'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

https://www.websiteplanet.com/news/eshyft-report-breach/

by Twirrim • 1 year ago

353 186 1 year ago

gnabgib• 1 year ago

Title: Thousands of Records, Including PII, Exposed Online in Healthcare Marketplace Connecting Facilities and Nurses Data Leak

(vs current: "'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket")

booi• 1 year ago

Uber for ___ has lost all meaning

dartos• 1 year ago

Well there be any consequences for the company?

ilrwbwrkhv• 1 year ago

No. And hence this will keep happening.

garciasn3• 1 year ago

Even if there are, it’ll be minuscule compared to what is necessary to drive effective change.

The fine for one person’s information from this site should be equivalent to their entire revenue for the year; should not be permitted to be resolved by bankruptcy, and should be required to transfer to any company purchasing their assets.

Their entire executive team should be jailed for a minimum of 3 years per individual offense.

Only then will there be any modicum of an opportunity for us to see some real change.

1970-01-01• 1 year ago

This is not so firm. Don't underestimate a wealthy person's medical record going public.

ethagnawl4• 1 year ago

I'll need to dig up a source but I recently heard about this company and, apparently, before offering gigs they do a credit report to determine how much debt the person is carrying (i.e. how desperate they are) and they use that information to _round down_ the hourly rate they offer them.

In the unlikely event that there are any negative consequences for this breach, they deserve every bit of them and more.

wewtyflakes• 1 year ago

This is abhorrent if true; truly evil behavior.

timewizard2• 1 year ago

It's amazing that, on a cursory look, only 11 states make this practice illegal. The "AI scriptown" is growing.

inetknght• 1 year ago

You might be surprised to learn that they're not the only company to do so.

Graziano_M• 1 year ago

It's definitely shady, but it's par for the course. Uber charges you more if you have more gift cards loaded, or just spend more on average in general. You charge what the market will bear.

sudoshred• 1 year ago

Game theory transcends basic humanity.

B4CKlash2• 1 year ago

What's interesting is that broadly speaking, people acknowledge that negotiating with asymmetric information is immortal or wrong. Take the stock market for example, insider trading is illegal and you don't often hear calls to reverse these laws.

But when it comes to private markets and semi-private negotiations that same sentiment doesn't easily transfer. Does society benefit in some unique way for allowing asymmetries in labor negotiations, private markets like Uber, or B2C relations like Robinhood (1,2)?

1. https://www.sec.gov/newsroom/press-releases/2020-321 2. Note, Robinhood was fined not for front-runniny customers, just for falsely claiming customers received quality orders. I suspect theyve only stopped the latter behavior.

linsomniac• 1 year ago

I don't remember the source, but I believe I listened to a podcast on an "uber for nurses" (not sure if it was this place), but they do all sorts of nasty things that really shaft the nurses. ISTR that the nurses when they get called in, have to be running a phone app that tracks them, and if they get stuck in traffic or lose cell signal, they get demerits. They pretty much do anything they can to give the nurses a demerit, and demerits cause your pay to go down.

So they're pretty much taking the existing terrible nursing environment in healthcare, and weaponizing it. Nurses already have too many patients and not enough CNAs, on top of 12 hour shifts, needing to do charting after those 12 hours. Healthcare squeezes nurses to the breaking point. Data point: my wife is a nurse.

implements• 1 year ago

I think I heard the same Podcast - not only do the Apps try and discover the minimum rate a Nurse might take, they’ll actively attempt to manipulate the circumstances of Nurses who were in a strong position so they too end up more dependent and exploitable.

rvense• 1 year ago

Isn't this exactly what you'd expect from an Uber for (somethign)?

Garbage company, garbage culture, garbage business model.

TheNewsIsHere• 1 year ago

Several of my family members were or have been nurses for decades and your wife’s experience mirrors the experiences I’ve seen from that distance.

And I’ve heard “it used to be so much worse”.

The American healthcare system is fairly well broken from virtually every angle.

refurb2• 1 year ago

That seems like a terrible way to estimate nurse wages.

People have spouses.

People’s parents pay credit cards.

