Many major healthcare providers use Epic Systems (https://www.epic.com/) software to manage patient records. At about half a dozen independent institutions, I’ve watched receptionists and Drs go from logging in to Epic (which contains all my and other patients health records, clinician notes, test results, etc.) to Facebook or email or general internet browsing. This smells and seems to be one phishKit or rootkit away from putting people’s health data at risk.
Why are these systems not airgapped or at least run on dedicated, restricted devices and networks that only allows Epic Systems activities?!
