Message-ID: <004a01c37729$9c167db0$152ea8c0@LUFKIN.DPSOL.COM>
From: purdy at tecman.com (Curt Purdy)
Subject: EULA

Actually, failure to achieve compliance with  HIPAA could find hospital
executives and physicians facing fines of up to $25,000. Certain  criminal
violations could cost individuals and  organizations $250,000 and up to 10
years in jail.  This is quoted out of more than one reference.

Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA
Information Security Engineer
DP Solutions
cpurdy@...ol.com
936.637.7977 ext. 121

----------------------------------------

If you spend more on coffee than on IT security, you will be hacked.
What's more, you deserve to be hacked.
-- former White House cybersecurity zar Richard Clarke


-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Gregory A.
Gilliss
Sent: Tuesday, September 09, 2003 5:13 PM
To: full-disclosure@...ts.netsys.com
Subject: [inbox] Re: [Full-Disclosure] EULA


Okay, this is from my girlfriend, so flame her if it's wrong :-)

Basically, a HIPAA compliant hospital/practice/etc. that is found to be
in violation of, say, the regs on software change control, can be fined
up to US$ 10,000 per violation. I would guess that tha *could* be construed
as "per personal computer" if they wanted to be dicks about it...

But, it gets better...if they hospital/practice/etc that has been
inspected and cited doesn't comply with the violated HIPAA regs,
they can be closed down.  BAM!  In practice I do not think that this has
happened (yet) because the whole HIPAA thing is so new. However if you
look at it from the security perspective, I expect that M$ legal will be
amending their existing EULA for health care providers as soon as they read
about this...

G

On or about 2003.09.09 14:08:04 +0000, David Hayes (david.hayes@....com)
said:

> So, if a HIPAA site uses Windows and accepts the SP3 EULA, they're
> screwed.  If a HIPAA site uses Windows and does not accept the SP3
> EULA, they're screwed.
>
> Logical conclusion, if a HIPAA site uses Windows, they're screwed.
> Thus they should use a different OS?
>
> --
> David Hayes    Network Security Operations Center     MCI Network Svcs
> email: david.hayes@....com      vnet: 777-7236     voice: 972-729-7236
>
>
> On Mon, Sep 08, 2003 at 01:13:21PM -0400, Valdis.Kletnieks@...edu wrote:
> > On Mon, 08 Sep 2003 08:43:14 PDT, D B <geggam692000@...oo.com>  said:
> >
> > > does the EULA of Microsoft violate lawyer client
> > > privilege ..... as in  if my lawyer is using windows
> > > is he violating my rights
> >
> > I can't speak for the legal profession, but the SP3 EULA (the one where
you agree to
> > allow Microsoft to install, without warning or notification, anything
labeled a "security
> > patch", even if it breaks 3rd party software), is known to be very bad
mojo for sites
> > covered by HIPPA, because it cedes software change control.
> >
> > Of course, if you fail to agree to the EULA and you're a HIPPA site,
you're still screwed
> > because then you can't install post-SP3 patches.
> >
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

--
Gregory A. Gilliss                                    Telephone: 1 650 872
2420
Computer Engineering                                   E-mail:
greg@...liss.com
Computer Security                                                ICQ:
123710561
Software Development                          WWW:
http://www.gilliss.com/greg/
PGP Key fingerprint 2F 0B 70 AE 5F 8E 71 7A 2D 86 52 BA B7 83 D9 B4 14 0E 8C
A3

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Powered by blists - more mailing lists