People with bad credit sometimes don’t care.

People have family money.

People with low debt can be desperate for work.

Does it even work?

DavidPeiffer• 1 year ago

At scale, the corner cases don't really matter. In aggregate, if it's decently well correlated and readily available, it's probably going to be used.

I can't find it now, but I believe LexisNexis or another large similar reporting/data agency had a product catalog of dozens of products that spit out values for ability to pay, disposable income monthly, annual income, etc.

It makes you feel awful thinking about the direction things are headed. Corporations approaching omniscient regarding all facts of our lives that are reasonably of value to them.

crazygringo• 1 year ago

Agreed. And it's not just those -- if you need to pay off debt, you're extra-incentivized to take the highest-paying job, as opposed to one that pays less but is e.g. closer to home, or has a more predictable schedule, or whatever.

The idea that you'd offer less seems... counterproductive to say the least.

jmye2• 1 year ago

I’m interested, given the massive nursing shortages, why any nurses were using this service at all? Especially for higher levels, there’s no reason to mess with a shitty app that underpays you, when you should be able to walk into any provider’s office or facility and get hired almost immediately (and for Runs, you even have wide-ranging telehealth options).

hn_throwaway_994• 1 year ago

This was my thought exactly. There is a giant nursing shortage. I know some nurses who are traveling nurses and they may bank, and they don't need any BS app. (Just want to emphasize, nursing is an incredibly difficult job at the moment, but there are also currently weird dynamics where traveling nurses can actually make a lot more than "stationary" nurses).

Thus, I'm led to believe that nurses using this app have to have some sort of difficulty finding jobs for other reasons, or they're just not informed about their options.

Scoundreller5• 1 year ago

You can get paid more as a contractor than an employee.

Some may just want to pick up casual shifts without any obligation on top of their full-time work. This is kinda double dipping because your full time work is paying your benefits, so why work overtime at time and a half for them when you can get 2x+ somewhere else with + pay in lieu of benefits?

Big orgs don’t want to deal with 1000 different individual contractors (especially if it means taking potential misclassification of employee as a contractor) risk.

I think the bigger issue is the myth of nurse fungibility. A rando nurse unfamiliar with your setup/org is unlikely to be very productive.

vincnetas• 1 year ago

this is the presentation that discusses this wage suppression for nurses.

https://pluralistic.net/2025/02/26/ursula-franklin/

ethagnawl4• 1 year ago

Thanks. This is definitely the source I was referring to.

However, as it applies to my parent comment, the companies mentioned were: Shiftkey, Shiftmed and Carerev. I do not see ENSHYFT mentioned, so I stand corrected.

user999999992• 1 year ago

Proper data privacy laws would make this sort of thing nearly impossible

codedokode2• 1 year ago

In America you can get (buy) someone's credit report without their permission?

marcus0x62• 1 year ago

Move fast and violate HIPAA.

xattt• 1 year ago

Does HIPAA apply to HR into, or just patient health data?

ahstilde• 1 year ago

Protected health information (PHI) under U.S. law is any information about health status, provision of health care, or payment for health care that is created or collected by a Covered Entity (or a Business Associate of a Covered Entity), and can be linked to a specific individual. This is interpreted rather broadly and includes any part of a patient's medical record or payment history.

source: i run Wyndly (YC W21 https://www.wyndly.com), which is most easily understood as a telehealth allergist online.

thfuran6• 1 year ago

It considers non-health-specific identifying info about patients that might be stored with the health-specific info to also be PHI.

kryogen1c• 1 year ago

HR likely deals with health info related to disability or fmla claims, or work-related injuries that is shared with health care providers and/or insurance companies; this makes them a covered entity subject to the requirements under hipaa.

jppope2• 1 year ago

Worth mentioning, because the authority level of medical practitioners throws people off. Don't ever give a doctor or practice your Social Security Number. They don't need it. Similarly if they want to check an ID that doesn't mean scan or photograph. Doctors, practices, etc are the worst at infosec. They have no training, basically no penalties if they do something wrong and all of that info is only to follow up in case you don't pay your bill.

thfuran6• 1 year ago

In the US, HIPAA is pretty much the strongest privacy legislation there is. There's probably no group that would have a more severe penalty for leaking your info than your healthcare provider.

