Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Security Government Medicine IT

'Wall of Shame' Exposes 21M Medical Record Breaches 112

Posted by Soulskill
from the you-can-trust-us dept.
Lucas123 writes "Over the past three years, about 21 million patients have had their unencrypted medical records exposed in data security breaches that were big enough to require they be reported to the federal government. Each of the 477 breaches that were reported to the Office for Civil Rights (OCR) involved 500 or more patients, which the government posts on what the industry calls 'The Wall of Shame.' About 55,000 other breach reports involving fewer than 500 records where also reported to the OCR. Among the largest breaches reported was TRICARE Management Activity, the Department of Defense's health care program, which reported 4.9 million records lost when backup tapes went missing. Another five breaches involved 1 million or more records each. Yet, only two of the organizations involved in the breaches have been fined by the federal government."
This discussion has been archived. No new comments can be posted.

'Wall of Shame' Exposes 21M Medical Record Breaches

Comments Filter:
  • Punish them. (Score:5, Insightful)

    by Nyder (754090) on Tuesday August 07, 2012 @09:20PM (#40913591) Journal

    Unless the various companies that lose the data are punished, nothing will change.

    • How should they be punished?
      • Re:Punish them. (Score:5, Informative)

        by Anonymous Coward on Tuesday August 07, 2012 @09:32PM (#40913685)

        With their wallets?

        Wasn't there an article recently on Slashdot about how the IRS is likely to pay $21 billion dollars over the next 5 years because of identity theft?

        • by Anonymous Coward

          Not the IRS. The taxpayers. Us. Because our flunkies failed to take basic security precautions.

        • Punishing companies is punishing their customers. And in case of a federal "company", that means that you foot the bill. Now you get punished twice, not only are your records public property now, you also get to pay for it.

          At least with government facilities, it would work to tie the responsibility to the C-Level (it's kinda hard to tell a private company how to handle it). Can the responsible CISO prove that he did everything in his power to prevent it? Are procedures in effect that should avoid such failu

          • Re:Punish them. (Score:5, Insightful)

            by rgbrenner (317308) on Wednesday August 08, 2012 @05:42AM (#40916295)

            Punishing companies is punishing their customers

            Bullshit. I'm tired of this line.

            When a company is punished, it raises the cost for them to do business, resulting in price increases for customers.

            For some reason, you stop there. But it doesn't end there.

            The customers, who can chose where to spend their money, will go to the cheapest retailer... leaving the punished company with fewer customers, less market share, etc.

            Customers are not forced to buy from a company.. so fining 1 company is NOT punishing customers.

            • It's kinda different with government agencies. I can't simply go to another IRS if they up the fees...

            • by Anonymous Coward

              Well tired or not you better get used to it because it's the truth. Let's say you have a company, oh I don't know like you local power company. Where else are you going to take your business? What happens when company A,B, and C are the only ones providing a service you happen to need and all get fined? Are you still going to tell me that there's no impact to consumers? You're the one that's full of bullshit. Try thinking beyond one isolated incident. The government fining companies does not make thi

              • wtf are you talking about? Why would my local power company have private health care records? Try providing a valid example.

              • by morgauxo (974071)
                Then they make less profit. If they can save money (to pay fines) by not providing as good of service or if they can make money (to pay fines) by charging more then they would be already doing so in order to make more profit. That's how corporations work!
            • by morgauxo (974071)
              Bullshit back at you.

              Between Insurance company rackets (in-netowork vs out of network coverage) and government enforced monopolies (drug patents, procedure patents, etc...) and the simple economics of geography (few people in NY are going to doctors in CA for an extreme example) there really aren't many choices if any at all for most people.

              Stop slapping companies on the wrist and start slapping individuals into prison. That is the only way to solve the problem.
        • We are fining you because you didn't have the money to get a modern system.

