by specialist »

wdb wrote: post #62
burnte wrote: post #47

Healthcare CIO here. This is true. Healthcare is still using paper fax. It has a 30 year old data interchange format that no one really supports because it's more profitable to lock in customers to your EMR. Healthcare is HORRIBLE about upgrading anything, at changing processes, and technological progress in general. Healthcare is VERY backwards from a tech standpoint. Another problem is that EVERYTHING is custom, we…

There are new data exchange protocols/formats which help to exchange between parties. They have been defined 2000+ so they are quite modern. The only problem is that is such a diverse way the healthcare providers are implementing it. So you end up having provider specific code :)

True.

My ETL work in healthcare finally pushed me to treat the problem as screen scrapping. Bypassing all the attempts at formality, eg XSD.

The next step, which I prototyped but was put into purgatory by being acquired, was to simply capture all the data and use text retrieval tools, eg Lucene. Versus ingesting the data, normalizing it (to some schema) and populating database(s). Basically, postponing the translation/transformation of client data until viewing. Because, as you hinted, everyone does stuff differently, and clients generally have no idea what their data looks like until we showed them.

The proper solution would be to have direct access to source data, versus data feeds, but that ain't gonna happen until we have single payer, because the current incentive structure strongly discourages such simplicity.

Re: Hospitals are a weak spot in U.S. cybersecurity

#142

Post by delfinom »

burnte wrote: post #47

Healthcare CIO here. This is true. Healthcare is still using paper fax. It has a 30 year old data interchange format that no one really supports because it's more profitable to lock in customers to your EMR. Healthcare is HORRIBLE about upgrading anything, at changing processes, and technological progress in general. Healthcare is VERY backwards from a tech standpoint. Another problem is that EVERYTHING is custom, we…

>we use very, very few off the shelf solutions.

Even off the shelf is no solution really. Everything is proprietary, you get locked in and years later the vendor isn't maintaining shit and moving away becomes an blackhole of a cost sink.

>It's INCREDIBLY common for nurses and doctors to need to have administrator access on their Windows desktops for various apps.

Honestly, needing admin on a "user network" device isn't the worst. You can still run malware that attacks the network via non-admin context :/ The best move is to use AppLocker if it's critical.

Re: Hospitals are a weak spot in U.S. cybersecurity

#143

Post by delfinom »

Mountain_Skies wrote: post #74
save_ferris wrote: post #34

Earlier quoted context omitted.

What were the hazards that you saw? Just curious

It's been over a year but I seem to recall potential exposure to radiation, infectious disease, and chemicals being on the list. It was quite long. I'm guessing the legal department added it for all positions in the hospital.

Yea that's just lawyer cya speak.

Re: Hospitals are a weak spot in U.S. cybersecurity

#144

Post by XaspR8d »

analog31 wrote: post #82
keithnz wrote: post #71

Earlier quoted context omitted.

Fax is odd, it was a fantastic thing when it first came about, and it has some desirable properties. - It's direct point to point communication (over a network) - The transport network is dedicated and not open to anyone and covered by quite strong laws in many countries - It's easy to see the history of communications - It's easy to see if the other end successfully received something - It's relatively standardized…

- It's easy to see if the other end successfully received something I think this is a biggie. It means your workflow doesn't need to include going back later and checking to see if your document was received, and then trying to send it some different way. You don't have to guess which way the recipient is capable of receiving a message. It's the original e-mail. ;-)

Except seeing it was digitally received is often quite insufficient to seeing it was received by a human it was intended for. All too often in dealing with healthcare and gov't orgs our faxes get lost with no way of identifying where they went. Presumably it is a mismanaged shared fax inbox where individuals are not actually being alerted to their messages...

Re: Hospitals are a weak spot in U.S. cybersecurity

#145

Post by ses1984 »

keithnz wrote: post #123
ses1984 wrote: post #113

Earlier quoted context omitted.

Some points seem contradictory. How do faxes have history that's easy to see, and if the other end successfully received, but it doesn't have delivery receipt like email?

not sure I'm understanding? But fax sends data via a protocol, it knows it has sent by virtue of the protocol completing. The fax can keep trying sending and it will keep track of those faxs that have gone through vs those that haven't. Email doesn't have delivery receipts....it's either done by bolting it on in clients or various hacks used by spamme....errr..email marketing systems.

