Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

7/22/2010
09:56 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Healthcare Breaches Spin Out Of Control

If the past week is any indication (and I'm afraid it is), health care companies are doing an abysmal job at protecting personal health care data.

If the past week is any indication (and I'm afraid it is), health care companies are doing an abysmal job at protecting personal health care data.This evening the Colorado Department of Health Care Policy and Financing announced that state officials discovered an unauthorized removal of a computer hard drive from the state's Office of Information Technology Department:

The information did NOT include addresses, dates of birth, social security numbers or any other financial information that could be used for identity theft. It included name, state ID number and the name of the client's program.

Approximately 111,000 clients, or one-fifth of those receiving public health insurance, will receive notification by first-class mail, as required by HIPAA.

So there it is, roughly 20 percent of the state's clients' data is at risk. Thankfully Social Security numbers were not exposed. Still: why is stored sensitive data not encrypted?

Perhaps because it's easier not to encrypt the data and then have to deal with all of the extra hassle. Just as it's easier to dump medical records than it is to have them properly destroyed.

Consider the shock when a Florida couple went to their local recycling center to discover "thousands" of medical records just tossed in the trash.

From Tampa Bay Online:

When they looked at the paper bin it was not only full to the point of pushing up the lid, it was practically bursting at its seams. Inside were what looked to be thousands of pastel and manila file folders, all with neat tabs attached.

Curious, they pulled out a couple and were stunned to see that they appeared to be medical records, Karen Keith said.

The information inside the files included some that couldn't be more personal - or dangerous: Social Security numbers, copies of drivers' license numbers and even credit cards numbers, she said.

Nice. Fortunately the couple called authorities, and the paperwork wasn't found by a crook, or someone willing to sell the data to a bunch of crooks. Unfortunately, we probably don't hear about it when that actually happens, we just witness the resulting spike in identity and medical identity theft.

Also last week, a professional data management firm lost data on 800,000 patients. From South Shore Hospital's notice:

Based upon South Shore Hospital's investigation so far, the back-up computer files could contain personally identifiable information for approximately 800,000 individuals. Included among those individuals are patients who received medical services at South Shore Hospital - as well as employees, physicians, volunteers, donors, vendors and other business partners associated with South Shore Hospital - between January 1, 1996 and January 6, 2010. The information on the back-up computer files may include individuals' full names, addresses, phone numbers, dates of birth, Social Security numbers, driver's license numbers, medical record numbers, patient numbers, health plan information, dates of service, protected health information including diagnoses and treatments relating to certain hospital and home health care visits, and other personal information. Bank account information and credit card numbers for a very small subset of individuals also may have been on the back-up computer files.

South Shore Hospital's back-up computer files were shipped for offsite destruction on February 26, 2010. When certificates of destruction were not provided to the hospital in a timely manner, the hospital pressed the data management company for an explanation. South Shore Hospital was finally informed on June 17, 2010 that only a portion of the shipped back-up computer files had been received and destroyed.

Unfortunately, this past week isn't much unlike any other week. Patient records are lost and stolen constantly.

So how does the health care industry bring some level of control over these breaches? Personally, I think they're adopting electronic medical records way too quickly: so slowing that down a bit would be a start. At least slowing down the implementation enough to conduct a security assessment of the health care provider, and make sure such records are adequately protected.

Another would be more aggressive enforcement. A recent example of a successful action would be the successful action of the Connecticut Attorney General's Office against the regional health plan, Health Net, for a lost portable drive that included health information, Social Security and bank account numbers on about 446,000 patients. In that incident, Health Net agreed to pay a $250,000 fine and implement a Corrective Action Plan to improve their security program. For a good overview, read Richard Santalesa's analysis of the settlement here, published yesterday.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24847
PUBLISHED: 2020-10-23
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticat...
CVE-2020-24848
PUBLISHED: 2020-10-23
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
CVE-2020-5990
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation, code execution, denial of service or information disclosure.
CVE-2020-25483
PUBLISHED: 2020-10-23
An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
CVE-2020-5977
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncontrolled search path is used to load a node module, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.