You do all of this technical configuration to safeguard patient data to later observe a doctor taking phone appointments at a fucking coffee shop.
Kaiser doctor. His laptop was open with patient records, no privacy screen, and he was actively taking phone appointments for at least an hour. “Let’s see here I’m looking at your xray now, it shows you have [medical condition] and at your weight of [number], you could stand to lose a few pounds. Diet can only go so far. Also I can see here that you’re on [prescription medications] at [dosages]”.
I called and reported him to Kaiser’s Ethics & Compliance board. The representative was gobsmacked and said based on all of the details I provided, they’d be able to find him easily.
I happen to run IT at a small mental health nonprofit, we’re a few years away from an EHR deployment at least, and I feel like I’m busting my ass to try and create a relatively safe system to protect our participants data (which is absolutely HIPAA protected). Our environment is a disaster after decades of neglect, it’s laughable. Goes to show you can do everything you can to up your cybersecurity stature, drop millions on an EHR, buy and configure the right licensing, do endless trainings with your staff and lo and behold some asshole decides it’s “no big deal” and pulls some shit like this.