I am a participant in a longitudinal study.
Periodically I am asked to answer questions in an online survey that:
- verifies my info (address, phone, email)
- verifies my contacts (name, address, phone, email)
- asks about recent doctor visits, prescriptions, hospitalizations, etc.
The login credentials are:
- login=email
- password=date of birth
But it gets worse: you can login to a partially completed survey and information previously entered has been saved.
I know this is terrible from a vanilla compsec standpoint; but isn't this information covered by HIPAA? What can I tell this organization to get them to understand the severity of this?
Periodically I am asked to answer questions in an online survey that:
The login credentials are: But it gets worse: you can login to a partially completed survey and information previously entered has been saved.I know this is terrible from a vanilla compsec standpoint; but isn't this information covered by HIPAA? What can I tell this organization to get them to understand the severity of this?