22. Juli Ann Quinn "Telemedicine was a byproduct of COVID-19."

Hoala Greevy: Mahalo, Olena. Great to be here.

Hoala: Yes, that's right, Olena.

So for the first time since launching Paubox in 2015, we submitted an application to the Inc. 5000 list. The list from inc.com is a ranking of the 5000 fastest-growing private companies in America.

Its rankings are based on percentage revenue growth over a three year period.

They do that, you know, we did have to send tech like tax returns, and I think we had to get our CPAs to sign off on it.

And long story short, I'm pleased to say that we ranked number 320, which puts us in the Upper 6% of the list, which also puts us in the Inc. 500 list. So pretty excited about that! I think, have some good morale boost for the company.

And I just like to say Mahalo to our Chief Operating Officer, Rick Kuwahara, for getting the supporting documentation submitted on a tight deadline.

It kind of came out of left field and we got it all done in, I think, a week or something. That's fantastic. Such an honor.

And so they have a list of the 5000 fastest growing and then they also have a list of 500.

So we made the Inc. 500.

And for us, it reinforces some things we firmly believe in here in Paubox, and it's basically three things, right.

So, one, the total addressable market for what we're doing, HIPAA compliant email, is indeed humongous.

Number two, there will continue to be immense opportunities and work ahead for us.

And three, we're just not stopping. We're still very much just getting started. 

Hoala: Oh, thanks.

Hoala: Yeah, that's right. Olena. It'll be from October 21 through October 22.

Its naturally going to be an online virtual conference just like everyone is doing these days in COVID.

And we've got half a dozen top-notch speakers lined up. And we're getting more of them and filling out the schedule.

And we're pleased to announce that HITRUST will once again be a strategic sponsor of ours this year.

And for more information, you can just go to PauboxSECURE.com to get more information on this year's conference.

That's PauboxSECURE.com.

Hoala: Yes, it will be our first virtual one, the other two we held in first in San Francisco. And so we're just like everyone else being forced to learn how to how to do something on virtual and online.

So looking forward to it, I think we can put together some valuable content for our customers and attendees. So very much looking forward to October 21 and 22.

Hoala: People in security and healthcare or healthcare enthusiasts in general, I believe we do a survey at the end of our first two conferences, and if I'm not mistaken, 100% of respondents said they did find value from attending our conference, so I do highly encourage people to again.

Hoala: Sure.

So, I woke up this morning to a text from one of our advisers, Eric Nakagawa, also an early investor in Paubox. And he sent me a link to a Reddit thread posted this morning that outlined how a PDF entitled “No Need To Hack When It’s Leaking” came into being.

And in a nutshell, this Reddit thread and subsequent report focuses on leaks of protected health information via GitHub. And this researcher's journey into finding and eventually helping protect for 100 to 100,000 to 200,000 individuals who had records stored there.

And so, in a nutshell, what happened is, GitHub is a place where tons of companies store their source code. GitHub makes sure that the branches and versions get taken care of so that you don't have to do it internally.

You can just have GitHub, post your code, you paid in a small fee per year. And you can grant access to your code for your developers, or even make your code public to the internet.

So, this researcher, I hope I get pronunciation, right, Jelle Ursem, a security researcher in the Netherlands. What he did was, he did some like basic poking around and he found two errors that 9 U.S. healthcare entities had mistakes in.

And so the first error was is this practice of storing the login credentials, that your code needs to access data, storing those login credentials i.e. username and password in the code, rather than separating them out of the code as a configuration option, that the code reads from a separate file, basically.

So that's Mistake number one, the credentials are stored in the code.

Then mistake number two is in GitHub, you can have your code marked public or private, so private, you know, only you and your developers can see and check out the code. Public, anybody can download the code and use it or fork it for their own use.

And so these 9 healthcare entities, in addition to embedding hard-coded login credentials, also mark that code is public.

So in other words, username and passwords are there on GitHub for anyone to see, and apparently, he started finding these things within 10 minutes of searching.

Looping this back to HITRUST and which is why we're so tightly aligned with HITRUST, because we really like what they're doing. And it validates our approaches to security. So when we went through our recertification process this year, which is in itself is a journey, one of the many hundreds of controls we had to prove was that we do not co-mingle, user login in our source code.

So, we had to test that we're not doing this and then document that we're not doing this. So this is part of our HITRUST. This is why it rang a bell to me when I read this morning.

And then, in addition, this practice also breaks one of the rules behind the 12-factor app. Specifically rule number 3, separating config from code. And if you want to learn more about the 12-factor app, it's just 12Factor.net number 12 factor dot net.

Anyhow, long story short, it's a 35-page report. And it focuses on 9 U.S. head healthcare entities whose sum total exposes at least 150,000 individuals protected health information.

And that's probably only the tip of the iceberg. I'm pretty sure there's a whole lot more.

Hoala: Yeah, for sure. I'm sure this is gonna get picked up. I'm sure it's gonna hit. I mean, it's a Monday. I'm sure it's gonna get more news from for sure.

Hoala: It's a popular service that developers use and almost every startup that I know uses, including Facebook and the biggest companies you can think of, and they use it as a place to store their source code.

So if you've got a team of 5, 10, hundreds of developers, you know, it's a place where they can store the code, check out the code, merge the code. And it just makes shipping code, you know, you have a source of backup version control, things like that.

Most of the internet, well, at least these companies I know of are GitHub users. And then Microsoft bought them, I think, a year and a half ago, for a lot of change.

Hoala: Yeah, and what's freaky is, you know, you could have a business associate, like a vendor of yours, that's, you know, has side projects of theirs. Where they're trying to make some interpretations of your data, for example, and they could be the source of the leak.

So it's not just the healthcare organization itself. It's also the vendors that use it.

HITURST is just a great thing. To invest your company's resources in because it proactively addresses things like this.