      • Re:Punish them. (Score:5, Informative)

        by Anonymous Coward on Tuesday August 07, 2012 @11:46PM (#40914711)

        Criminal charges against the CEO, CIO and CSO level. Or at least civil charges.

        I'm currently working on a project with a major regional medical HMO. What I've found in 3 months of digging makes me want to *never* have a friend or family go to any of their affiliates. There is zero recognition of privacy -- admins are routinely passing round medical records of celebrities. Their idea of 2 factor authentication was forcing someone to login with the same credentials twice in a row. What appears to be security (doctors, nurses using RFID badges to login and out) is theatre only -- only a single ID is associated with all RFID badges for logins. A complete farce.

        Why? Because even when caught there is no penalty. Make the penalty meaningful to the people running things, and you'll see cultural changes pretty damn fast.

        • Re:Punish them. (Score:5, Interesting)

          by Eskarel (565631) on Wednesday August 08, 2012 @02:19AM (#40915483)

          Hospitals are complex places. Lots of staff, lots of data being transferred between systems some of which are insecure and there's nothing you can do about that, because they're required, and no competitors exist.

          The main reason that the number of breaches in hospitals is as low as it is is because for the most part people don't target hospitals so relatively basic security functions. Now of course we have people doing it "for the lulz" or to prove some sort of point which makes health care even harder to do.

          In a hospital environment you have to cater for doctors which no one other than the person running their accreditation even knows exist, nurses who view IT as a barrier between them and what they actually do, patients who want miracles, and health funds who seem to desire complexity for the sake of complexity. Connect all that up to IT products which haven't been updated since the mid 90's, never will be updated and can't be replaced because the group that would certify a competitor makes the product in question, add in vastly disparate WAN locations, a need for instant performance and 5 nines up time all on a shoestring budget and you'll start to get a picture of hospital IT.

          In the end you really have to ask yourself, is it better or worse to risk having a portion of your medical record stolen, or to die because the doctors couldn't get the information they needed quick enough. Sadly that's about how the choices line up, hospitals aren't generally negligent, it's just the nature of the game.

        • by Thorodin (1999352)
          Yes, there is a penalty. It's called a fine by CMS for a HIPAA violation. Providers (doctors and hospitals) are being with with fines by CMS. This idea that companies are not being fined is not true. Jeez, just do a quick search on "hipaa+fine" and see what you get. Even /. had a story on it (http://yro.slashdot.org/story/11/02/25/2021232/first-ever-hipaa-fine-is-43m).
      • by Hatta (162192)

        Throw the executives in jail.

    • by c0lo (1497653)

      Unless the various companies that lose the data are punished, nothing will change.

      Achmmmm... Tricare [wikipedia.org] you say?

      The ultimate responsible organization for administration of Tricare is the U.S. Department of Defense Military Health System, which organized the Tricare Management Activity (TMA)

      In this case, what you suggested amounts to "government should punish itself" - something not very common for the US govt, wouldn't you say?

      • Re:Punish them. (Score:5, Insightful)

        by vux984 (928602) on Tuesday August 07, 2012 @09:54PM (#40913885)

        In this case, what you suggested amounts to "government should punish itself" - something not very common for the US govt, wouldn't you say?

        Nor terribly productive.

        At best, they increase their budget by the amount of the fines, and then raise taxes to cover the increased budget.

        At worst, they pay the fine without increasing their budget, and make cuts elsewhere... thereby ensuring that not only is there no money to improve the security that led to the first breach, but now they are probably running shorthanded increasing the odds of a second breach...

        Punishing governement and large corporations is generally meaningless. We have to pierce the veil and go after individuals within them... fine or even imprison them personally.

