bugtraq - Microsoft technologies. By default, non-HIPAA compliant?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 29 Jun 2004 22:43:19 -0400
From: "Anything But Microsoft" <abm@...thingbutmicrosoft.org>
To: <@securityfocus.com BUGTRAQ <BUGTRAQ@...URITYFOCUS.COM>
Cc: <secure@...rosoft.com>
Subject: Microsoft technologies. By default, non-HIPAA compliant?

The US health care system is the only industry where best network and
security practices are a federally mandated requirement.

In light of last weeks MS vulnerabilities with no known patches or
usable work around (text only mode in a browser, or security settings
that disable most usage, is not a suitable work around) I have a
question for everyone here with an answer for interpretation.

Are Microsoft technologies by default non-HIPAA compliant in regards to
protecting confidential patient information? If you are a health care
provider and use any Microsoft technology where alternatives exist, such
as for e-mail and web usage, is that exposing your PC/network to
unnecessary risks? (Thereby violating the spirit of HIPAA?)

When security experts en-mass suggest you find alternatives to IE, and
you as an information technology services provider to the health care
industry do not provide these Microsoft alternatives, are you not
providing HIPAA compliant services?

My view is that any health care provider using replaceable Microsoft
technologies is not HIPAA compliant, in regards to privacy or security
of patient data.

Your thoughts and comments?

<duck and cover...>