Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Medicine Security Privacy Software News Hardware IT Science Technology

Study Finds Password Misuse In Hospitals Is 'Endemic' (securityledger.com) 198

Posted by BeauHD from the password123 dept.
chicksdaddy writes from a report via The Security Ledger: Hospitals are pretty hygienic places -- except when it comes to passwords, it seems. That's the conclusion of a recent study by researchers at Dartmouth College, the University of Pennsylvania and USC, which found that efforts to circumvent password protections are "endemic" in healthcare environments and mostly go unnoticed by hospital IT staff. The report describes what can only be described as wholesale abandonment of security best practices at hospitals and other clinical environments -- with the bad behavior being driven by necessity rather than malice. "In hospital after hospital and clinic after clinic, we find users write down passwords everywhere," the report reads. "Sticky notes form sticky stalagmites on medical devices and in medication preparation rooms. We've observed entire hospital units share a password to a medical device, where the password is taped onto the device. We found emergency room supply rooms with locked doors where the lock code was written on the door -- no one wanted to prevent a clinician from obtaining emergency supplies because they didn't remember the code." Competing priorities of clinical staff and information technology staff bear much of the blame. Specifically: IT staff and management are often focused on regulatory compliance and securing healthcare environments. They are excoriated for lapses in security that result in the theft or loss of data. Clinical staff, on the other hand, are focused on patient care and ensuring good health outcomes, said Ross Koppel, one of the authors of the report, who told The Security Ledger. Those two competing goals often clash. "IT want to be good guys. They're not out to make life miserable for the clinical staff, but they often do," he said.
This discussion has been archived. No new comments can be posted.

Study Finds Password Misuse In Hospitals Is 'Endemic' More

Study Finds Password Misuse In Hospitals Is 'Endemic'

Comments Filter:

  • Just amazing (Score:5, Insightful)

    by Overzeetop ( 214511 ) on Friday June 24, 2016 @08:04AM (#52380743) Journal

    If you forget a password, someone may die right in front of you. You can choose to write that password down and reduce security, or you can take a chance that you'll forget what this month's 12 character combination of at least two upper case, two lower case, 2 numbers, and 2 non-alphanumeric characters is in a pressure situation and the result will be death or injury to a human in your care and, likely, a lawsuit and dismissal.

    Until this is fixed, people are going to write down passwords.

    • It's not just emergencies (Score:2, Informative)

      by Anonymous Coward

      My wife is a practitioner and she constantly complains how when she's with a patient, the system locks her out and demands a password change - which can take several minutes because they have this cloud EMR shit that's hosted across the country and is slower than shit.

      Or just having the system time out fast. She's with a patient listening to their health complaints and examining them and then the system times-out and she has to log in again - and go through the obscene obstacle course of a UI to get back

      • [...] is slower than shit.

        Try eating fiber. No more slow shit.

        It is fun to hear people complain about technology.

        If there is one thing I have learned, it is that people like to complain and they LOVE to complain about technology.

        You could address all of these concerns and the next thing out of the user's mouth will be "the text is hard to read" or "the color scheme hurts my eyes" or any number of other asinine things.

        • Re: (Score:3)

          by sabri ( 584428 )

          Try eating fiber. No more slow shit.

          It's not about fiber. If you have Netflix, go find "Code Black". It's a documentary about a group of ER doctors, and of of the things that stand out is their move to a "HIPAA compliant" hospital. One of the doctors can be quoted saying something like "if I use the restroom, I want to login. Login Login Login everywhere". Sure, HIPAA keeps patient records safe. But what use is that to the patient if he's dead? I'd rather be alive and have my records slightly less safe than being dead but knowing for sure tha

    • Keycard and 4-digit pin combo.
      The "security" is getting ridiculous. Especially since when you hear about these data breaches, it all seems to be from the big companies servers, not from a regular joe 6-pack user

      • You do realize how these breaches happen right?

        Almost every major hack you have heard about has the same vector into the network: users.

        • Yes, the eighth layer of the OSI model: end users. The most insecure layer of them all LOL

          • Requiring complicated passwords they need to write down is a failure of security design.