SR2Z• 1 year ago

And yet the data still seems to leak pretty frequently...

jandrese• 1 year ago

HIPAA has strict rules with severe penalties, but enforcement is at best spotty. So honest hospitals and doctors offices bend over backwards to comply with the rules at great expense, but bad actors are rarely punished. It's the worst of both worlds. I'm pretty sure that is why the punishments are so harsh, because they need to put the fear of god into practitioners to make them take it seriously since there are so few inspectors.

scarmig• 1 year ago

Perhaps true, but the strongest privacy protections in the US are still pretty weak. The biggest penalty I know of is Anthem 2018, where they leaked HIPAA-qualifying records on 80 million customers. Their financial penalty was a whopping... $16 million. Two dimes per affected customer!

colechristensen4• 1 year ago

Eh.

Last year the total HIPAA violations fines were less than $9.2 million.

A figure I could find for hospital revenue in the same year which is a good enough proxy for fines vs revenue is about $1.2 trillion.

Which rounding because who cares comes to 0.001% of medical revenue ends up being paid for HIPAA violation fines.

Or the equivalent ratio of about a cup of coffee for a typical enough person per year.

HIPAA needs teeth, what it says you're supposed to do is quite strong, the enforcement of it is pathetic.

slt2021• 1 year ago

PCI-DSS is the strongest, HIPAA is just a rubber stamp

andrewmcwatters• 1 year ago

Only the young and inexperienced believe the law is enforced when it matters.

paulcole3• 1 year ago

How many healthcare providers do you know personally who have faced severe penalties for leaking information?

The reality is that for a small doctor/dental/whatever office, there is essentially 0 risk. HIPAA violations that carry significant penalties go to huge hospitals and healthcare companies.

Your neighborhood doctor has to screw up in a major way for an extended period of time to have a minute risk of any consequence.

eclipticplane• 1 year ago

HIPAA was designed for portability -- the 'p' standards for portability not privacy -- of health info, so there are immense carve outs in service of that objective. Fines for violating HIPAA are almost non-existent.

HIPAA is wildly misunderstood by the public as a strong safeguard, meanwhile medical offices just get any patient (a captive audience) to sign a release waiver as part of patient intake ...

supertrope• 1 year ago

What do you do if they refuse to book an appointment without it?

x3n0ph3n3• 1 year ago

Find a new provider. I have gone 2 decades without providing my SSN to doctors.

mayneack• 1 year ago

I've never had that happen (sample size ~5). They accept non-citizen patients, so they probably don't make SSN a required field.

(for SSN, never tried to prevent scanning of my ID)

jppope2• 1 year ago

You can just use my SSN: 123-45-6789.

RandomBacon2• 1 year ago

In my experience, no one has ever asked it when booking, just when you fill out forms on your first visit. I always leave it blank (and most other things that don't pertain to my healthcare issue) blank and have never been hassled.

I also always ask for a paper copy of the disclosures to sign, saying that "I don't sign blank checks" when asked to sign the electric pad. I've never had an issue with them printing it out, letting me sign, and them scanning it in.

Healthcare "security"/"authentication" is just "protected" by your name and date of birth which is easily discovered for anyone online.

gtirloni• 1 year ago

Why "Uber for nurses" and not the actual company name in the title?

Mistletoe• 1 year ago

It lets me know the company is bullshit in a way the company name never would.

nick__m• 1 year ago

According to the article the name is ESHYFT. It sounds like a brand of electronic found on aliexpress but with less quality!

ks2048• 1 year ago

Please invest in my startup, ENSHITIFY

mhitza• 1 year ago

I wonder how old the S3 bucket was, because at some point AWS made new S3 buckets private by default.

Which means it's either old, or they recklessly opened it up because they couldn't get files uploaded/downloaded to the bucket from their mobile app/services.

bpodgursky• 1 year ago

Also possible a webdev opened it up so they could use the assets on a website, and didn't think about other private data in the bucket.

