(A security pro’s eye-opening (and slightly terrifying) visit to the doctor’s office)

The Setup: Waiting for My Annual Checkup (and Accidentally Becoming a Hacker)

I was lying on that dreadfully cold exam table, staring at the ceiling tiles that had seen way too many secrets, when I decided to kill time on my phone. The office Wi-Fi was

free and apparently on the same network as the doctor’s patient management system—because apparently, my health is worth less than a Starbucks latte—but I figured, “What’s the worst that could happen?” Then I heard screaming from the next room. Not the “I found a weird mole!” kind of scream. The “SOMEONE JUST STOLE MY IDENTITY AND IS NOW PRESCRIBING ME VIAGRA FOR LIFE” kind of scream. OK… that part didn’t happen.

My doctor walked in, clipboard in hand, ready to ask the five questions that cost me $35. I was already questioning the value of this visit when my security-pro brain kicked into overdrive. I started poking around the office’s digital setup—and what I found made me question whether I should trust this place with my life. (Spoiler: The answer is complicated.)

The Digital Time Capsule: Windows XP, Take Me Back (to 2004)

First, I noticed the computers. Not just old—abandoned. Running Windows XP SP1, a system so outdated that Microsoft stopped supporting it 10 years ago. That’s like leaving your front door unlocked with a “Free Candy Inside” sign for cyber-criminals. But wait—it gets worse.

• The X-ray machine? Running XP.
• The patient records system? XP.
• The printer that holds my medical history? Also XP.

This isn’t just bad IT—it’s like a haunted house, where every ghost is a hacker waiting to exploit a known vulnerability. I tapped my doctor on the shoulder and said, “Hey, I don’t mean to be that guy, but… is this stuff supposed to be this easy to hack?” (He did not laugh.)

The Wi-Fi: “Free Password? More Like ‘Free Backdoor’”

Then I checked the Wi-Fi network.

• No password? Check.
• Broadcasting its name like a neon sign? Double check.
• Using WEP encryption? (The digital equivalent of writing your PIN on a Post-it under your keyboard.)

I could’ve walked in, connected in 30 seconds, and started reading files like they were a buffet. But why stop at just my records? With access to the network, an attacker could:

✅ Steal patient data (medical histories, prescriptions, credit card info).
✅ Change medication dosages (ever had a doctor prescribe the wrong pill? Now imagine it on purpose).
✅ Lock down the system with ransomware (ever seen “PAY US $500 OR YOUR X-RAYS ARE GONE FOREVER”? No? Too soon.).
✅ Impersonate a doctor and email fake test results to pharmacies.

(Cue the sweating.)

The Grandma Password Policy

The office’s file storage was even more concerning.

• No passwords? Just “Windows Workgroup” sharing—meaning anyone who plugged in a USB drive could walk away with every patient’s medical file.
• The backup system? Had its own Wi-Fi network with a web portal—basically a “Free Loot Box” for hackers.

I asked the doctor: “Do you at least have a rule like ‘No sharing passwords with strangers’?” He blinked. “…We have a rule about not eating in the exam rooms.”

(This was not reassuring.)

The Good News: They Fixed It (Sort Of)

I didn’t just come here to panic—I came to help. I explained the risks, showed them how easy it would be for someone to exploit these flaws, and (thankfully) they took it seriously.

Within a few weeks:
✔ Upgraded all systems (no more XP time capsules).
✔ Set up Active Directory (so passwords aren’t “password123” anymore).
✔ Added security training (because even doctors need to know not to click “Open” on suspicious emails).
✔ Encrypted everything (so if a laptop gets stolen, my medical records aren’t up for auction on the dark web).

Progress! But here’s the thing—this shouldn’t have been a big deal.

Why This Matters (Even If You’re Not a Tech Nerd)

You don’t need to be a cybersecurity expert to care about this. Your health data is some of the most valuable (and dangerous) information out there.

• Identity theft? Steal someone’s medical records, and suddenly they’re getting fake prescriptions or denied insurance.
• Blackmail? “Pay me $1,000 or I’ll tell your doctor you have HIV.”
• Wrong treatment? A hacker changes your blood type in the system—now you’re getting the wrong transfusion.

(Yes, this has happened before. No, it’s not a joke.)

What You Can Do Next Time You Visit the Doctor

1. Ask:“How do you protect my digital records?”
   • If they say “Uh, we have a password?”—run.
2. Check for HTTPS (the little lock 🔒 in your browser). If it’s not there, your data is in plaintext.
3. Report suspicious activity. If you see outdated systems or no security, tell them—politely but firmly.
4. Assume someone is watching. Because they might be.

The Bottom Line: Healthcare Should Be Safe (Even Digitally)

Doctors save lives. But if their systems are hacked, they might accidentally kill you.

This wasn’t about blaming anyone—it was about waking up. Most doctors and clinics don’t realize how vulnerable they are. But now that we know, we can fix it.

So next time you’re waiting for your appointment, do me a favor: Check the Wi-Fi password.

(And if it’s still “password123,” maybe bring this article to the front desk.)

Final Thought:
“If a bank had this level of security, they’d be robbed in 10 minutes. If a hospital has it? People die.” Let’s not let that happen.

References:
“HIPAA at DSHS.” Health Insurance Portability and Accountability Act (HIPAA) Home. Ed. DSHS. Texas Department of State Health Services, 1 Nov. 2010. Web. 10 Mar. 2014. https://www.dshs.state.tx.us/hipaa/