            Network security that allows average user access to things they don't need access to is the bigger problem.

            If Joe SixPack doesn't have access to the credit card database, his account can;t be used to hack it.

            • If Joe SixPack doesn't have access to the credit card database, his account can;t be used to hack it.

              It's never that simple.

              An attacker will hack Joe's account because Joe was dumb enough to click a phishing email or download a trojan.

              The attacker will own Joe's machine and wait for an account with admin privileges to log on. It could be the Help Desk guys installing patches, or it could be the application account for the enterprise configuration management application. It doesn't matter, as long as it has the privileges.

              Since that admin account probably has access to all the workstations on the domain, th

      • Would a data breach on a regular Joe 6-pack user's machine be newsworthy enough for us to hear about it?

    • Re:Just amazing (Score:4, Informative)

      by tchdab1 ( 164848 ) on Friday June 24, 2016 @10:10AM (#52381729) Homepage

      Add to this the great volume of doctors, interns, nurses, technicians, assistants, etc. that need access to these understaffed and overly busy places, and that come and go frequently. You arrive at a unit in the hospital and everything is password protected, all the passwords are different, and you need to get into many of them to do your job and help people in various stages of critical need. Nobody has taken the time to tell you what the common passwords are (for getting into locked rooms) or even given you your personal authorization to get at med dispensing machines, because they don't have the 15 minutes needed to do that (they'll get to this a little later when the breathing is stabilized or the pain is addressed). Don't be surprised that security is squarely in the way of getting things done, but make it easier for people to survive and be productive in this kind of environment.

    • Common Access Card (Score:2, Informative)

      by Anonymous Coward

      If you forget a password, someone may die right in front of you.

      I'm surprised that more hospitals haven't implemented CAC:

      https://en.wikipedia.org/wiki/Common_Access_Card

      You generally need a pass card for most offices now anyway, so allowing it may not be a bad idea. When the work day first begins, you login with BOTH the passcard AND a password, which starts a 4/8/10 hour timer window. With-in that window you can only SIMPLY use your card to login, but once it passes you have to re-login. This way if the card is lost you still need two-factor.

      Basically putting a Kerber

      • CAC is the US DoD implementation of smart cards, and any enterprise can deploy smart cards to its users.

        Basically putting a Kerberos ticket on the card for single sign-on for a limited time.

        That is not at all how smart cards work.

        The card contains one or more certificates, and it will perform some pre-defined authentication operations using the private key if presented with the user's PIN.

        Successful completion of these operations verifies the owner of the certificate is using the machine. The Subject Alternative Name field on the certificate is linked to the user's Active Directory account.

    • If you forget a password, someone may die right in front of you. You can choose to write that password down and reduce security, or you can take a chance that you'll forget what this month's 12 character combination of at least two upper case, two lower case, 2 numbers, and 2 non-alphanumeric characters is in a pressure situation and the result will be death or injury to a human in your care and, likely, a lawsuit and dismissal.

      Until this is fixed, people are going to write down passwords.

      So instead of liability reform, I vote in favor of removing all door locks and all security from any medical device or hospital. In fact, that whole HIPAA security model has probably cost lives by now, so let's just get rid of that shit too.

      That way, all you have to worry about at the end of the day is when the device itself fails, or when the human operator working back-to-back 18-hour shifts makes a mistake.

      If you goal is to remove liability from the medical industry, good fucking luck.

    • If you forget a password, someone may die right in front of you.

      If we didn't connect the damn things to the intertoobz, perhaps a password might not be needed at all.

      But the hospital as the proving grounds of the Internet of Things, just shows that if you need an easy password to save lives, bad guys can use that easy passwork to kill people.

      • Re: (Score:2)

        by torkus ( 1133985 )

        You also have to take into account physical access, not just the interwebz. Drug carts, supply rooms, medical pumps, etc. all need to be protected from the patients that are in the same room/area as they are.

