Risk
1/17/2012
11:50 AM
Connect Directly
RSS
E-Mail
50%
50%

Patient Data Theft Sends IT Specialist To Jail

Atlanta man gets 13 months for hacking into former employer's computer database and stealing patient data for a competing medical practice.

12 Mobile Health Apps Worth A Closer Look
9 Mobile Health Apps Worth A Closer Look
(click image for larger view and for slideshow)
Eric McNeal, a 38-year-old information technology specialist from Atlanta, Ga., has been sentenced for hacking into the patient database of a former employer, stealing patient information, and then deleting the information from the system.

For his crime, McNeal was sentenced on Jan. 10 to serve 13 months in prison with three years of supervision after his release. McNeal also was ordered to perform 120 hours of community service.

"The circumstances of this case and resulting patient data breach is very common," and can happen in any size of practice, Rick Kam, president and co-founder of ID Experts told InformationWeek Healthcare. According to court documents, McNeal, who pleaded guilty to the charge on Sept. 28, worked as an information technology specialist for APA, a perinatal medical practice in Atlanta. He left APA in November 2009, and subsequently joined a competing perinatal medical practice, which was located in the same building as APA.

[ Explore docs' fascination with iPads. See Apple Capitalizes On Doctors' iPad Romance. ]

In April 2010, McNeal used his home computer to hack into APA's patient database; download the names, telephone numbers, and addresses of APA's patients; and then delete all the patient information from APA's system. McNeal used the patient names and contact information he stole to launch a direct-mail marketing campaign for his new employer. There is no evidence that McNeal downloaded or misused specific patient medical information.

Christine Marciano, president of Cyber Data Risk Managers, said medical facilities looking at this case should ask themselves how they can realistically protect against similar hacking attempts. "Having an exit strategy in place when an employee leaves or is terminated should be strictly enforced," Marciano told InformationWeek Healthcare. "The exit strategy needs to include cutting off the employee's access to all of the facility's databases in order to prevent unauthorized access."

Richard Santalesa, senior counsel at InfoLawGroup, said because McNeal pleaded guilty his sentence was reduced, and noted that McNeal could have received a five-year federal prison sentence for his crimes.

"Anyone who gives their personal information to a doctor or medical facility does not expect that their information will be hacked and used to make money," U.S. Attorney Sally Quillian Yates, said in a statement. "The cost of medical care is already high enough without patients having to pay a heavier cost with the loss of their privacy."

When are emerging technologies ready for clinical use? In the new issue of InformationWeek Healthcare, find out how three promising innovations--personalized medicine, clinical analytics, and natural language processing--show the trade-offs. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
1/18/2012 | 1:20:16 AM
re: Patient Data Theft Sends IT Specialist To Jail
Symantec recently released some interesting research about insider threats and the profile of employees who tend to go rogue that is good reading for organizations worried about this kind of breach.
http://www.symantec.com/connec...
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1032
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before 3.4.5 for EPiServer allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party inf...

CVE-2012-1417
Published: 2014-09-17
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.

CVE-2012-1506
Published: 2014-09-17
SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from th...

CVE-2012-1507
Published: 2014-09-17
Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3) uri parameter to index...

CVE-2012-2583
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers to inject arbitrary web script or HTML via the body of an email.

Best of the Web
Dark Reading Radio