Risk
9/20/2012
08:59 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Medical Data Breach Highlights Need For Encryption

Massachusetts Eye and Ear Infirmary could have avoided a $1.5 million fine with an adequate risk analysis and relatively inexpensive encryption measures, say IT experts.

Uncle Sam Shares 12 Top Health Apps
Uncle Sam Shares 12 Top Health Apps
(click image for larger view and for slideshow)
The recent data breach at Massachusetts Eye and Ear Infirmary (MEEI) and Massachusetts Eye and Ear Associates once again screams the message: Encryption, encryption, encryption!

The provider has agreed to pay a $1.5 million fine to the Department of Health and Human Services (HHS), after allegations were made that Mass. Eye and Ear failed to comply with certain requirements of the Health Insurance Portability and Accountability Act (HIPAA) standards that govern the security of individually identifiable health information.

Mass. Eye and Ear declined to comment on the breach other than to release a statement that mentioned the hospital's proactive self-reporting of a doctor's unencrypted laptop being stolen while he was traveling abroad in 2010. The statement went on to say: "Given the lack of patient harm discovered in this investigation, Mass. Eye and Ear was disappointed with the size of the fine, especially since the independent specialty hospital's annual revenue is very small compared to other much larger institutions that have received smaller fines."

[ For another point of view on PHRs, see Why Personal Health Records Have Flopped. ]

HHS' Office for Civil Rights released a resolution agreement for the incident. During an interview with InformationWeek Healthcare, Mahmood Sher-Jan, vice president of product management at data breach response specialist ID Experts, said the incident was "a clear pattern of disregard" on behalf of MEEI, as well as a failure to comply with "a number of key elements of the HIPAA security rule."

"…In one of the first items [in the agreement], they mention the issue is more than portable devices," Sher-Jan said. "They concluded the entity didn't perform a risk analysis on an ongoing basis, and this goes all the way back to when the security rule was put into place back in 2005. Consequently, I think portable devices were impacted… [T]hey didn't have good policies and procedures around their own home devices, but also portable devices coming in and out that weren't owned by the entity…."

Chad Boeckmann, president at security program company Secure Digital Solutions, agreed with Sher-Jan and said in an interview that failure to conduct a risk analysis was "the big thing that was highlighted" in the agreement. "For quite some time, they weren't maintaining these requirements or being proactive. It's about maintaining due diligence," he said.

Boeckmann added the organization could have invested in encryption technology, which most likely would have cost them a "tenth of the cost of their fine." The technology would have helped MEEI meet HITECH requirements, he said, "as well as [help with] an organizational assessment to see their compliance with HIPAA and HITECH requirements, and manage the remediation to that degree."

InformationWeek Healthcare brought together eight top IT execs to discuss BYOD, Meaningful Use, accountable care, and other contentious issues. Also in the new, all-digital CIO Roundtable issue: Why use IT systems to help cut medical costs if physicians ignore the cost of the care they provide? (Free with registration.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jaysimmons
50%
50%
jaysimmons,
User Rank: Apprentice
9/23/2012 | 2:17:47 AM
re: Medical Data Breach Highlights Need For Encryption
Why people continue to keep patient data on unencrypted machines is beyond me. I assume that we just need more education around how easily this can happen and better policies within organizations to help mitigate the risk. It seems like such an easy solution to such an epidemic problem.
Jay Simmons
Information Week Contributor
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I've seen worse.  Last week Tim had a dragon."
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.