        Yeah, someone might remote in and hack the drug cart to open up and dispnse lots of morphine to their friend who stealths in on a fake sickness...or the junkie who goes to the ER every other week for a hot meal and a shower figures out how trivial it is to get into the cart with a a fixed punch-code or

    • Re: (Score:2)

      by tlhIngan ( 30335 )

      If you forget a password, someone may die right in front of you. You can choose to write that password down and reduce security, or you can take a chance that you'll forget what this month's 12 character combination of at least two upper case, two lower case, 2 numbers, and 2 non-alphanumeric characters is in a pressure situation and the result will be death or injury to a human in your care and, likely, a lawsuit and dismissal.

      Until this is fixed, people are going to write down passwords.

      Then it's time to

  • what happens if someone dies (Score:3)

    by known_coward_69 ( 4151743 ) on Friday June 24, 2016 @08:05AM (#52380751)
    because people can't remember the password or code for that exact door or device? at some point you accept some lapse in security for the greater good

    • Re:what happens if someone dies (Score:4, Insightful)

      by beelsebob ( 529313 ) on Friday June 24, 2016 @08:14AM (#52380801)

      It's also a great example of something I've been saying for a while.

      IT needs to take much more account of what their users actually need and want. In a hospital, it reaches a really obvious head, because what the users need and want is for their patients not to die, but the same applies across pretty much every company I've worked at bar one. The IT department universally will try to bias things towards security (because thats their mandate) and will want excessive justification for anything at all that a user needs/wants to do.

      The result almost always is that users will end up going "fuck IT" and trying to find work arounds (*cough* like putting top secret emails on their own personal mail server *cough*). Seriously, I would bet big money that the only reason that Hillary had emails on her own server was because IT refused to accommodate her needing to access work somewhere other than where they deemed the correct place was.

      • Re:what happens if someone dies (Score:4, Insightful)

        by jon3k ( 691256 ) on Friday June 24, 2016 @09:07AM (#52381181)
        This isn't an IT problem it's a federal regulation problem. Take it up with congress. HIPAA mandates unique user IDs and passwords so that access to ePHI can tied back to a human being. Sharing passwords makes it next to impossible to guarantee you know who accessed a medical record.

      • It's also a great example of something I've been saying for a while.

        IT needs to take much more account of what their users actually need and want. In a hospital, it reaches a really obvious head, because what the users need and want is for their patients not to die, but the same applies across pretty much every company I've worked at bar one. The IT department universally will try to bias things towards security (because thats their mandate) and will want excessive justification for anything at all that a user needs/wants to do.

        The result almost always is that users will end up going "fuck IT" and trying to find work arounds (*cough* like putting top secret emails on their own personal mail server *cough*). Seriously, I would bet big money that the only reason that Hillary had emails on her own server was because IT refused to accommodate her needing to access work somewhere other than where they deemed the correct place was.

        Anyone doing IT Security long enough knows damn well it's a double-edged sword.

        Too much, or not enough, will hurt you. This cuts right to the bottom line these days, and speaks directly to the bean-counters, in the only language they understand.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        No. Hillary did it to avoid FOIA.

      • IT refused to accommodate her needing to access work somewhere other than where they deemed the correct place was

        Those refusals were based on following the law.

        Federal laws dictate what constitutes a public record and how they must be retained. Virtually all outbound communications would qualify as public records, and many internal office emails will qualify as well.

        Federal laws also dictate how sensitive information is handled. This includes not only classified information, but also any electronic storage of personal information or information designated for official use only.

        Sometimes IT may slack off and deny a req

      • Re: (Score:2)

        by torkus ( 1133985 )

        Part of it is the fact that there are so many independent data points to remember. In theory SSO-type mechanisms would work but in reality there's a different code, password, PIN, and combination for any number of things.

        I work outside of the medical field and we've implemented SSO for quite a few things...and there's still a dozen accounts the typical user needs to know and remember. It basically falls under "yeah SSO for everything...but hey here's this new tool/site/app that you need for some other cri

    • Meh. It's a trade off issue like everything else.

      Clearly there should be no critical, time sensitive, live saving system or device with heavy security. At the same time, make sure that these systems are physically separated from the administrative network.

      On the other hand, stuff like research terminals or administrative computer systems can be locked down and require more security. I believe that these are the systems the article is talking about.

