Hospital Assigned Senior Doctor a Separate PC for Personal Use After Repeated Malware Issues

Security

ON CALL

Support chap told to either allow blatant policy violations or find a new job

Welcome to a fresh edition of On Call, The Register‘s weekly look at the challenges IT support professionals encounter.

This week’s tale comes from a reader we’ll call “Mason,” who once provided technical assistance for a hospital’s research laboratories.

One of the labs was run by a physician who was among the world’s leading organ‑transplant researchers. Mason noted that the doctor’s workstation frequently became infected with malware, a pattern that repeated several times each week.

The doctor’s habit of consuming adult entertainment was widely known throughout the facility, and each incident violated multiple workplace policies. Mason repeatedly raised the issue with his supervisor, but the doctor’s senior status meant no corrective action was ever taken.

When a destructive cyber‑worm struck the hospital, investigators discovered logs tracing the outbreak to the physician’s PC. The doctor had been using it for personal activities at the exact time the worm propagated.

Mason expected disciplinary measures, but instead the physician negotiated a compromise: he would use a dedicated machine, salvaged from the hospital’s e‑waste, for any personal or intimate pursuits, reserving his primary workstation for official duties.

The IT team refurbished the discarded PC and delivered it to “Doctor Pervert,” as Mason’s boss referred to him. Mason protested the arrangement, warning that it exposed the hospital to legal risk and squandered resources, yet his supervisor responded that the CIO had instructed him to comply or seek another position.

After the special PC was installed, malware infections dropped to roughly once per year, typically after the machine became so compromised that it no longer served its original purpose. Eventually, Mason resigned while the designated PC remained in place.

Years later, the physician’s graduate students filed a lawsuit, citing the separate computer as evidence that the hospital was aware of the doctor’s activities and had facilitated them rather than addressing the policy breaches.

Source link