Just because you get a receipt from the protocol doesn't mean it made it from the fax machine to the intended recipient. Folks who send faxes still regularly follow up with calls and emails, "just sent the fax did you get it?" and the answer is often "no, what fax?"

Re: Hospitals are a weak spot in U.S. cybersecurity

#146

Post by roywiggins »

btown wrote: post #135
roywiggins wrote: post #90

Earlier quoted context omitted.

Backend is all MUMPS. Frontend was for a long time coded in Visual Basic 6. VB6/MUMPS stack is... not ergonomic to code in. Epic is easy to hate (it's everywhere), and for good reason. However, the alternatives are not obviously better unless there's been some radical innovation. There are definitely systems designed for a particular piece of a hospital (ex, ER, or labs, etc) that are probably better than Epic is, bu…

Did anyone think to make languages that compile to those? I imagine that it would make an incredible amount of sense for Epic, at its scale, to write the equivalent of Typescript to reduce errors and improve productivity. Or do they just not have any sort of dev tools/research department?

They built their MUMPS IDE themselves, and their change tracking / bug management system. And effectively the database code is also entirely written by Epic- the business logic and database are both written in MUMPS and live side-by-side.

So they have quite a lot on their plate when it comes to tooling. When I was there, there was a truly horrible attempt at a DSL for code-generation that would build database querying code, but I found it both unwritable and unreadable.

Re: Hospitals are a weak spot in U.S. cybersecurity

#147

Post by tristor »

dmix wrote: post #122
tristor wrote: post #120

Earlier quoted context omitted.

Yep, and yet I’ve been able to successfully implement it in a 1 year project in a prior org (as part of a team obviously). HITRUST isn’t that bad, and it’s better than the alternative, which is HIPAA directly. I would best describe HIPAA as Vague, Fruitless, Bureaucratic, and Arbitrary. HITRUST is a huge improvement even if it’s not perfect.

Wasnt HIPAA not intended for security or privacy when it was originally developed? Merely as a standardized approach so various vendors could integrate easier. I could be mis-remembering this though.

Yes, that’s accurate. It is not prescriptive at all, but it does contain broad data security requirements. These are really the only legally mandated security requirements in healthcare. That said, HIPAA is more about establishing a legal and contractual framework for sharing data between providers and insurers and different providers.

Re: Hospitals are a weak spot in U.S. cybersecurity

#148

Post by dredmorbius »

gruez wrote: post #115
keithnz wrote: post #71

Earlier quoted context omitted.

Fax is odd, it was a fantastic thing when it first came about, and it has some desirable properties. - It's direct point to point communication (over a network) - The transport network is dedicated and not open to anyone and covered by quite strong laws in many countries - It's easy to see the history of communications - It's easy to see if the other end successfully received something - It's relatively standardized…

>- The transport network is dedicated and not open to anyone and covered by quite strong laws in many countries is it? what if the hospital is using a VOIP solution?

...when it first came about...

Re: Hospitals are a weak spot in U.S. cybersecurity

#149

Post by dredmorbius »

baroffoos wrote: post #119
xyst wrote: post #63

Earlier quoted context omitted.

To be honest, Google is the last company I want handling my health data. If you don't check the right boxes, it could end up being "anonymized", and sold off.

Google is very good at precisely controlling what happens to the data. You never hear about some huge leak where 1B google accounts had their whole data taken.

There have been two reported Google breaches, both small.

https://www.oag.ca.gov/privacy/databreach/list?field_sb24_or...

Curiously, the "data breach" for which Google+ was supposedly shut down ... is not listed.

Re: Hospitals are a weak spot in U.S. cybersecurity

#150

Post by [deleted] »

dodobirdlord wrote: post #76
Doodood wrote: post #45

Earlier quoted context omitted.

How so?

In the wake of discovery of attacks by China[0] and the NSA[1] Google has adopted a nation-state actor threat model and a siege mentality around data access and encryption. [0] https://en.wikipedia.org/wiki/Operation_Aurora [1] https://www.washingtonpost.com/world/national-security/nsa-i...

[deleted]
Post reply on HN