      This isn't brain surgery here.

  • It's not just in Healthcare (Score:3, Informative)

    by Dust038 ( 4606581 ) on Friday June 24, 2016 @08:13AM (#52380797)
    Having been in the trenches for a number of years, it isn't just heathcare where password misuse is 'Endemic' I am not sure how paywalled this article is but this here: ~~ "Those two, competing goals often clash. “IT want to be good guys. They’re not out to make life miserable for the clinical staff, but they often do,” he said." ~~ I've been in their shoes, and at the next HIPAA Compliance check they are doomed with IT taking most of the blame. We can only advise them in the end to follow best practice. Anyone have an article about a doctor being fired for password misuse and not IT? Just my 2 cents.

  • Two failure modes (Score:5, Insightful)

    by Geoffrey.landis ( 926948 ) on Friday June 24, 2016 @08:14AM (#52380803) Homepage

    Let me remind everyone here that there are always two failure modes of a simple component, type 1 and type 2. A switch can fail open-circuit or short-circuit; a lock can fail locked or open, and a password failure can be either "will let people in who shouldn't be allowed to get in" or "won't let people in who need to get in".

    You can alway take one failure rate to zero by making the other failure rate 100%. Reducing the rate of type 1 errors tends to increase the rate of type 2 errors, and vice versa.

    Basically, the hospital workers are voting "there are too many errors of the type "can't get in when we need to", and we need a work-around to prevent this."

  • Comment removed (Score:5, Informative)

    by account_deleted ( 4530225 ) on Friday June 24, 2016 @08:26AM (#52380877)
    Comment removed based on user account deletion

    • It also required me to train users on posix permissions and how to properly collaborate in a unix-like environment

      Are you posting from 1993?

  • Security that gets in the way doesn't work (Score:5, Insightful)

    by Opportunist ( 166417 ) on Friday June 24, 2016 @08:27AM (#52380885)

    Security that gets into the way of the worker to the point where it hinders him in his actual work will be circumvented without remorse. Actually, it will be done with the justification of increasing productivity. An example:

    Take a security door that MUST be closed all the time for security reasons because something valuable is stored behind that door. Now take a worker that has to haul heavy items through that door. The prescribed flow of operation would be that he unlocks the door, goes through it, locks the door behind him, picks up whatever heavy item he has to haul, puts it down at the door, unlocks the door, opens the door, carries the heavy item through, puts it back down, closes the door, locks the door and then carries the heavy item to its destination.

    How many times do you think he'll do this before that door is wedged open?

    To him, that door is a nuisance and, worse, it is something that lowers his productivity and, in his opinion because he does not know the other implications, hurts his company. It isn't something he does for personal gain where he'd hurt his company, like checking his Facebook page on company time or watching YouTube videos, something he would at least feel guilty for, it is something he does FOR the company because it means he can work faster.

    That is by some margin the worst kind of security infraction because it is done without remorse and with a good justification.

    How much more likely is something in a health related area where the justification can well be saving someone's life?

    This is why you have to plan your security in such a way that it does not impede the workflow of your workers more than absolutely necessary. Yes, that means you have to actually do your fucking job as a CISO and not just spout some insane and harebrained password requirements that force everyone to write it down 'cause they cannot remember them. You have to find out how to automatize away security from your workers. Perfect security isn't one where your workers stumble upon it every single time they want to do it, perfect security is achieved if the worker doesn't even interact with it anymore and hence CANNOT fuck it up, neither deliberately nor accidentally.

    The aforementioned door could be made secure without causing your worker additional stress simply by giving him a RFID token and the door opening if it is being scanned. If you want to make theft of the token unlikely, activate it when the worker signs in in the morning (using the RFID token and a pin key, so someone stealing the RFID token would not know the pin) and deactivate it when he leaves. This is trivially possible and if whatever you have to secure is so important, the cost for implementing this are negligible as well.

    But you have to do it. Instead of just offloading the burden of security onto your workers.

  • . . . .to worry about passwords. Both my daughters work at the local hospital, a regional medical center. ~450 beds. 5000+ employees.

