Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/24/2008
10:05 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Medical Records For 2,500 Study Participants Are Stolen

Only after a laptop is stolen from the trunk of a car owned by a researcher at the National Heart, Lung, and Blood Institute (NHLBI) does this organization promise to do better when it comes to security. Why does it always go down this way?

Only after a laptop is stolen from the trunk of a car owned by a researcher at the National Heart, Lung, and Blood Institute (NHLBI) does this organization promise to do better when it comes to security. Why does it always go down this way?According to a statement issued by the NHLBI, a notebook was lifted from the locked trunk of an employee. The good news, as is so often the case, is that the theft appears to be random. That is, the thieves seem to have gone for the hardware, and not for the data it holds. Also, it doesn't appear as if any financial information was stolen, or data that could directly lead to identity theft, such as Social Security numbers or credit card data. What is definitely missing are the health records of roughly 2,500 hundred participants in a cardiac MRI study conducted between 2001 and 2007. The records included name, date of birth, medical record numbers, and MRI data. While this is certainly private information, it's not as bad as many of the breaches due to lax security we've recently witnessed.

I'm not familiar with any law or regulation that requires this breach to be publicly disclosed. It's certainly not covered by California SB 1386, which requires personally identifiable financial information to be exposed to trigger a notification. So kudos to the NHLBI for doing the right thing, and alerting participants who may be affected.

However, it's the promise of future security enhancements that rings hollow. It sounds like the text in so many other breach notifications that have made the news in recent years:

We want to assure the participants in this and every other NHLBI study that we are taking several steps to increase data security and ensure that similar incidents do not occur in the future.

And it continues:

The NHLBI is conducting proper follow-up procedures with those responsible for this incident and has taken several steps to increase data security and protect the privacy of current and future study participants. First, we are ensuring that all NHLBI laptop computers are encrypted, as required by policies of the DHHS and the Office of Management and Budget. Laptop computers in the possession of NHLBI research staff are being inspected by NIH CIT information security personnel to ensure that appropriate encryption software is installed.

The interesting question here is one about organizations and risk. What is it about risk that makes organizations only take these sorts of security-conscious steps after there's a breach?

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Hacking It as a CISO: Advice for Security Leadership
Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15596
PUBLISHED: 2020-08-12
The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Disclosure attacks via a "fake" DLL file.
CVE-2020-15868
PUBLISHED: 2020-08-12
Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.
CVE-2020-17362
PUBLISHED: 2020-08-12
search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.
CVE-2020-17449
PUBLISHED: 2020-08-12
PHP-Fusion 9.03 allows XSS via the error_log file.
CVE-2020-17450
PUBLISHED: 2020-08-12
PHP-Fusion 9.03 allows XSS on the preview page.