Perimeter
Guest Blog // Selected Security Content Provided By Sophos
What's This?
9/22/2011
08:58 AM
Dark Reading
Dark Reading
Security Insights
Connect Directly
RSS
E-Mail
50%
50%

20K Stanford Hospital Emergency Room Patients Have Health Records Posted Online

'An ounce of prevention is better than a pound of cure' adage rings true

20,000 people have joined the ranks of the 11 million+ victims whose personal medical data has been improperly exposed in the past two years. Last week, The New York Times reported that 20,000 records of patients who visited the emergency room at Stanford Hospital in 2009 were posted on the Internet for over a year.

The leaked information included names, diagnosis codes, account numbers, admission and discharge dates, and billing charges. The source of the leak is likely Multi-Specialty Collection Services, a billing contractor for the hospital.

But remember: the “how” of this breach should not be the focal point in this situation. The more important question is, why was the data not protected (encrypted) in the first place?

I see several problems at work in these types of incidents...

First, medical organizations that are required to protect confidential patient data in the United States under the HIPAA and HITECH acts often outsource work to third parties.

Simply inserting some clauses in their contracts to require these third parties to meet these regulations does not ensure the data will be protected.

Secondly, our attitudes—and the laws—around data protection are outdated. If you think you should treat data differently when it is inside than when it is outside, you are setting the stage for a data breach. Think of the many groups of people touch personal health information “internally”—doctors, nurses, billing departments, etc. Each time the data is accessed or changes hands is another opportunity for that data to be compromised.

Confidential information, whether it is sensitive health records or source code to your secret Jesus phone to be released next month cannot be "inside" or "outside." There is no inside.

And thirdly, organizations that cite cost as a reason to not protect their data are setting themselves up for a bigger financial burden in the long run. The average cost of a data breach is $7.3 million. This number includes federal and state fines for noncompliance with HIPAA/HITECH laws, as well as other incidentals like the cost of notifying victims of the data breach and providing them with identity protection services. And don’t forget the non-monetary repercussions like lost customer confidence and bad publicity.

So instead of cleaning up after a data breach, prevent one from happening. Classify your data based upon its importance. Now, based on that classification, take the appropriate actions to control and protect that data. Please?

Chester Wisniewski is a senior security adviser at Sophos Canada

Need help? Check out Sophos’s free Data Security Report to understand what puts data at risk and how to defend against data loss and prevent future breaches.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1032
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before 3.4.5 for EPiServer allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party inf...

CVE-2012-1417
Published: 2014-09-17
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.

CVE-2012-1506
Published: 2014-09-17
SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from th...

CVE-2012-1507
Published: 2014-09-17
Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3) uri parameter to index...

CVE-2012-2583
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers to inject arbitrary web script or HTML via the body of an email.

Best of the Web
Dark Reading Radio