    IT Shop ? 3 people. They're too busy putting out brush-fires to even THINK about more than out-of-the-box configs. It's to the point that both daughters (one is a ward admin, the other a radiology trainee ) spend about a third of the time as de-facto frontline IT Techs.

    I rather suspect it's not an isolated case. . .

  • Working with DHS components (Score:3)

    by wiredog ( 43288 ) on Friday June 24, 2016 @08:36AM (#52380957) Journal

    DHS being the Defense Health Service of the DoD. Someone had the brilliant idea of requiring the use of CACs (ID cards) to log in to terminals used by military medical personnel worldwide. This would satisfy the HIPAA requirements, keep Security happy, make it easy to log who was seeing what, and generally be a Good Thing.

    Then it was pointed out that using a CAC for login required a connection to validation servers. And field hospitals in Afghanistan, Iraq, and other places generating lots of patients might not have good connections... Oh, and Navy ships at (and especially under) sea can also lack good connectivity.

    Amazingly, the Powers That Be agreed that the Idea, while Good, was not practical, so using the CAC is now recommended rather than required.

    • Then it was pointed out that using a CAC for login required a connection to validation servers.

      Not continuously.

      They could download the CRLs from each certificate authority once a day and distribute them to the authentication servers (Windows domain controllers, most likely).

      There are tools to automate this process, and they can be scheduled for off hours and to retry in the event of a network outage.

      Obviously, there are grounds for an exception where internet connectivity goes down for days at time, but even then you could configure the system to skip validation. (Skipping validation still means the

  • Wrong way to write down passwords (Score:4, Interesting)

    by gurps_npc ( 621217 ) on Friday June 24, 2016 @08:55AM (#52381109) Homepage

    There is a right way and a wrong way to do this. In my experience, all the hospitals do it the wrong way - which is to write down the actual password.

    The correct way to do it is simple, right down a password that is systematically wrong.

    If the password is 845, write down 734.
    If the password is EmerC@rE, write down eMERc2Re, or perhaps R,rV#tR (check your keyboard).

    simple cryptography works fine.

    • There is a right way and a wrong way to do this. In my experience, all the hospitals do it the wrong way - which is to write down the actual password.

      The correct way to do it is simple, right down a password that is systematically wrong.

      If the password is 845, write down 734. If the password is EmerC@rE, write down eMERc2Re, or perhaps R,rV#tR (check your keyboard).

      simple cryptography works fine.

      A corrollary would be to have two passwords stored in the system, the real one and the memory jogger. If someone enters the memory jogger you know an intrusion may have be attempted and can lock the system and warn the ser the next time they log on.

    • Re:Wrong way to write down passwords (Score:4, Insightful)

      by geekmux ( 1040042 ) on Friday June 24, 2016 @10:48AM (#52382073)

      There is a right way and a wrong way to do this. In my experience, all the hospitals do it the wrong way - which is to write down the actual password.

      The correct way to do it is simple, right down a password that is systematically wrong.

      If the password is 845, write down 734. If the password is EmerC@rE, write down eMERc2Re, or perhaps R,rV#tR (check your keyboard).

      simple cryptography works fine.

      Holy SHIT do you overestimate the average human's ability to understand even simple obscurity models.

      Feel free to provide examples of where this has actually worked for people outside of IT.

    • Re: (Score:2)

      by ljw1004 ( 764174 )

      In my experience, all the hospitals do it the wrong way - which is to write down the actual password. The correct way to do it is simple, right down a password that is systematically wrong. If the password is 845, write down 734.
      If the password is EmerC@rE, write down eMERc2Re, or perhaps R,rV#tR (check your keyboard). simple cryptography works fine.

      Sure, great idea. That way you'll have two post-it notes stuck on the monitor:
      * "password is 734
      * "add 1 to each digit to get real password"

      What actual threat model do you imagine anyway? Which danger model is more likely? (1) That a clinician forgets a password or the password sticky note convention and so care is delayed by several hours while it gets restored? (2) Or a new clinician comes to the shift and doesn't know the convention and care is delayed? (3) Or an electronic attacker tries to get into the

    • There is a right way and a wrong way to do this. In my experience, all the hospitals do it the wrong way - which is to write down the actual password.

