Hacker News Reader

Comment by paulcole | Hacker News Reader

HIPAA is absolutely to be trifled with. Look up who is actually fined and face actual consequences from HIPAA violations. It is 99.99% big universities, hospitals, and insurance companies. Everyone else gets (at most) a slap on the wrist and has to promise not to do it again. Once in a while they’ll fine a small family practitioner $25k for not shredding papers properly but it’s a total joke.

HIPAA Compliance Services are something for consultants to sell so business owners can sleep at night. It’s like Lisa’s magic rock on the Simpsons that keeps tigers away. Does it work? I don’t see any tigers around here do you?

View on HN

Seconded. I’m a physician that got so pissed off at how a practice was repeatedly and willfully violating HIPAA that I risked my standing in the local physician community and reported them.

I was basically told by the case manager, or whatever they call themselves, to fuck off.

When I worked at an MSP, we supported a small dermatologist's office. Everyone had personal computer accounts but everyone had a password of '1234' so...yeah.

Preach it. Reported my own psychiatrist for having a bunch of highly sensitive "followup" forms asking about medication, emotional state, etc. (and including patient name, address, other PII) on the practice website that transfered data over plaintext to a shared hosting server running PHP5 in debug mode that had been hacked by an automated script and was redirecting people on first visit from a fresh IP to a "Congrats! You're our 1000000th visitor" spam site. Haven't heard from OCR in over a year.

¯\_(ツ)_/¯

Agreed. The organization would likely get fined for a breach, not the engineer. I work a senior IT role in Healthcare and I've seen what breaches look like. I've never even heard of someone going to prison, let alone for what this story tells.

Yeah to go to prison you have to really screw up, in a way that is malicious and willful. Though the CEO driving over to his MLM buddy with a thumbdrive of PHI might do it.

Do you know what the actual risk is here?

Personally, I wouldn't stake my future on hoping the government doesn't notice what my hypothetical law-breaking company is doing. Or that my law-breaking unethical CEO won't lie and try to throw me under the bus if/when the company eventually gets caught.

I'll restate that I recommend OP talk to a knowledgeable lawyer to get an informed assessment of what kind of risks he/she is undertaking.

I understand the difference between odds and risk. The risk is high (assuming you use the harshest possible penalties) but the odds are infinitesimally long.

Google and find who has actually faced penalties from HIPAA violations and what those penalties were. How many serious fines/prison sentences have been handed down? Who was at fault? Were they random no-name startups?

Reply on news.ycombinator.com