Hacker News Reader

Comment by drewg123 | Hacker News Reader

So the breach involved their portal. I HATE those portals. I wish healthcare providers would just send an email, rather than "you have a new message on our portal". I think (hope?) my email is more secure than these portals..

View on HN

As I understand it, HIPAA requires that health information is secured in transit and at rest. This is difficult to do over email, since email is not always encrypted in transit, so the general recommendation is to use a portal instead.

There's some additional information here: https://www.securitymetrics.com/static/resources/orange/HIPA...

These patient portals are required by law now, for all medical offices large and small. Part of it is also just shifting work into the portal one is required to have anyways

Source: have worked in a medical office

Technically, your email may have been transmitted in plain text over the open internet. Most email doesn't go through unencrypted connections, but it isn't guaranteed. Email also doesn't do much to establish the authenticity of the sender, at least not as part of its specification.

Yes I wish there was a way to opt out and just rely on phone support. At least with phone support the attackers would have to social engineer things at an individual records level versus just being able to brute force huge bulk data records out.

Most doctors offices are effectively overworked and understaffed small businesses. Shifting all that support to the phone would not be reasonable, from a workload perspective.

Just to expand on that, patients aren't the only ones with a legitimate reason to access that data. Insurance companies need copies as well, so they would still want some kind of mass-data portal even if customers don't use it. If you change doctors, they want copies of your old medical records. If you see a specialist, if you go to the hospital, etc, etc. Pharmacies might call and ask if they think there's something weird about a prescription.

Direct patient contacts are a vanishingly small percentage of records requests for a doctor. Doctors could likely handle those via phone, but it doesn't solve the issue of needing an EMR.

Reply on news.ycombinator.com