    • by besalope (1186101)
      Per the Department of Health and Human Services (HHS) the organizations that have breaches of information are in violation of HIPAA and are fined [eweek.com].
    • They would pass any fee straight to their customers.
      • by superwiz (655733)
        That is actually not accurate in this case. Imposing a universal surcharge on all providers would make them pass that fee to the customers. Imposing fees only on the guilty would make the providers who are innocent of such violations more competitive (they wouldn't have the added costs of the fees). So if you believe in markets, the effect of such charges would be to make compliant behavior more competitive in the market place.
    • They are punished.
      The problem is Most Medical Software is Mizerably out of date. The new stuff that comes out is still a decade behind what other industries have. And if you look at the list the core of the problems isn't as much people hacking the network (there are a few occurances) but mostly due to work flow processes that no one has the guts to change. Where things are printed on paper. The paper get lost and found by someone else. It is very hard to explain to MD's how email is insecure...

      Oddly enou

  • Worry Not (Score:1, Funny)

    by Anonymous Coward

    Now that the US government is taking over healthcare this problem will disappear!

  • Wait, what? (Score:4, Insightful)

    by fuzzyfuzzyfungus (1223518) on Tuesday August 07, 2012 @09:43PM (#40913801) Journal

    I'm impressed. I wouldn't have guessed that insurance outfits had anybody familiar with the concept of 'shame' available to coin such a nickname...

  • by c0lo (1497653) on Tuesday August 07, 2012 @09:43PM (#40913807)
    TFA (second page):

    On March 9, Blue Cross Blue Shield of Tennessee (BCBS) was fined the maximum $1.5 million for 57 unencrypted computer hard drives that were stolen from a leased storage facility in 2009. BCBS has since encrypted all of its hard drives, representing 885TB of data.
    BCBS said it spent more than 5,000 man-hours on the encryption effort, which cost the company $6 million.

    Say they used new HHD-s at $100 for a 1TB HDD -> HDD cost=$88,500. F*** it... let's be generous and say all the equipment amounts for $1M.
    The rest should be labour-cost, isn't it? Which means $1000/h... Seems to be a good trade to be in.

    • by ColdWetDog (752185) on Tuesday August 07, 2012 @09:53PM (#40913881) Homepage

      No, No, No - you have it all wrong.

      Say $100K for the drives, another 50K for the 'Enterprise Level' software, another 100K for labor.

      The other 5.5 million for upper level executive compensation.

      Thinking this stuff through is hard.

    • by linatux (63153) on Tuesday August 07, 2012 @10:14PM (#40914069)

      I'd like to think that they use higher-grade drives than you buy at Fry's or where-ever. Would also assume RAID5 or better. Add in the fact they were probably plugged into a DMX or similar & $6M starts sounding reasonable.

      Why they weren't encrypted from the start is the real question.

      • by PNutts (199112)

        Why they weren't encrypted from the start is the real question.

        HIPAA only recently grew teeth that makes non-compliance painful.

    • I work with BCBS, they are idiots. It usually takes three people to give me three different wrong answers. It probably took 10 people per hard drive.
    • TFA (second page):

      On March 9, Blue Cross Blue Shield of Tennessee (BCBS) was fined the maximum $1.5 million for 57 unencrypted computer hard drives that were stolen from a leased storage facility in 2009. BCBS has since encrypted all of its hard drives, representing 885TB of data. BCBS said it spent more than 5,000 man-hours on the encryption effort, which cost the company $6 million.

      Say they used new HHD-s at $100 for a 1TB HDD -> HDD cost=$88,500. F*** it... let's be generous and say all the equipment amounts for $1M. The rest should be labour-cost, isn't it? Which means $1000/h... Seems to be a good trade to be in.

      If only it was as easy as just buying new HDs and installing them in the systems. Sorry, but they are most likely dealing with multiple enterprise levels systems, some that have to be FDA approved, between multiple vendors. They have to make sure they can encrypt all the drives, that the vendors will still support the system in question, that the FDA is ok with it, fully tested, and that in all that there is no downtime. Like it or not, you're talking about multiple projects involving lots of people and pro

  • Our secret health (Score:5, Insightful)

    by mcelrath (8027) on Tuesday August 07, 2012 @09:59PM (#40913943) Homepage

    And why do we care who has our medical information?

