0

Recently I had to make an appointment at a hospital. I got an email with a link with a token in the form of a GUID. This brought me to a page where I had to enter my birth date to see the details.

This detailed page contained sensitive details like my SSN, what department my appointment was for (e.g. surgery, radiology etc.) and my doctor's name.

The email was send through TLS. The link has not expired so far and I am not able to change my password (the concept 'password' does not seem to exist).

Since my birthday is basically public information, is this scheme equivalent to sending me a plaintext password (GUID)? Or is there something that I'm missing?

  • Yeah, that seems like a lame auth scheme and I wouldn't be shocked if it violates HIPAA. – Mike Ounsworth May 18 '16 at 15:11
  • @MikeOunsworth yeah I thought so. Though it would be the European equivalent. See if I can find anything about something like that. – AmazingDreams May 18 '16 at 15:26
  • Although, do other hospitals email you your appointment reminder directly? Cause at least these guys are trying... – Mike Ounsworth May 18 '16 at 15:28
  • @MikeOunsworth I have no idea, luckily I don't have to go to the hospital that often. I think it's some sort of company or something with multiple hospitals/doctors to make it easier for everyone to keep track of stuff. Guess they made it a little too easy here. – AmazingDreams May 18 '16 at 15:31
  • What was the original mechanism in which the hospital found out your email address? Was it ever verified by you prior to receiving this email? – TTT May 18 '16 at 19:03
1

I would say its secure. The unique link, ensures that nobody that know your birthdate, can just logon and gain access to your information.

And the birthdate login, ensures that somebody that catches the email in transit (for example, on a public wifi), and the email happens not to be encrypted, cannot abuse your link since they don't know your birthdate.

I would say its sufficently secure for sending, not extremely sensitive information, but I would say your SSN, department, doctor's name and appointment time, for a single patient, is not extremely sensitive.

As you know, the rules for security changes in how many patient details you send. For example, sending a stack with 100 journals from one hostpital to a another, is not permitted via snail mail at all, you need to send it with guarded transport. But sending a single journal to a patient, is permitted to be sent in a simple letter, you don't even need to send it traceable or registred.

And its generally similiar when it comes to email. You may send simple information, but not more than that. Sending a link to the journal would not be permitted, but sending the information you got, is OK. However, sending a link to the journal via a GUID link + for example a SMS code to your phone, would be permissible.

So I would say, for the threats that are applicable, I would say its sufficently secure.

I think that they have made so the link expires when your appointment are over. It would ofcourse be dumb to make the link expire earlier, since you might read the appointment on mobile, think "yeah, its 1 week left, I can write the time into the calendar when I come home", and then when you come home, the link is expired/used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.