CaffeineLD502• 1 year ago

Yeah I remember when Amazons AWS was new and people said "hey its cool but not secure." Then AWS added all these security features but added a caveat: BTW security is your responsibility

Here we are. I guess we can blame the users and not any shitty security architecture slapped on AWS.

Clearly what matters most is that legal culpability be avoided, not that users will be secure. The former is 'shite security' while the latter is good security

richwater2• 1 year ago

shitty security architecture slapped on AWS

It's literally, and I do mean this literally, 1 click to block all public traffic to an S3 bucket. It can be enabled at the account level, and is on _by default_ for any new bucket. What exactly more do you want?

dragonwriter• 1 year ago

It's literally, and I do mean this literally, 1 click to block all public traffic to an S3 bucket.

I'm reasonably certain that for quite a while blocking all public access has been the default, and it is multiple clicks through scary warnings (through the console; CLI or IaC are simpler) to enable public access.

wsatb• 1 year ago

The only mistake AWS made was making buckets originally public by default. It’s been many years since that’s been the case. At this point, you have to be completely ignorant to be storing PII in a public bucket.

jihadjihad• 1 year ago

In the section of their Privacy Policy titled Data Security [0]:

We use certain physical, managerial, and technical safeguards that are designed to improve the integrity and security of information that we collect and maintain. Please be aware that no security measures are perfect or impenetrable. We cannot and do not guarantee that information about you will not be accessed, viewed, disclosed, altered, or destroyed by breach of any of our physical, technical, or managerial safeguards. In particular, the Service is NOT designed to store or secure information that could be deemed to be Protected Health Information as defined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

IANAL and all that, but I’m not sure you can use the excuse “We didn’t design our system to be HIPAA compliant, sorry,” and hope your liability disappears. Does anyone know?

0: https://eshyft.com/wp-content/uploads/2019/06/ESHYFT-Privacy...

colechristensen4• 1 year ago

[Nevermind]

johann8384• 1 year ago

The PII of the nurses being accidentally shared by a staffing agency isn't a HIPAA violation. Yes the nurses are providers but their relationship with the Uber for nurses service isn't a medical provider relationship. It's definitely a legal and ethical failing but I don't think it's a HIPAA one.

refulgentis• 1 year ago

I'm confused because the article lays it out by the 4th paragraph, and you have the right understanding, up until "we're a startup"

Maybe you think the startup maintains patient records?

The article lays out the nurses uploaded them, the provider. This is a temp booking system. The health records were uploaded by the nurses to communicate reasons for absences to their employee and weren't required or requested

They have as much responsibility as Dropbox does. Nurses shouldn't have uploaded them.

tclancy• 1 year ago

If you're not a direct health provider, you probably can. Don't take that as an endorsement.

skue2• 1 year ago

If you partner with a healthcare provider to provide any sort of technical services, you will be required to sign a BAA (Business Associates Agreement), which makes you similarly liable to the HIPAA & HITECH acts.

weezin3• 1 year ago

HIPAA applies to patient data not providers data.

I also saw what appeared to be medical documents uploaded to the app. These files were potentially uploaded as proof for why individual nurses missed shifts or took sick leave. These medical documents included medical reports containing information of diagnosis, prescriptions, or treatments that could potentially fall under the ambit of HIPAA regulations.

It looks like providers accidentally uploaded some PHI.

IANAL so may be wrong, but I worked for a healthcare company. Whether HIPAA applies to them depends on if they are considered a covered entity or a business associate [0].

IMO they aren't bound to HIPAA requirements as a covered entity.

Business associate is a little tricky to determine. But business associates have to sign a BAA (Business Associate Agreement). And I doubt they would have signed one if they have that in their privacy policy.

Also just as a side note, HIPAA is not a ideal standard to begin with for security. Many large companies exchange bulk PHI via gmail since it is HIPAA compliant..

0: https://www.hhs.gov/hipaa/for-professionals/covered-entities...

hn_throwaway_994• 1 year ago

Also just as a side note, HIPAA is not a ideal standard to begin with for security. Many large companies exchange bulk PHI via gmail since it is HIPAA compliant.

