Jack of All Tales

STARTING OFF. BAD.

Why is that you might ask. Well you see. There are many Rules and Laws and Regulations about the use and exchange of personal healthcare data.

Which is why of course this guy, seeing a well-thought-out and tested technical position, decided "what if i get all of them at once and also the 2FA codes and stored them ALL in the same place with no encryption whatsoever"

The shortest possible story on this is that in the 90s there was a court case that basically made it so that without your consent, basically you the patient, NOTHING ABOUT YOU SHOULD EVER BE SHARED. Not even with the government. (there are limited exceptions and they don't need to be expanded)

Not even that you're a patient there or you've even been on the premises. This was a federal case so your medical information should be protected nationwide. This includes everything from having a cold to whether or not you're HIV positive or you've had an abortion or you take HRT.

There are a lot of interested parties who want medical data to at best advertise to you and at worst discriminate against you or advocate that you be euthanized.

What you see above is basically an inverse of the training program that every healthcare technology worker takes. This person created a means of evading all the checks that limit sharing private health information to only staff who need to look at your chart to do their jobs. They created a means of sending all that data to untrusted third parties who WILL disclose that data without your consent.

There are hundreds of thousands of people who work every day to protect the private healthcare data of all of us every day and this connector is a spit in all of the collective faces of anyone who works in healthcare.

This? right here? "I built web scrapers instead of the official FHIR API since they're mostly read-only and too limited." ONE, you little shit, FHIR has not ~officially~ been forced onto the healthcare industry, so it's still being baked. We're talking about an industry that required encrypted fax to be invented for them because they were legally tied to the giantest horsecock dildo that is the phone line based facsimile machine. Though I guess it is better that your affront to the divines and humanity didn't profane HL7 more than it is already. TWO, the reason for that is a principle called "least privilege", which is where everyone touching a patient chart is supposed to have the most minimal access required to do their task. Ideally admin staff checking in can only see *that* you have an appointment, and who with, unless you specifically say they can go into your chart and look at it. Many, many, far too many, practices give staff symmetric access so desk staff can see more than they need when they check you in. As employees of the practice that's... ~ okayyy~ in that it's not turbo illegal but it's not great. Anyway so we have a combination of legal frameworks and best practices, which all say when you have an agent or connector it better only collect the most tiniest amount of data as possible to do the SINGLE task that pipe does and then it shuts up and forgets about everything it's seen ASAP except not really, every time anything opens and reads a patient chart that activity needs to be logged and I didn't actually see any such auditing on this "tool". Which is also turbo illegal. So audit logs are part of a larger collection of responsibilities a medical data steward ( like your doctor's office, but could also be a health insurance provider or whatever ) that they 100000000%%%% have to be able to attest to WHO looked at a patient's data and WHEN and WHAT HAPPENED to the data when it was looked at. Because if an unauthorized disclosure or (horror music sting) a BREACH happens, they gotta be able to explain what reallll fuckin detailed-like.

All of the "credentials, 2FA" stuff is about ensuring someone is authorized and authenticated. Authentication means figuring out if the user is *authentically* who they say they are, and not Barb pretending to be Carol. Authorization has to do with what privileges you have once you get there. Barb might *want* to pretend to be Carol because Carol has access to the button that lets you delete the scan that you just made upside down and attached, upside down, to the patient chart. Barb should just suck it the fuck up and ask Carol to do her job instead of letting her pride prod her into stealing Carol's password from under her keyboard.

STARTING OFF. BAD.

Why is that you might ask. Well you see. There are many Rules and Laws and Regulations about the use and exchange of personal healthcare data.

Which is why of course this guy, seeing a well-thought-out and tested technical position, decided "what if i get all of them at once and also the 2FA codes and stored them ALL in the same place with no encryption whatsoever"

but thankfully some people are sensible

The reblog chain is one of the things that makes Tumblr unlike anywhere else. All the notes on reblogs are attributed to the original post, no matter which branch people actually liked or reblogged. We want to keep encouraging conversations, and give contributors the recognition they deserve. 

Soon, you'll be able to like, reblog, or reply to any part of a reblog chain, and that note will go to that reblog's author. Each reblog will have its own counts, instead of one aggregated number from every version of the post. And yes, you’ll be able to like multiple posts in one chain.

If a reblog doesn't add anything, the love flows up to the last person in the chain who did. Your post doesn't lose notes just because people spread it quietly.

Past notes will stay on the original post — we're only changing what happens from here on out. Retroactively re-attributing all of them would be... a lot.

We rolled out a significant change to how notes work on reblogs, and the reaction has been strong. We're not going to pretend otherwise. 

First things first: We're reversing the change. Your feedback in comments, emails, and especially reblogs, made clear that the rollout created problems we need to address before moving forward. We also should have communicated this differently from the start, and we didn't.

We still believe there's a better version of how reblogs can work. One that gives every voice in a chain the credit it deserves. But we want to get there with you.

In the coming days we'll share more on how we plan to do that,  including ways to work directly with some of you on this and future changes before they ship.

nobody wants the shop icon where the account icon used to be 

nobody wants the new video player / image viewer (let us pause ! let us zoom !) 

the only good feature recently has been polls and even that took way too long to properly roll out 

we are STILL fighting in the trenches against spam bots 

Please unfollow/block me if you plan on playing this game.

Yes, pirating counts. I don't want you here. If you don't care about the safety of jewish people enough to do the bare minimum of not fucking playing this game then I'm begging you to reevaluate. If you still are into HP in the year 2023 then I don't know how to help you.

The Official “Phase Three” F.A.Q!

The protest is starting in ONE WEEK on February 1st 12 am est and extends until February 8, 12 am est. I’ve answered the most common questions about the protest above, so make sure to read over everything before sending an ask!

Log off for a week at these dates and times: 

Jan 31:

PST- 9 pm.

MST- 10 pm.

CST- 11pm. 

Feb 1: 

EST-12 am. 

GMT- 5 am.

CET- 6 am.

AET- 4 pm. 

If you don’t see your timezone, use this link. 

On every day from the start of the protest until the end, tweet to the following about why you’re participating in the protest and what you want to be done. Tag each tweet with #phasethree2019. 

@tumblr @tumblrsupport @verizon @yahoo @jeffdonof 

Also, make sure to report the app on the Google Play Store and the App store for “Hateful or Abusive content” due to the hate groups on here.