2

My dental office just printed my user-defined password (not a first or one-time password) to their portal on some checkout paperwork.

I asked on Law.stackexchange and it doesn't sound like this is a HIPAA violation, but I am really curious if this violates other regulations or goes against known best practices, as it seems really bad security-wise.

It doesn't feel right that they can even see my password.

Any thoughts / resources much appreciated.

1
  • What geographic area are you in? US? EU?
    – schroeder
    Oct 23, 2019 at 8:30

2 Answers 2

1

Does it violate best practices? Absolutely.

Passwords are meant to be stored in a hashed form, which means that they should not be able to work out what your password is to be able to print it off anywhere. This has been a standard for decades.

There may be privacy regulations that might have an opinion on the practice, too, depending on your jurisdiction.

The bigger problem is trying to talk to your dentist office about it as no one there is likely to be able to understand either the security or privacy issues and nuances. If you express your concerns, I suspect the response would include some notion that all info on the portal is a copy of info that they already have access to. So, it would come down to the issue that it is printed off, and that the admin of the portal also has access to the data, and that requires an understanding of the nuances of security or privacy.

1

If it is the password that you generated and that you use to access their portal, it is unacceptable that they know it. How do they know the password? Did you provide it directly (verbally or otherwise) outside the sign-up process on the portal? If not, this means that their portal database save users passwords in clear and they have full access to them, this, at least in EU, can conflict with new privacy and electronic data processing rules: GDPR. I don't know what your nation is, but even if it were outside the European Union, I am sure that such behavior would violate some law.

3
  • @schroeder you're almost right in saying that GDPR is not restrictive. However I work as a sysadmin in a company and our privacy consultant has expressed more than a perplexity for a db that stored sensitive data in clear. They don't make you contraventions for this but, if tomorrow someone accesses the database and takes the data, the responsibility is yours and things can take an unpleasant turn for you.
    – Yamar69
    Oct 23, 2019 at 8:43
  • Much better phrasing. Thanks. The #1 rule of GDPR: "It depends".
    – schroeder
    Oct 23, 2019 at 8:51
  • @schroeder thanks to you for pointing out :)
    – Yamar69
    Oct 23, 2019 at 8:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.