02:13 PM

Government Grapples With EMR Security, Privacy

Healthcare providers aren't stepping up to protect privacy of electronic medical records. Can the government provide adequate data security?

While electronic medical records promise massive opportunities for health benefits, the privacy and security risks are equally enormous.

The Obama administration has set an ambitious goal -- to get electronic medical records on file for every American by 2014. The administration is offering powerful incentives: $20 billion for EMRs included in the American Recovery and Reinvestment Act of 2009, and stiff Medicare penalties for healthcare providers that fail to implement EMRs after 2014.

EMRs offer huge benefits: Improved efficiency by eliminating tons of paper files in every doctor's office, and improved medical care using the same kinds of database and data mining technologies that are now routine in other industries. EMR systems can flag symptoms and potentially harmful drug interactions that busy doctors might otherwise miss.

But the privacy and security threats are massive as well. When completed, the nation's EMR infrastructure will be a massive store of every American's most personal, private information, potentially abused by marketers, identity thieves, and unscrupulous employers and insurance companies.

Unlocking Benefits, Minimizing Risks

Regulators are attempting to craft rules that would unlock the benefits of EMRs while protecting Americans from the security risks. Healthcare IT pros will be required to implement systems and business processes that conform to these regulations or face lost funding, institutional fines, and even -- in some cases -- personal criminal penalties.

The new regulations come as the healthcare industry faces big privacy problems, going back years. In 2003, a medical transcriptionist in Pakistan threatened to post patient records from the University of California San Francisco's Medical Center on the Internet unless she was paid for her work for a transcription service company hired by the university. The dispute was resolved but many patients were shocked to learn that their records were being sent overseas.

In another breach, two computers that held a disc containing the confidential records of close to 200,000 patients of a medical group in San Jose, Calif., were posted for sale on Craigslist.org. The FBI recovered the information and the medical group informed current and former patients of the theft, according to a 2006 report in the HIPAA Bulletin.

Celebrities aren't immune. Last year, more than a dozen staff at the UCLA Medical Center faced disciplinary charges for prying into the medical records of Britney Spears. The same hospital got in trouble again when employees accessed Farrah Fawcett's medical records after she went there for cancer treatments.

1 of 3
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest September 7, 2015
Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-12
vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message.

Published: 2015-10-12
The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.

Published: 2015-10-12
Cisco Unified Computing System (UCS) B Blade Server Software 2.2.x before 2.2.6 allows local users to cause a denial of service (host OS or BMC hang) by sending crafted packets over the Inter-IC (I2C) bus, aka Bug ID CSCuq77241.

Published: 2015-10-12
The process-management implementation in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges by terminating a firestarter.py supervised process and then triggering the restart of a process by the root account, aka Bug ID CSCuv12272.

Published: 2015-10-12
HP 3PAR Service Processor SP 4.2.0.GA-29 (GA) SPOCC, SP 4.3.0.GA-17 (GA) SPOCC, and SP 4.3.0-GA-24 (MU1) SPOCC allows remote authenticated users to obtain sensitive information via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
What can the information security industry do to solve the IoT security problem? Learn more and join the conversation on the next episode of Dark Reading Radio.