Perimeter
Guest Blog // Selected Security Content Provided By Sophos
What's This?
9/22/2011
08:58 AM
Dark Reading
Dark Reading
Security Insights
50%
50%

20K Stanford Hospital Emergency Room Patients Have Health Records Posted Online

'An ounce of prevention is better than a pound of cure' adage rings true

20,000 people have joined the ranks of the 11 million+ victims whose personal medical data has been improperly exposed in the past two years. Last week, The New York Times reported that 20,000 records of patients who visited the emergency room at Stanford Hospital in 2009 were posted on the Internet for over a year.

The leaked information included names, diagnosis codes, account numbers, admission and discharge dates, and billing charges. The source of the leak is likely Multi-Specialty Collection Services, a billing contractor for the hospital.

But remember: the “how” of this breach should not be the focal point in this situation. The more important question is, why was the data not protected (encrypted) in the first place?

I see several problems at work in these types of incidents...

First, medical organizations that are required to protect confidential patient data in the United States under the HIPAA and HITECH acts often outsource work to third parties.

Simply inserting some clauses in their contracts to require these third parties to meet these regulations does not ensure the data will be protected.

Secondly, our attitudes—and the laws—around data protection are outdated. If you think you should treat data differently when it is inside than when it is outside, you are setting the stage for a data breach. Think of the many groups of people touch personal health information “internally”—doctors, nurses, billing departments, etc. Each time the data is accessed or changes hands is another opportunity for that data to be compromised.

Confidential information, whether it is sensitive health records or source code to your secret Jesus phone to be released next month cannot be "inside" or "outside." There is no inside.

And thirdly, organizations that cite cost as a reason to not protect their data are setting themselves up for a bigger financial burden in the long run. The average cost of a data breach is $7.3 million. This number includes federal and state fines for noncompliance with HIPAA/HITECH laws, as well as other incidentals like the cost of notifying victims of the data breach and providing them with identity protection services. And don’t forget the non-monetary repercussions like lost customer confidence and bad publicity.

So instead of cleaning up after a data breach, prevent one from happening. Classify your data based upon its importance. Now, based on that classification, take the appropriate actions to control and protect that data. Please?

Chester Wisniewski is a senior security adviser at Sophos Canada

Need help? Check out Sophos’s free Data Security Report to understand what puts data at risk and how to defend against data loss and prevent future breaches.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2184
Published: 2015-03-27
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

CVE-2014-3619
Published: 2015-03-27
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.

CVE-2014-8121
Published: 2015-03-27
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over...

CVE-2014-9712
Published: 2015-03-27
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allows remote administrators to read arbitrary files and obtain passwords via a crafted path.

CVE-2015-0658
Published: 2015-03-27
The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.