Risk
12/15/2009
02:13 PM
Connect Directly
RSS
E-Mail
50%
50%

Government Grapples With EMR Security, Privacy

Healthcare providers aren't stepping up to protect privacy of electronic medical records. Can the government provide adequate data security?

While electronic medical records promise massive opportunities for health benefits, the privacy and security risks are equally enormous.

The Obama administration has set an ambitious goal -- to get electronic medical records on file for every American by 2014. The administration is offering powerful incentives: $20 billion for EMRs included in the American Recovery and Reinvestment Act of 2009, and stiff Medicare penalties for healthcare providers that fail to implement EMRs after 2014.

EMRs offer huge benefits: Improved efficiency by eliminating tons of paper files in every doctor's office, and improved medical care using the same kinds of database and data mining technologies that are now routine in other industries. EMR systems can flag symptoms and potentially harmful drug interactions that busy doctors might otherwise miss.

But the privacy and security threats are massive as well. When completed, the nation's EMR infrastructure will be a massive store of every American's most personal, private information, potentially abused by marketers, identity thieves, and unscrupulous employers and insurance companies.

Unlocking Benefits, Minimizing Risks

Regulators are attempting to craft rules that would unlock the benefits of EMRs while protecting Americans from the security risks. Healthcare IT pros will be required to implement systems and business processes that conform to these regulations or face lost funding, institutional fines, and even -- in some cases -- personal criminal penalties.

The new regulations come as the healthcare industry faces big privacy problems, going back years. In 2003, a medical transcriptionist in Pakistan threatened to post patient records from the University of California San Francisco's Medical Center on the Internet unless she was paid for her work for a transcription service company hired by the university. The dispute was resolved but many patients were shocked to learn that their records were being sent overseas.

In another breach, two computers that held a disc containing the confidential records of close to 200,000 patients of a medical group in San Jose, Calif., were posted for sale on Craigslist.org. The FBI recovered the information and the medical group informed current and former patients of the theft, according to a 2006 report in the HIPAA Bulletin.

Celebrities aren't immune. Last year, more than a dozen staff at the UCLA Medical Center faced disciplinary charges for prying into the medical records of Britney Spears. The same hospital got in trouble again when employees accessed Farrah Fawcett's medical records after she went there for cancer treatments.

Previous
1 of 3
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2595
Published: 2014-08-31
The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which all...

CVE-2013-2597
Published: 2014-08-31
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that lever...

CVE-2013-2598
Published: 2014-08-31
app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to overwrite signature-verification code via crafted boot-image load-destination header values that specify memory ...

CVE-2013-2599
Published: 2014-08-31
A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption pas...

CVE-2013-6124
Published: 2014-08-31
The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary fil...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.