Risk
10/25/2010
02:54 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

More Patient Data Dumps

Yet another case where patient medical records are left in a dumpster and out in plain sight.

Yet another case where patient medical records are left in a dumpster and out in plain sight.What is it going to take to ensure hospitals and medical facilities properly dispose of patient records? NewsChannel4, KFOR.com in Oklahoma City reports that a resident found dumped patient records from at least two different offices.

Within each folder they found oncology patient record details on children and their parents. The news station says it retrieved all of the medical files and then contacted both medical offices.

It's quite possible that the firm the offices use to dispose of their records failed to properly shred them. The video of the news report is below:

 

Unfortunately, these types of incidents are not uncommon. We recently covered an Urgent Care that was fined $50,000 for a similar dump. And we've noted others occurring in Monicello, NY, Chattanooga, TN, and Port Lucie, FL.

Security firm McAfee recently had breaches that involved Social Security numbers between January 2009 and this October analyzed to rank the most dangerous locations for one to leave their Social Security number. The breach data was sourced from the Identity Theft Resource Center, Privacy Rights Clearinghouse and the Open Security Foundation that involved Social Security number breaches from January 2009 - October 2010.

Turned out health care related offices took 3 of the top 10 slots. Third place was hospitals, seventh was medical related businesses (distributors, billing services, etc.), and tenth place tied with medical insurance firms and medical offices and clinics.

So hospitals and medical offices may not only be ideal places to pick up a new disease, they're also ideal for having your identity information stolen.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5427
Published: 2015-03-29
Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integration Engine (NIE) 5xxx-x, and NxE8500, allows remote attackers to read pa...

CVE-2014-5428
Published: 2015-03-29
Unrestricted file upload vulnerability in unspecified web services in Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server (ADS), Extended Application and Data Server (aka ADX), LonWorks Control Server 85 LCS8520, Network Automation Engine (NAE) 55xx-x, Network Integratio...

CVE-2014-9205
Published: 2015-03-29
Stack-based buffer overflow in the PmBase64Decode function in an unspecified demonstration application in MICROSYS PROMOTIC stable before 8.2.19 and PROMOTIC development before 8.3.2 allows remote attackers to execute arbitrary code by providing a large amount of data.

CVE-2015-0528
Published: 2015-03-29
The RPC daemon in EMC Isilon OneFS 6.5.x and 7.0.x before 7.0.2.13, 7.1.0 before 7.1.0.6, 7.1.1 before 7.1.1.2, and 7.2.0 before 7.2.0.1 allows local users to gain privileges by leveraging an ability to modify system files.

CVE-2015-0996
Published: 2015-03-29
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive info...

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.