Perimeter
Guest Blog // Selected Security Content Provided By Sophos
What's This?
9/22/2011
08:58 AM
Security Insights
Security Insights
Security Insights
Connect Directly
RSS
E-Mail
50%
50%
Repost This

20K Stanford Hospital Emergency Room Patients Have Health Records Posted Online

'An ounce of prevention is better than a pound of cure' adage rings true

20,000 people have joined the ranks of the 11 million+ victims whose personal medical data has been improperly exposed in the past two years. Last week, The New York Times reported that 20,000 records of patients who visited the emergency room at Stanford Hospital in 2009 were posted on the Internet for over a year.

The leaked information included names, diagnosis codes, account numbers, admission and discharge dates, and billing charges. The source of the leak is likely Multi-Specialty Collection Services, a billing contractor for the hospital.

But remember: the “how” of this breach should not be the focal point in this situation. The more important question is, why was the data not protected (encrypted) in the first place?

I see several problems at work in these types of incidents...

First, medical organizations that are required to protect confidential patient data in the United States under the HIPAA and HITECH acts often outsource work to third parties.

Simply inserting some clauses in their contracts to require these third parties to meet these regulations does not ensure the data will be protected.

Secondly, our attitudes—and the laws—around data protection are outdated. If you think you should treat data differently when it is inside than when it is outside, you are setting the stage for a data breach. Think of the many groups of people touch personal health information “internally”—doctors, nurses, billing departments, etc. Each time the data is accessed or changes hands is another opportunity for that data to be compromised.

Confidential information, whether it is sensitive health records or source code to your secret Jesus phone to be released next month cannot be "inside" or "outside." There is no inside.

And thirdly, organizations that cite cost as a reason to not protect their data are setting themselves up for a bigger financial burden in the long run. The average cost of a data breach is $7.3 million. This number includes federal and state fines for noncompliance with HIPAA/HITECH laws, as well as other incidentals like the cost of notifying victims of the data breach and providing them with identity protection services. And don’t forget the non-monetary repercussions like lost customer confidence and bad publicity.

So instead of cleaning up after a data breach, prevent one from happening. Classify your data based upon its importance. Now, based on that classification, take the appropriate actions to control and protect that data. Please?

Chester Wisniewski is a senior security adviser at Sophos Canada

Need help? Check out Sophos’s free Data Security Report to understand what puts data at risk and how to defend against data loss and prevent future breaches.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-3154
Published: 2014-04-17
DistUpgrade/DistUpgradeViewKDE.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 does not properly create temporary files, which allows local users to obtain the XAUTHORITY file conte...

CVE-2013-2143
Published: 2014-04-17
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.

CVE-2014-0036
Published: 2014-04-17
The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.

CVE-2014-0054
Published: 2014-04-17
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External ...

CVE-2014-0071
Published: 2014-04-17
PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections.

Best of the Web