    Because in the US, we've decided that the only people that get health care are those with jobs. So getting a job is deeply tied to one's state of health. Accidental leaking of your health care information could lead to losing your job, or failure to obtain one. Other laws try to tackle that, but nonetheless, we all have the fear that if our potential employer (especially) knew how much we might really cost, we wouldn't get that job. And the fact of the matter is that no employer wants to employ a sick person if they can help it.

    We'd be better off decoupling health care from employment. One side effect would be that medical information wouldn't be so secret. This is rather important when you consider that that information should perhaps be shared among health care providers, patients with the same ailments, and especially, family (possibly distantly related but genetically susceptable, for instance).

    • by tompaulco (629533)
      I've decouple my healthcare from my job, but Obamacare threatens to remove my option and force me into a plan that I don't want and that just feeds more money into the insurance Fat Cats pockets.
    • Re: (Score:3, Insightful)

      by PNutts (199112)

      Because in the US, we've decided that the only people that get health care are those with jobs.

      We've decided no such thing.

      • Oh, really? Have you ever tried to buy insurance by yourself if your employer doesn't provide it? It's almost impossible to get an affordable plan unless you go onto one of the socialized health care plans.

    • by superwiz (655733)

      Because in the US, we've decided that the only people that get health care are those with jobs.

      Nonsense. Pure nonsense. I pay my primary doctor cash whether I have insurance or not.

      We'd be better off decoupling health care from employment. One side effect would be that medical information wouldn't be so secret.

      Or so useful. Astronomy is not secret. Cause you can't do anything about it or with it. If your medical history is just as useless because you can't get treatment (a world order for which you are actively advocating despite your arguments to the contrary), then your medical history is as valuable to anyone as astronomy.

    • by brit74 (831798) on Wednesday August 08, 2012 @01:05AM (#40915101)

      And why do we care who has our medical information?

      I think people are concerned about the privacy implications. If you have a talk with your doctor about something personal, you'd like to believe that the entire world isn't listening in. What's that? You've got erectile disfunction? You've had mental health issues? You once tried to kill yourself? You went to the emergency room because you were high on drugs or you stuck an object where it shouldn't go? You've admitted to having lots of sex partners or you're gay and you haven't come out? You've got an STD and you'd prefer that your friends and family don't know about it?

      Not only are there some potentially embarrassing secrets, but the idea that everyone can find out about your medical history can make you less likely to go to the doctor -- because there might be situations where it might be embarrassing to tell a doctor what the situation is, and much more embarrassing if the whole world could find out about it.

      • by ToddInSF (765534)
        Be careful what you tell your doctor, he's not your friend.

        Get injured at work ? Your entire medical records, including "private" conversations and unrelated information your doctor recorded is now in the hands of your employer. It's happened to me.

        You want privacy, don't trust people that don't have a vested interest in keeping it private. HMO's don't care if they destroy your life.
    • Because in the US, we've decided that the only people that get health care are those with jobs.

      First, you are wrong. Medicare and Medicaid provide healthcare to the poor and the elderly. We spent close to a trillion dollars on those entitlement programs in 2010. Second, some other countries with "socialized medicine" tie health insurance to employment. Third, the making of healthcare and health insurance into a "benefit" of employment dates back to WW2, when prices and wages were frozen. Benefits were not. So, to entice workers to come work at a munitions plant, an employer would add "healthcare" ben

    • Because in the US, we've decided that the only people that get health care are those with jobs.

      This is a misleading statement. I know plenty of people who have jobs but no health care.

