Comment by amatecha | Hacker News Reader

Comment by amatecha | Hacker News Reader

Parent Full thread

Oh yeah, this has actually been a bit of a controversy in Vancouver recently[0][1], including speculation that the problem may be national. Local hospitals have now removed diagnosis data from the transmissions, but apparently still broadcast everything else, including "patient name, age, gender marker, their attending doctor and room number" (as of Sept 2019)[2].

Vancouver Coastal Health claims they "have no information to suggest private patient information has been used in any malicious way", which is a very disingenuous statement to make, because there's no conceivable way for them to know who has received radio transmissions or made use of such data maliciously. To be frank, I find this pretty mind-blowing and it's disappointing that even in the face of press/public attention, it's not being remedied.

[0] https://openprivacy.ca/blog/2019/09/09/open-privacy-discover...

[1] https://www.ctvnews.ca/health/pager-systems-used-in-healthca...

[2] https://openprivacy.ca/blog/2019/09/26/pager-breach-update/

Sit outside that place with a 4G connected phone and just send it up to a website called VancouverCostalData.com and I bet you someone will care.

... and go to jail for stealing patient data and break HIPAA laws. Nice thought experiment, though.

They are broadcasting patient data. It’s not more stealing than me publishing in a web site CB conversations.

Then set up a mock-up site at https://10.3.42.8/, and just show a journalist on your laptop. Ask to remain anonymous, then switch off your web server and let them know that "it has since been taken down, but anybody else could make a new one".

That's their story. They can then go on to describe the actual issues, namely the plain-text broadcast that made your proof of concept possible, and state in all honesty that it'd be ten minutes work for a bad actor to set up another, similar, site – and less to just gather (and later sell) the private medical data. Plus, it's not wildly unethical! (Might still be illegal, though.) This is drawing attention to an issue that they're well aware of, and are doing nothing about, in a way that minimises public access to these medical records – one could argue it's positively ethical.

… Though, actually, it'd probably be better to do to somebody in charge first, since perhaps only with such a mock-up would they truly understand. They might genuinely not be aware, thinking it's just some obscure issue.

HIPAA doesn't apply to individuals, it only applies to health institutions and their employees and business associates[0].

[0] https://www.hhs.gov/hipaa/for-individuals/guidance-materials...

Plus, Canada.

Reply on news.ycombinator.com