You seem to imply using GMail is a bad thing? I think GMail, when appropriately configured to handle PHI, is probably a million times more secure than some crappy bespoke "enterprise" app.

SkyPuncher4• 1 year ago

HIPAA only applies to a very specific entity called a "covered entity". At a high level, "covered entities" are health care providers that accept insurance or insurers. That's right, there's a massive caveat on "accepts insurance". You can be a healthcare provider and do not have to comply with HIPAA if you don't accept insurance.

That being said, HIPAA isn't even relevant here because "ESHYFT" is just a provider a labor. No different than a big consultant providing staff augmentation services.

hn_throwaway_994• 1 year ago

At a high level, "covered entities" are health care providers that accept insurance or insurers. That's right, there's a massive caveat on "accepts insurance". You can be a healthcare provider and do not have to comply with HIPAA if you don't accept insurance.

Again, HIPAA continues to be the most colloquially misunderstood law out there.

The rule that makes providers "covered entities" isn't really about insurance, it's about whether they transmit specific HIPAA "transactions" electronically. Now, yes, most of these transactions having to do with providers are thing like claim submissions or pre-authorizations to insurance. But there are other reasons a provider may need/want to send a HIPAA transaction electronically.

My point is that there isn't some sort of "loophole" where providers that don't accept insurance are somehow being sneaky. The whole point of the HIPAA security rule is to protect PHI when it is transferred around to different entities in the healthcare system. If the information is going just between you and your doctor, HIPAA isn't relevant, and that is by design.

hansvm• 1 year ago

HIPAA doesn't care about your POS TOS. It either applies or does not.

That said, it's both less broad and more toothless than I'd like. If FB convinces you to install a tracking pixel (like button) stealing your private medical data, they likely haven't violated any laws. At most you'd be able to file a claim against the person who created the leak.

Not a lawyer and all that, but for TFA I don't think HIPAA would be a valid way to try to limit your losses. It's a bit closer to what would happen if you (a doctor) uploaded patient data to Google Drive and then somehow leaked that information (one of Google's contractors disclosing it, a hack, whatever). Nothing about ESHYFT's offerings requires or would be benefited by the data HIPAA protects, and (ignoring incompetence and other factors) I'd be as surprised to see my health data leaked there as I would to see a YT video going over my last lab reports because of some hospital's actions.

They could still be liable for all sorts of other damages (and maybe somebody can convince a court of a HIPAA violation), but it's not an easy HIPAA win.

ripped_britches• 1 year ago

What makes this uber for nurses?

ants_everywhere• 1 year ago

It's Kelly Services for nurses, but Uber sounded cooler 10 years ago

rad_gruchalski• 1 year ago

Maybe nurses come over by Uber.

dikaio• 1 year ago

Would be surprised if this company makes it out of this. Medical records…. Yikes

xyst• 1 year ago

A company of this size definitely wouldn’t be able to tank a multimillion dollar lawsuit.

SamuelAdams• 1 year ago

I am confused, the article seems to be short on details. Was the attack an open S3 bucket? The company in question seems to be hiring for GCP, so I imagine they don’t use S3 at all.

Did the submitter intentionally change the post title to get more clicks?

https://eshyft.com/careers/gcp-devops-engineer/

colechristensen4• 1 year ago

Multi-cloud isn't uncommon, especially interacting with vendors. It has been a long time since I've worked somewhere that didn't have at least some usage in more than one cloud provider.

whatever12• 1 year ago

I thought the cloud was safe, that is why you pay premium.

morkalork• 1 year ago

They just sell pick axes, they don't care if you plant one right through your foot.

whatever12• 1 year ago

No that is not the sales pitch to enterprise customers. They are pitching that sys admins are stupid and that security nowadays is too complicated, hence cloud is the only safe solution.

Yet every month I see a story here about an huge data leak from an unrestricted bucket.

markus_zhang• 1 year ago

What a surprise. How do we, the common people dealing with corporations and governments leaking out information left and right? Even password storage services are not really safe AFAIK.

9999000009992• 1 year ago

Are y'all gonna blame AWS like you blamed Firebase last week ?