  • by besalope (1186101) on Tuesday August 07, 2012 @10:24PM (#40914141)
    Umm... where's the news? This website has been around for YEARS. The breaches aren't anything new and anyone that is affected should've been alerted per HIPAA.
  • Small doctors offices are ripe for this. The software they use is a joke. Their security is horrendous. Easy to find sql passwords. Entire health claims stored in plain text. Claim files being sent via modem transmissions. Doctors that refuse to update their software or windows environment because they are cheap... List goes on.
    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Assumption junction, what's your function? Hookin' up word and phrases and sound bites.

  • by jforr (15487) on Tuesday August 07, 2012 @11:26PM (#40914591)

    "Among the largest breaches reported was TRICARE Management Activity, the Department of Defense's health care program, which reported 4.9 million records lost when backup tapes went missing."

    Submitter should have dug a little bit further. TRICARE was the agency where the records originated, but SAIC was the "business associate" that actually lost the records belonging to TRICARE.

    • by BSDstef (263739)

      Deciding to outsource data processing doesn't make you any less responsible for the data.

      • by Thorodin (1999352)
        True but how far do you go or what do you do to guarantee that the out-sourced company is fully compliant with HIPAA security and privacy regulations? Look at this scenario (btw, I work in IT in a hospital): Upload patient data via VPN (fully encrypted, AES, etc.) to a data mining company for patient safety study. The company shown they've been audited by security auditors and passed. However, they don't mention they're upgrading their systems and something gets missed during the upgrade and BAM! patien
        • by Fnord666 (889225)

          True but how far do you go or what do you do to guarantee that the out-sourced company is fully compliant with HIPAA security and privacy regulations? Look at this scenario (btw, I work in IT in a hospital): Upload patient data via VPN (fully encrypted, AES, etc.) to a data mining company for patient safety study. The company shown they've been audited by security auditors and passed. However, they don't mention they're upgrading their systems and something gets missed during the upgrade and BAM! patient data revealed. I think in that scenario, the provider, having shown due diligence, may get by without a fine but if the records revealed amount to =>500 patients, they'll still get listed on the wall of shame.

          If you are outsourcing your data for studies, then all personally identifying information should be scrubbed or anonymized.

  • by slashmydots (2189826) on Tuesday August 07, 2012 @11:35PM (#40914635)
    I beat the system by having no significant medical records in the last 10 years :P One finger X-ray (no break, yay) and like 2 appointments for allergies. Good luck blackmailing me with that, lol. I just stay exceptionally healthy. Take that, hackers! lol.
  • by stanlyb (1839382) on Tuesday August 07, 2012 @11:53PM (#40914739)
    If you read the article, you will see that the main problem is of proper handling of the backups, not the actual server application or database, or with other words, here the problem is the "meatware", not the "software"
  • by spasm (79260) on Tuesday August 07, 2012 @11:58PM (#40914757) Homepage

    I think this is all kind of backwards. Since moving to the US a decade or so ago from a country with universal healthcare* the biggest problem I've had is with getting my health records passed from one provider to the next when I change jobs / locations / insurers. I'd love it if someone hacked all my health records and put them on the web for everyone (including myself), since that'd actually mean my various providers could see what the last person produced. I really don't give a shit if my next door neighbor knows I have elevated cholesterol and am on anti-anxiety meds. Shit, if they knew that I was so stressed I was having panic attacks, maybe they'd stop firing up their fucking leaf blower at 8am sharp out of concern for my wellbeing. But I digress.

    The reason Americans are so paranoid about 'other people' seeing their healthcare records is some of the 'other people' are for-profit health insurers and before 2010 (when key provisions of the Patient Protection and Affordable Care Act aka 'Obamacare' came into force) they could and did deny coverage to people with pre-existing conditions. It's not surprising that there's a bit of a social lag here - three generations of Americans have had to be scared about whether their for-profit healthcare provider could find a way to weasel out of actually paying for necessary healthcare, and it's going to take a while for people to realize they don't have to give a shit any more.

    * Good luck guessing which country I moved from - every other first world country on earth has universal healthcare, as do many of those who can't easily claim 'first world' status.

