The US health care system is the only industry where best network and
security practices are a federally mandated requirement.

In light of last weeks MS vulnerabilities with no known patches or
usable work around (text only mode in a browser, or security settings
that disable most usage, is not a suitable work around) I have a
question for everyone here with an answer for interpretation.

Are Microsoft technologies by default non-HIPAA compliant in regards to
protecting confidential patient information? If you are a health care
provider and use any Microsoft technology where alternatives exist, such
as for e-mail and web usage, is that exposing your PC/network to
unnecessary risks? (Thereby violating the spirit of HIPAA?)

When security experts en-mass suggest you find alternatives to IE, and
you as an information technology services provider to the health care
industry do not provide these Microsoft alternatives, are you not
providing HIPAA compliant services?

My view is that any health care provider using replaceable Microsoft
technologies is not HIPAA compliant, in regards to privacy or security
of patient data.

Your thoughts and comments?

<duck and cover...>

[ reply ]