      The correct way to do it is simple, right down a password that is systematically wrong.

      If the password is 845, write down 734. If the password is EmerC@rE, write down eMERc2Re, or perhaps R,rV#tR (check your keyboard).

      simple cryptography works fine.

      Except that the many of the people who are writing it down are the people who have issues getting it correct even when written down correctly, mostly older doctors and staff. The rest are people who have so many passwords for som many systems that are used so seldomly, that they can't remember them. This would include what their system of cryptography is too. Add in that many of these systems are vendor controlled and they all have different constraints on how passwords can be created so that any such syste

    • Re: (Score:2)

      by antdude ( 79039 )

      They won't remember that method.

  • Comment removed (Score:5, Insightful)

    by account_deleted ( 4530225 ) on Friday June 24, 2016 @09:00AM (#52381145)
    Comment removed based on user account deletion

    • +1, Wish I had mod points.

      Passwords in general have been obsolete for years, but not replaced. Password policies have made this worse. I have 4 different passwords and a chip card at work alone (WTF?). Dozens of websites want passwords, many of which I only need to access monthly or yearly. Many have policies that get in the way of good password practices (many have very short character limits, which is stupid beyond belief). So I readily admit I reuse the same burner password and login for many low im

    • IT security and policies should support the mission of the organization - not the other way around.

      This is a useless generalization.

      Since most businesses do not want their trade secrets or contract information stolen, they need IT security.

      Since most businesses are obliged to protect personal information or other sensitive information, they need IT security.

      The value of various protections should determine how much they spend to implement security, and the potential for lost productivity should determine how much is spent on streamlining procedures and deploying enterprise tools. Most of those assessment

  • For starters, go ahead with your weak rationalizations about why any of these critical devices need to be on a network that is also connected to the Internet.
    Go ahead...
    • From an AC post further up

      General Electrics: "Oh, we didn't tell you but we'll need a 24/7 IPSec VPN to this 500,000€ piece of equipment (and all its consoles) you just bought from us." Me: "What." General Electrics: "I know your medical imagery dept. is currently airgapped but hey, easy enough to correct, right?" Me: "Yeah, no, it's not that easy." General Electrics: "Then I'm afraid you've got a 500,000€ paperweight until you comply with our demands." That was last year.

      They should just repla

      • Yea, I work at a lab, and a few of our instruments now need to be constantly connected to phone home.
        There is no rationale for this. Just more of the clouded thinking that we now have to live with.

        It's going to be a rough ride when the IoT gets going, with how weak it's "security" is.
        Imagine when "everything" is on a network, with little to no thought about security...

  • Apply security where it makes sense (Score:4, Funny)

    by MobyDisk ( 75490 ) on Friday June 24, 2016 @09:05AM (#52381173) Homepage

    There are some places where security just isn't needed. Where I work we are having discussions kinda like this:

    Security team: All new products must support two-factor authentication!
    Development: On the juke box??

  • " and mostly go unnoticed by hospital IT staff."

    and mostly go willfully unnoticed by hospital IT staff.

    Fixed that for you.

    Though it is more correct to say "hospital IT staff turn a blind eye to the practice".

  • I'm the Admin for a High-Tech factory. While we do use some very dangerous chemicals, those are pretty well restricted using physical means. However, on the factory floor itself, the company has historically used shared passwords for most of the manufacturing tools themselves. While this doesn't currently pose much of a safety threat, it does make tracking "who did what" basically impossible. Additionally, we were recently acquired by a Public company, and due to SOX, the whole "shared password" thing i

    • Re: (Score:2)

      by PPH ( 736903 )

      The use of RFID tags would work, but then you have the issue of potential theft of said tag.

      The theft problem is diminished if the tags are used for facility access control. 'Lose' your tag and you've got to stop by security for a new one (and have the old one deactivated). Actual theft by miscreants attempting unauthorized access has been handled in an innovative way in at least one place. Tags gone missing are 'deactivated' but still work to open one door in a man trap. Then the holder is stuck, having to explain himself to (armed) security. Not willing to go that far? You can still get a photo

  • Endemic? Endemic? Don't you mean "nosocomial"?

