Risk
12/15/2009
02:13 PM
50%
50%

Government Grapples With EMR Security, Privacy

Healthcare providers aren't stepping up to protect privacy of electronic medical records. Can the government provide adequate data security?

While electronic medical records promise massive opportunities for health benefits, the privacy and security risks are equally enormous.

The Obama administration has set an ambitious goal -- to get electronic medical records on file for every American by 2014. The administration is offering powerful incentives: $20 billion for EMRs included in the American Recovery and Reinvestment Act of 2009, and stiff Medicare penalties for healthcare providers that fail to implement EMRs after 2014.

EMRs offer huge benefits: Improved efficiency by eliminating tons of paper files in every doctor's office, and improved medical care using the same kinds of database and data mining technologies that are now routine in other industries. EMR systems can flag symptoms and potentially harmful drug interactions that busy doctors might otherwise miss.

But the privacy and security threats are massive as well. When completed, the nation's EMR infrastructure will be a massive store of every American's most personal, private information, potentially abused by marketers, identity thieves, and unscrupulous employers and insurance companies.

Unlocking Benefits, Minimizing Risks

Regulators are attempting to craft rules that would unlock the benefits of EMRs while protecting Americans from the security risks. Healthcare IT pros will be required to implement systems and business processes that conform to these regulations or face lost funding, institutional fines, and even -- in some cases -- personal criminal penalties.

The new regulations come as the healthcare industry faces big privacy problems, going back years. In 2003, a medical transcriptionist in Pakistan threatened to post patient records from the University of California San Francisco's Medical Center on the Internet unless she was paid for her work for a transcription service company hired by the university. The dispute was resolved but many patients were shocked to learn that their records were being sent overseas.

In another breach, two computers that held a disc containing the confidential records of close to 200,000 patients of a medical group in San Jose, Calif., were posted for sale on Craigslist.org. The FBI recovered the information and the medical group informed current and former patients of the theft, according to a 2006 report in the HIPAA Bulletin.

Celebrities aren't immune. Last year, more than a dozen staff at the UCLA Medical Center faced disciplinary charges for prying into the medical records of Britney Spears. The same hospital got in trouble again when employees accessed Farrah Fawcett's medical records after she went there for cancer treatments.

Previous
1 of 3
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2184
Published: 2015-03-27
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

CVE-2014-3619
Published: 2015-03-27
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.

CVE-2014-8121
Published: 2015-03-27
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over...

CVE-2014-9712
Published: 2015-03-27
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allows remote administrators to read arbitrary files and obtain passwords via a crafted path.

CVE-2015-2157
Published: 2015-03-27
The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.