• 2 Posts
  • 56 Comments
Joined 2 years ago
cake
Cake day: June 5th, 2023

help-circle














  • You’re right to point out the problem. Using a rhetorical tone was a bit sarcastic / condescending, so I mirrored it.

    I think it’s a question of perspective. Your doctor faxing something to a pharmacy or specialist is archaic at this point, and I agree it’s not great. If they are using FOIP and not POTS, one would hope it’s encrypted with TLS or something (if it’s not, it’s possibly a HIPAA violation if there’s PHI in the FAX). But the blast radius is pretty small.

    I suppose if a hacker compromised a hospital system’s FOIP they could harvest a lot of medical records that way. But at that point, they are already in and they’d likely be more interested in fatter & juicier targets on the network. Bigger datasets with less effort (versus pulling from a trickle of FAXes going in and out).

    Bottom line: yes, FAX is dumb, and it’s a problem but it’s very small compared to other things.



  • Having permission to access to the HIPAA-protected dataset is only the first hurdle. You also need a medically valid or claim processing reason to look at individual patient records within that dataset. People have gotten into trouble by not respecting this. Doctors and other providers are not going to just poke around in the data for fun. Too little to gain for too much risk.

    HIPAA is far from perfect, but it does do a decent job of protecting data at rest and in transit. If a bad actor like a hacker manages to get a copy of it, the sensitive stuff will be encrypted.

    We handle HIPAA data at my job, and we all take it very seriously. There’s annual training required, and a reporting process for violations. Nobody is looking at anything unless they really need to.

    Large corporate health insurance providers are another problem. They of course do have access to it, and I am sure they abuse the privilege for data mining and scheming on claims denial strategies and so on. But that’s a political and enforcement issue not an issue with HIPAA itself. They are violating HIPAA and getting away with it because they are a powerful lobby.