deleted

Found the info I was looking for in the article. The documents did not appear to be stored with any kind of encryption... so yeah this was terrible it happened, but it happened partially due to not spending enough on IT resources to guide them on proper practices for handling documents with confidential information and violated HIPAA. As someone who works in the field all patient information must be encrypted at rest or another form of encryption on the data must exist for it to fall within compliance. On top of this only the bare minimum amount of people should have access to this data and absolutely should have audit logs for anyone accessing the data normally through the 3rd party application used to store and lookup the information.

Let me guess without reading the article: The data was stored on an unecrypted drive connected to a computer in a network running with Windows, Active Directory, and Outlook/Exchange?

With that combo, you can just post your "secret" data on the web site, it won't make much of a difference.

Yikes. What a weird, cruel thing for someone to do.

Let's just all post our nudes and get it over with. You go first.

Honestly the whole before/after nude photo aspect of plastic surgery feels so weird even if they're never hacked. No other doctors do this with photos. And I get it, portfolio and all that, but at least offer a discount of something. But everyone? For medical reasons? Not even just kinda creepy, that's meaningfully creepy. And as made evident by this breach, not even a little surprising that they have substandard information security policies. Anybody at the office could probably get access to the shared folder they probably stuff these into. And the doctor's kids all probably know his crappy password that never changes. So so so many ways this could and will go wrong.