Perimeter
Guest Blog // Selected Security Content Provided By Sophos
What's This?
9/22/2011
08:58 AM
Dark Reading
Dark Reading
Security Insights
50%
50%

20K Stanford Hospital Emergency Room Patients Have Health Records Posted Online

'An ounce of prevention is better than a pound of cure' adage rings true

20,000 people have joined the ranks of the 11 million+ victims whose personal medical data has been improperly exposed in the past two years. Last week, The New York Times reported that 20,000 records of patients who visited the emergency room at Stanford Hospital in 2009 were posted on the Internet for over a year.

The leaked information included names, diagnosis codes, account numbers, admission and discharge dates, and billing charges. The source of the leak is likely Multi-Specialty Collection Services, a billing contractor for the hospital.

But remember: the “how” of this breach should not be the focal point in this situation. The more important question is, why was the data not protected (encrypted) in the first place?

I see several problems at work in these types of incidents...

First, medical organizations that are required to protect confidential patient data in the United States under the HIPAA and HITECH acts often outsource work to third parties.

Simply inserting some clauses in their contracts to require these third parties to meet these regulations does not ensure the data will be protected.

Secondly, our attitudes—and the laws—around data protection are outdated. If you think you should treat data differently when it is inside than when it is outside, you are setting the stage for a data breach. Think of the many groups of people touch personal health information “internally”—doctors, nurses, billing departments, etc. Each time the data is accessed or changes hands is another opportunity for that data to be compromised.

Confidential information, whether it is sensitive health records or source code to your secret Jesus phone to be released next month cannot be "inside" or "outside." There is no inside.

And thirdly, organizations that cite cost as a reason to not protect their data are setting themselves up for a bigger financial burden in the long run. The average cost of a data breach is $7.3 million. This number includes federal and state fines for noncompliance with HIPAA/HITECH laws, as well as other incidentals like the cost of notifying victims of the data breach and providing them with identity protection services. And don’t forget the non-monetary repercussions like lost customer confidence and bad publicity.

So instead of cleaning up after a data breach, prevent one from happening. Classify your data based upon its importance. Now, based on that classification, take the appropriate actions to control and protect that data. Please?

Chester Wisniewski is a senior security adviser at Sophos Canada

Need help? Check out Sophos’s free Data Security Report to understand what puts data at risk and how to defend against data loss and prevent future breaches.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-8626
Published: 2014-11-22
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding...

CVE-2014-8710
Published: 2014-11-22
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.

CVE-2014-8711
Published: 2014-11-22
Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?