The security procedures I take while hacking out something for my friends at 3am should not extend to products hosting PII. It's up to YOU to implement basic data security.

onion2k• 1 year ago

It's up to YOU to implement basic data security.

You definitely need to do this, but a platform should help where possible, and try to have users fall into a 'pit of success' where if a dev just goes with the defaults everything is fine. In this case, S3 buckets should be private and encrypted by default and devs should need to actively choose to switch those things off (which I think may be the case now, but it wasn't in the past.)

9999000009992• 1 year ago

This is like having a small store and instead of locking up at the end of the day, blaming the door for not automatically locking. Yes new automatic locks exist now, but you still need to check.

Cloud technology allows us to build fantastic software very fast. But if you’re too lazy to implement a basic api to get S3 data on a needs to know basis, that’s on you.

AWS makes this very easy. You can’t blame anyone else.

jeffhuys• 1 year ago

S3 buckets should be private and encrypted by default and devs should need to actively choose to switch those things off

Yeah, that's the case right now. There's multiple screens you have to go to, that almost scream at you that you're making EVERYTHING PUBLIC. Also, in the overview, it distinctly says "!! PUBLIC".

bigfatfrock• 1 year ago

Sorry for the dude that built their infra and was really tired and then woke up to this, what a bummer.

elevatedastalt• 1 year ago

Annual reminder that the P in HIPAA stands for Portability, not Privacy.

RobotToaster• 1 year ago

Why does this keep happening? It seems like every month there's a new leak from an open S3 bucket?

dmix• 1 year ago

New companies with immature systems, old companies hiring young developers doing side stuff off in their own world, bad default configurations etc

Most importantly there's a large amount of highly incentivized people probing constantly at mass scale. These days it's very easy to scan the internet (github, IPs, domains, etc) for information and "bad S3 configuration" detection is just a script anyone can use. No advanced programming skills required.

reustle• 1 year ago

S3 (and most of AWS) is terribly designed, so you end up googling for access policies that likely work when you are trying to get a new project off the ground. That policy may not be right for prod in the future.

Not saying it is right, it's just what happens.

j45• 1 year ago

I wish private data was more independently audited.

albert_e• 1 year ago

The linked article does not mention Amazon S3 or AWS

Is there a different source for the "open S3 bucket" in HN title?

devonbleak• 1 year ago

I had the same thought. Closest I can tell there's screenshot that looks like s3 console listing csv files if you click over far enough in the carousel.

arresin• 1 year ago

Always. Always the open bucket.

tmpz22• 1 year ago

Are we pretending that there are still functional regulatory agencies that are able to take action over this?

fads_go• 1 year ago

The person working the hardest to find these is then immediately shutting them down. Makes government more efficient.

mordae• 1 year ago

Now if only this data found its way to some union organizer.

littlestymaar• 1 year ago

When do we start making that kind of thing criminal negligence with prison sentences for this kind of bullshit…

amelius2• 1 year ago

It is really unfair, the way capitalism treats nurses (and police officers, school teachers). Without them, the entire system wouldn't even exist. Capitalism may sound like a great idea at first, but in the end you have a few rich bastards milking the rest.

piokoch• 1 year ago

It has nothing to do with capitalism. You can have capitalism and society that is aware that having good public services pays-off, as overall spending on schools, security, etc. will be smaller if done at the whole country level.

In the USA it is not that easy to achieve, as, historically, it is not a single country but a union of "states" that is countries, so the main boss should not interfere too much with local bosses and force on them particular "federal" laws.

amelius2• 1 year ago

That doesn't answer whether it is fair. Capitalism will always push for a smaller government and with all the power they have at their disposal. At the same time, why can capitalists have their rich-making business schemes while nurses and other (semi) public servants are stuck with whatever society decides is good for them? The system is rigged in favor of capitalists.

