Risk
7/22/2010
09:56 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Healthcare Breaches Spin Out Of Control

If the past week is any indication (and I'm afraid it is), health care companies are doing an abysmal job at protecting personal health care data.

If the past week is any indication (and I'm afraid it is), health care companies are doing an abysmal job at protecting personal health care data.This evening the Colorado Department of Health Care Policy and Financing announced that state officials discovered an unauthorized removal of a computer hard drive from the state's Office of Information Technology Department:

The information did NOT include addresses, dates of birth, social security numbers or any other financial information that could be used for identity theft. It included name, state ID number and the name of the client's program.

Approximately 111,000 clients, or one-fifth of those receiving public health insurance, will receive notification by first-class mail, as required by HIPAA.

So there it is, roughly 20 percent of the state's clients' data is at risk. Thankfully Social Security numbers were not exposed. Still: why is stored sensitive data not encrypted?

Perhaps because it's easier not to encrypt the data and then have to deal with all of the extra hassle. Just as it's easier to dump medical records than it is to have them properly destroyed.

Consider the shock when a Florida couple went to their local recycling center to discover "thousands" of medical records just tossed in the trash.

From Tampa Bay Online:

When they looked at the paper bin it was not only full to the point of pushing up the lid, it was practically bursting at its seams. Inside were what looked to be thousands of pastel and manila file folders, all with neat tabs attached.

Curious, they pulled out a couple and were stunned to see that they appeared to be medical records, Karen Keith said.

The information inside the files included some that couldn't be more personal - or dangerous: Social Security numbers, copies of drivers' license numbers and even credit cards numbers, she said.

Nice. Fortunately the couple called authorities, and the paperwork wasn't found by a crook, or someone willing to sell the data to a bunch of crooks. Unfortunately, we probably don't hear about it when that actually happens, we just witness the resulting spike in identity and medical identity theft.

Also last week, a professional data management firm lost data on 800,000 patients. From South Shore Hospital's notice:

Based upon South Shore Hospital's investigation so far, the back-up computer files could contain personally identifiable information for approximately 800,000 individuals. Included among those individuals are patients who received medical services at South Shore Hospital - as well as employees, physicians, volunteers, donors, vendors and other business partners associated with South Shore Hospital - between January 1, 1996 and January 6, 2010. The information on the back-up computer files may include individuals' full names, addresses, phone numbers, dates of birth, Social Security numbers, driver's license numbers, medical record numbers, patient numbers, health plan information, dates of service, protected health information including diagnoses and treatments relating to certain hospital and home health care visits, and other personal information. Bank account information and credit card numbers for a very small subset of individuals also may have been on the back-up computer files.

South Shore Hospital's back-up computer files were shipped for offsite destruction on February 26, 2010. When certificates of destruction were not provided to the hospital in a timely manner, the hospital pressed the data management company for an explanation. South Shore Hospital was finally informed on June 17, 2010 that only a portion of the shipped back-up computer files had been received and destroyed.

Unfortunately, this past week isn't much unlike any other week. Patient records are lost and stolen constantly.

So how does the health care industry bring some level of control over these breaches? Personally, I think they're adopting electronic medical records way too quickly: so slowing that down a bit would be a start. At least slowing down the implementation enough to conduct a security assessment of the health care provider, and make sure such records are adequately protected.

Another would be more aggressive enforcement. A recent example of a successful action would be the successful action of the Connecticut Attorney General's Office against the regional health plan, Health Net, for a lost portable drive that included health information, Social Security and bank account numbers on about 446,000 patients. In that incident, Health Net agreed to pay a $250,000 fine and implement a Corrective Action Plan to improve their security program. For a good overview, read Richard Santalesa's analysis of the settlement here, published yesterday.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8917
Published: 2015-01-28
Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/audio.swf, and (4) dojox/av/resources/video.swf in the IBM Dojo Toolkit, as used in IBM Social Media A...

CVE-2014-8920
Published: 2015-01-28
Buffer overflow in the Data Transfer Program in IBM i Access 5770-XE1 5R4, 6.1, and 7.1 on Windows allows local users to gain privileges via unspecified vectors.

CVE-2015-0235
Published: 2015-01-28
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

CVE-2015-0312
Published: 2015-01-28
Double free vulnerability in Adobe Flash Player before 13.0.0.264 and 14.x through 16.x before 16.0.0.296 on Windows and OS X and before 11.2.202.440 on Linux allows attackers to execute arbitrary code via unspecified vectors.

CVE-2015-0581
Published: 2015-01-28
The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, as demonstrated by reading private keys, related t...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If youíre a security professional, youíve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.