  • Really? (Score:4, Informative)

    by nospam007 ( 722110 ) * on Friday June 24, 2016 @09:46AM (#52381517)

    "Hospitals are pretty hygienic places -- except when it comes to passwords, it seems. "

    Hardly. Bad hygiene in hospitals kills over 100.000 people a year in the US alone.

    http://abcnews.go.com/GMA/stor... [go.com]

  • Pressure to perform QUICKLY, ALL THE TIME, on every 16 hour shift.

  • One company has announced the new product line called Password PostIts, specifically for this misuse.

    These are just as easy to use.
    1.Write the password down on the post It.
    2.Peel off.
    3.Stick in a convenient location, preferably visible to human traffic
    4.Sell them by the gajillions
    5.Profit!

    What makes them unique is they are non-stick postIts. Other than being lime green, they really don't stay on for very long.

  • The IT staff felt I was competent enough to be given Admin access to my machine. So I shrank the Windows partition and installed Debian in the empty space. Works great! I can do my work just as well on Debian as I can in Windows

  • Comment removed (Score:4, Insightful)

    by account_deleted ( 4530225 ) on Friday June 24, 2016 @10:28AM (#52381917)
    Comment removed based on user account deletion

    • Pretty much this. I was vocal about it at work, ignored, and just go with it now. I'm the same I have a million different usernames and passwords for various systems I have access to. There has been some improvement in the last couple of years, where we've managed to consolidate some systems into the same environment where we can share usernames/passwords, but for the most part it is still the same. Then every year some new systems are added to the pile, each with it's own username and passwords... Ideally

  • They don't invest the money to make things work smoothly in their IT service, it just has to work. The last hospital I worked for had no central authentication service. You had over a dozen passwords, they all needed to be changed at different times, and all had different requirements.

    Some of the better systems I've seen had a PIN number tied to your longer password. The pin was only good for your shift and you had to change it on your next shift. It resisted brute force by locking out after so many attempt

  • The end-user is rarely schooled in ANYTHING IT-related. Keyboards are an obstacle. Mice are an obstacle. Add bureaucracy to this and you have very frustrated users who are not going to take kindly to passwords or any other additional obstacle.

    Last time I saw a doctor he was forced to "code" the X-Ray I was about to get in one of about fifty different codes made necessary by the accounting system. He couldn't see the extended explanations on the page because the data elements had been squished together. Obvi

  • Technology has been a boat anchor dragging down the industry thanks to regulations like Hippa, and requirements that all records be kept electronically. Paper charts are banned. now. This is a classic example of what happens when legislators regulate something they know nothing about. I see it everyday, as I work at the helpdesk of a major midwestern hospital chain. I am convinced all the technology that end users can't figure out has led to dead and injured patients. I am a perma-temp, where I work, not

  • The password misuse isn't by medical staff. It's IT that is abusing standard password policies that aren't designed for man-rated procedures.

  • Based on my [very long] experience watching people deal with this in the real word....

    The #1 reason passwords are written down is because of stupid, backwards, unnecessary expiration rules. It is in insane practice that somehow became "best practices" when it should have been declared "WORST practices" decades ago. When your perfectly good and memorized password expires every X days, you are going to either start writing it down, or make it insanely weak (or duplicated with other systems) so it can be rem

  • Consultants/Politicians: We're going to move you to electronic healthcare records, you're going to love it!
    Doctors: I know it's old fashioned, but my paper records worked fine, why do we have to change?
    Consultants/Politicians: Ha, ha, that's adorable. Now sign here to get your e-records database for $500k.
    Doctors: Do I have to?
    Consultants/Politicians: Do you like jail?
    Doctors: Okay ... now what?
    Consultants/Politicians: Welcome to the future! Now, you and your staff just have to take this one week cour
  • endemic is my password!

Slashdot Top Deals

Repel them. Repel them. Induce them to relinquish the spheroid. - Indiana University fans' chant for their perennially bad football team

Close