TLDR, I stood up to a doctor wanting to make an insecure connection and won.
In a previous life, I worked at a hospital holding company. I received a call from a doctor wanting a connection from the hospital to the Electronic Medical Records (EMR) system at his clinic. Ok, I was good with that until he told me the connection was over telnet. I twitched and told him I could not make the connection over telnet due to HIPAA regulations, but I could do it over SSH. The doc said it had to be over telnet. I told the doc no. Thus starts the rant:
Doc “I will tell your manager.”
Me “My manager will tell you no.”
D “I will tell your director.”
M “You can contact the CIO and she will tell you no.”
D “I will have your job.”
(by this time, I had looked the guy up, he was a neurosurgeon)
M “You can have my job, but it will be a drastic reduction in pay”
(10 seconds of silence. Not sure if the doc is stunned, laughing or furious at me)
D “You can make the connection work over SSH?”
M “Yes sir.”
D “I will not know the difference?”
M “No sir.”
D “It will be secure?”
M “Yes sir”
D “Ok call me back when it is done.”
M “No sir, you will stay on the line and test it when I am done.”
D “How long will it take?
M “In the time we have been arguing, I could have done it 10 times over.”
I created the access, modified his client, and he tested.
D “You are right, I don’t know the difference.”
M “Yes Sir.”
D “Thank you”
In dealing with physicians this was the first time:
- One challenged me
- I had a witty response
- Received a thank you
