So, I've got a bit of a moral dilemma that's been bothering me lately. This will more than likely turn into a wall-o-text, so just skip to the end for a TL;DR summary. Alright, here it goes.
I've come to hate my job. My boss promises things and never delivers, too many things to count. He overworks and underpays all of his staff, myself included. We do IT support for a ton of offices in the medical field, so not only do we get to deal with the general help desk stuff, but we also need to deal with HIPPA and other regulations.
So, let's get into some of the issues I don't like:
He has charged, and is still charging, some clients for services we are not performing. The major one being off-site backup. When I first started back in 2008, they were promising off-site backup to half of the clients but the backup program was still in development. 2 years later and it's still in development. It's half working but not in any condition to be sold as a product, more like an alpha/beta.
He also has us use a lot of pirated software to fix computers or maintain them. We have a single license of a backup program that is for one server. The program costs ~$1,000 USD. We currently have it installed on every server we monitor, which is about 100. He hired someone to redo our website and pretty up some marketing information, but refused to buy the Adobe products needed to make those changes (part of our site is in Flash). She ended up doing basic IT work and quit for a better job. We use OEM Windows keys on other computers, which violates the EULA. The list goes on.
He has caused data loss for several clients from dumb mistakes. In one case he wanted to find out which breaker cut off power to a certain area. So, he tells me to go into the breaker room and flip the switches until his multimeter doesn't read a current. I go through them and we find out that it must be controlled outside of our building or on a different breaker. In the process of doing this, we caused a server to go down that was rebuilding a RAID. This was at around 6pm on a Friday. We worked on that server until about 2am before calling it quits. We had run a backup on this server a week before we brought it in to upgrade it, but the backup never finished because the data set was so large. We were able to recover the majority of his data, but they lost a few weeks of appointments, images, notes, and documents. He blamed it on their previous IT company.
The most recent case is a similar story. Some of our clients are multi-office, so instead of doing an off-site backup to us, we just transfer office-to-office, makes sense, right? Well, he wanted to make it so we can check when this sync job was last run and have the ability to check it over SNMP, standard stuff. I told him what needed to be done and he does it. 2 weeks later we get a call from the office saying they are missing images, most are needed for insurance and legal reasons. It turns out that he just edited an existing job that deleted all local content in a specific directory first, and then grabs data from the remote server. In essence, instead of syncing between offices, he caused it to delete EVERYTHING that was supposed to be synced on one office and then have the remote office send stuff over. We tried data recovery with free utilities, but this wasn't good enough. Instead of purchasing proper software, he told me to install a pirated version of On-Track. In the end, nothing was recovered because the data was most likely overwritten. He blamed it on the medical software they used and user error on the office's part.
The same day we found out, and realized that we couldn't recover anything, he asked me if I could modify the database files to make it look like they never took the images. I told him I wouldn't do it because it's unethical and illegal. Not 20 minutes later he comes back and asks if we can just replace the missing images with duplicates from the same patient or other patients. I told him that if he wanted to do it, it was all him and I wanted nothing to do with that. Not only would that screw up the patient, but I'm sure the insurance company would know and accuse the office of fraud.
Another issue happened the same day we found out about the data loss, and this pushed me over the edge. He had one of our sales people call a possible new client to bid on the job. Apparently, she told the office who gave us some confidential information and that pissed off the office we called because no one was supposed to know. Now, this doctor works next to the doctor we used as a reference and whose name she slipped. Doctor A accuses doctor B, our client, of leaking information and doctor B bitches at us. My boss told him that we never said anything and that we record all of our calls and he has the audio file to prove it.
Turns out he was wrong, we did say his name. He comes to me and asks if I can edit the call to remove that bit where the name came out. I told him it's not easy and that I don't feel right doing it. 30 minutes later, the sales lady comes up and asks me the same exact thing, thinking I'd do it for her since she asked. My boss asked her to ask me. He wanted me to forge call logs to clear his name.
I'm in the process of finding a new job and I have a few places that are looking good. Real companies with real software and real management. I'm torn whether or not to tell the clients the truth about what happened to their data, the lies about what they are being charged, and what goes on behind the scenes. I am also torn on whether or not to turn them in to the BSA for piracy. Any opinions or experiences?
TL;DR Summary:
Boss lied to clients, charged them for services we don't provide, uses pirated software, caused data loss and blamed others, and asked me and others to do unethical things to clear his name.