_xtrimsky• 1 year ago

it has nothing to do with capitalism. this company could have hired a cheap student, that would have known best AWS practices and would have kept it secure. at the same time a communist government with lots of funds, could have made this mistake.

user999999992• 1 year ago

Close it. Sell off all the assets and give the proceeds as compensation to those whose data was exposed. Why do we have a human death penalty but not a corporate one?

game_the0ry2• 1 year ago

Incredible. Healthcare is a busted industry through and through. Even the tech companies that serve it are incompetent. There are so many things wrong here:

- the uber-fication of nursing, bc of cheap and corporate owned hospitals won't just hire them as w2 employees

- cheapness probably led hospitals to this crappy app, which probably gave kick backs to the admins that approved it

- this should totally bankrupt the ESHYFT, but more likely nothing will happen

zero_k• 1 year ago

Bankrupt only? It should also be criminal negligence. Until some exec goes to jail, this kind of stuff will keep happening. Someone was (likely is...) making good profit out of this business by not investing in IT security. They cheaped out, and other people paid the price, who didn't have anything to do with the profit of the company. Watch out for the execs going around in a few years giving talks about how to build a successful company. If we let this kind of behaviour have zero repercussions, the public will continue to pay the price of private profits.

game_the0ry2• 1 year ago

Do not disagree here. As long as it is on the CEO and head on eng. No some poor intern.

franktankbank2• 1 year ago

I'm really curious about the kickbacks comment. I'm sympathetic to it but how do you root it out practically? Noone has much incentive to fix it because the people aware of the ill doing are the ones benefiting from it.

Scoundreller5• 1 year ago

To some extent, apps like this keep independent hospitals/providers viable.

A big bad health system will have its own “float” pool of W2 nurses or internal offer system.

Heck, that’s part of the “sell” when selling out: to get access to a robust vacation/vacancy handling system.

only-one1701• 1 year ago

As an AWS Solution Architect - Associate, I can confidently say they should’ve been using AWS Macie (tongue in cheek btw)

kittikitti• 1 year ago

How does the medical and healthcare industry that is notorious for gatekeeping have these problems? Leaving a database open and unprotected is just hard to understand given the levels of red tape you have to complete to develop in this space. Theranos was jailed and defamed whereas this will likely cause more damage as a whole (instead of some billionaires becoming slightly less rich).

donatj• 1 year ago

Huh, I worked for an agency and built a site that was essentially "Uber for Nurses" back in 2010. I was immediately like "it's not them is it?" No, seems they shut down in 2017.

As far as I know, never really took off, at least while I was maintaining it, but the gig economy wasn't in full swing yet.

All that said, the sheer number of forms and amount of paperwork the site required you to fill out just to sign up had to have been a limiting factor in getting you in the door. Real high friction getting people in the door.

I wonder if Eshyft was able to somehow simplify the process.

Scoundreller5• 1 year ago

You were probably too early.

Covid lead to a wave of quitting, retirements, sick calls and increased health care demand so nurses could flex their spot in the market place and get the new market rate through contracting.

insane_dreamer• 1 year ago

“Uber for X” has become equivalent to “let’s extract as much value as possible out of X for the benefit of some Big Corp while making the experience as horrible as possible for the people this is supposedly benefits” (drivers, nurses).

redwoolf• 1 year ago

This is shameful. S3 buckets have not been public by default for many years. You have to make a choice to make them publicly accessible. And to not have the contents encrypted at rest. I just can’t.

The lack of respect that some companies have for their customers is appalling.

dhab• 1 year ago

I know I won't be able to dig it up, but certain that I read this research paper where they concluded in words to the effect that jobs which require a bit of passion are the most underpaid/overworked - e.g. teachers, nurses, musicians, sports-people.

localghost3000• 1 year ago

I’ve worked in healthcare tech and this is pretty bad. You get fined per patient record and it’s not cheap. You also get put on a “wall of shame” where anyone who might do business with you in the future can look and see. You can also be held personally liable if you mess up. It’s really intense.

At my old job we didn’t even allow PII to pass through our API so we couldn’t accidentally log it and kept all of it in its own VPS totally isolated from the rest of our system. When we needed a record we’d put it into an S3 bucket and hand back temp link that only the caller could access (and expired within a short period of time) Total pain but you could sleep at night.

'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

Related Stories