Hacker News Reader

Comment by throwoutway | Hacker News Reader

This is seriously concerning and requires a response from Microsoft. People use O365 for healthcare/HIPAA data and Microsoft signs a BAA for this use

View on HN

Having worked in healthcare tech for over a decade, it's extremely common for healthcare facilities to send medical records over fax.

HIPAA and BAAs are for lawyers to argue about after your medical records has been exposed, and if attempts to remedy the situation deteriorate.

You're allowed to assume the phone network is not being eavesdropped, you're not allowed to assume that for Internet transmission. Whether that's true or not, that's the accepted position.

If this encryption genuinely allows structural data retrieval - eg common invoice templates or medical reports - then this is absolutely a HIPAA problem, and once a facility is made aware of it they would need to respond.

FWIW, this message encryption is also accepted by UK NHS, in fact it's virtually the standard.

The mitigating factor is that typically the user is fully authenticated before being allowed to access the encrypted data...

Explain to me how this is a bigger risk than just physical burglary and stealing a computer with encrypted drives? The effort required to MITM and take advantage of this exploit is considerably more costly and time-consuming than just breaking into a building.

AS OP mentioned, this is not about assumptions but laws and their interpretation during consideration in a court of law.

The amount of sensitive data Microsoft must be collecting from all manner of organizations is insane. As far as I can tell companies just don't care at all about the data they leak to third parties anymore. They seem to either trust that they'll know when that data is abused or leaked or that they can lawyer their way out of being responsible for any fallout. It must be an endless gold mine for MS though to have that level of insight into what damn near every corporation is involved in.

Not really, the current method of secure Microsoft “email” via Exchange Online is receiving a message that you have “secure mail”. You then have to click on a link to view the message stored on a webserver behind SAML/LDAP auth with a username/password hopefully provided by offline methods. Usually best if behind corp vpn, but that is going away now.

Sounds spammy, but this is industry norm from personal experience on Ironport and Exchange. Downside is the spam imitations of this that are likely quite successful at phishing creds from corporate users.

I seriously doubt this will cause HIPAA problems.

> Since Micosoft has no plans to fix this vulnerability the only migiration is to avoid using Microsoft Office 365 Message Encryption.

Should clinicians just ignore this or should they demand a response?

Clinicians will certainly just ignore this.

Of course they will, but I said “should” not “would” for a reason

Reply on news.ycombinator.com