    • by Z34107 (925136) on Wednesday August 08, 2012 @12:28AM (#40914937)

      Nobody has to "hack" your medical record. HIPAA guarantees you a copy, so go ask for it.

      If, instead, your beef is that the doctors treating you don't talk to each other, find some that do. Electronic health records make this trivially possible, and there are lots of Keysers out there practicing managed care [wikipedia.org].

      Finally, do you really think that "for-profit insurers" are the only reason Americans expect their medical records to be confidential? I understand that you have Nothing To Hide, but "too much patient privacy" is the last thing wrong with healthcare in America.

    • by eyenot (102141)

      * Trully, brah, 2nd/3rd-world gauranteed health coverage is way, way way, WAY better than this total shit-hole butt-rape in the face scab nightmare we call "America"! Fuck yeah, you should move the fuck out. Do yourself one better. Before your neighbors break into your home and replace your anxiety meds with sugar pills. Fucking Americans!!! *sob* I just wish I had all the gauranteed health care coverage available in so many 2nd/3rd world countries.

  • by kermidge (2221646) on Wednesday August 08, 2012 @12:15AM (#40914839) Journal

    To hell with fines. Felony-grade jail time in no less than medium-security, from top people on down, with the parole condition that upon release they never work with customer information or data again.

    • by Thorodin (1999352)
      Spoken by someone with nary a clue as to the complexity involved and the unintended consequences of such an idea, if put in place. You'd see a boatload of IT people leave. I know I would. But just imagine what affect that would have on the delivery of healthcare. Think how tight security would get.
      • by kermidge (2221646)

        @AC - probably not, but I've worked under various fiduciary and performance bonds where the consequences for screwing up carried the risk of jail time.

        Thorodin - ah, good, some discussion. I don't see that fines work: cost is passed to clients' insurance; the highers and stockholders are not affected in any meaningful way. Notice I said top down - not the bods and sods in IT (unless they'd been screwing the pooch.)

        How many stories and posts have we seen just in the last year or so where upper management

  • The Cloud will fix this! See, if everything is in the cloud then everyone's records can be accessed without authorization at the same time, thus negating the need for the Wall of Shame! Or at least just have one name on the Wall. But then that's not much of a wall. Snippet of Shame? One-liner of Shame?
    • by eyenot (102141)

      The great thing about The Cloud is it allows you to tailor the data experience to the networking needs of all clients and all terminals. So whoever visits the Wall will just see their own name.

  • by anorlunda (311253) on Wednesday August 08, 2012 @09:01AM (#40917587) Homepage

    Before passage, the HIPPA bill was much debated. Privacy advocates wanted two big things, (a) opt-in rather than opt-out and (b) the right for patients to refuse permission for their health into to be used in ways they don't want while still receiving treatment. They privacy advocates lost.

    The result is that now, when you visit the doctor you get a multi-page privacy disclosure. You are allowed to request changes in how your health info is treated. However, the provider has the right to refuse treatment if you request even the slightest deviation. That means that providers can write their software presuming that 100% of patients consent to the most invasive and insecure privacy practices.

    It should be the right of every patient to forgo the advantages of digitally stored health records and to opt-out without being sent packing without treatment. One should even have the right to seek treatment anonymously and pay cash. Even that is forbidden by state and federal laws regarding record keeping by providers.

    I'm afraid that the only way out for US citizens determined to protect their privacy is itself a felony. I speak of identity theft -- fraudulently using someone else's identity to get health care.

    HIPPA was supposed to protect patient privacy. Instead, it merely adds to the mindless and wasteful bureaucracy of health care while institutionalizing privacy invasive practices, giving legal cover to abusers, and criminalizing individual tactics to protect themselves. In addition, HIPPA preempted many state laws that provided better privacy protections than HIPPA.

1 Billion dollars of budget deficit = 1 Gramm-Rudman

Working...