Slashdot Mirror
Medical Data on 365,000 Patients Stolen
Anonymous writes "Backup tapes and disks with data on 365,000 patients were stolen out of the car of a worker at a healthcare company in Portland. According to this Computerworld story, the tapes were in his car because he took them home as part of a disaster recovery plan, to protect the information from fire and other on-site disasters. D'oh!"
They still have the originals, so they can make a new set of backups!
do they have a recovery plan for this disaster?
The higher the technology, the sharper that two-edged sword.
"But we know the data's safe! We just have no idea where the hell it is."
From TFA:
;)
The data on the tapes was encrypted, Walker said. The data on the disks was in a proprietary file format that was not encrypted, but "is stored in a way that would make it difficult, if not impossible, for someone to access it, then make any sense out of it," he said.
So not as bad as the summary seemed to indicate, but still not the greatest thing to have happen.
Especially if that proprietary file format "difficulty" is just the fact that the files are in some old version of Word.
I watched C-beams glitter in the dark near the Tannhauser gate.
Oh, and make sure the vault they keep them in is a)real and b) really able to withstand ANY disaster.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
...on eBay.....
Windows in 6 Bytes (IA-32) : 90 90 90 90 CD 19
You've got to wonder why these people didn't have this stuff encrypted... An encrypted filesystem at least or straight up file encryption even... When are these companies going to get a clue?
And storing the tapes in your car? What happens if it's 100 degrees outside?
Where i work, they make the backup copies and have someone drive them to one of the other branches at the company. They make a backup every day and keep seven days worth of backup in rotation so if something went wrong 6 days ago and they backed up the problem every day, they ahve the 7th backup left to work with...
Unfortunatley i don't know what their view on encrypting the data is. With as anal retentive as the IT VP is about security though, i can't imagine they wouldn't be encrypted...
I mean, that has to be violating health care laws, the individual taking patient records home, even if they are in some propietary format. That can't be legal at all, due to patient confidentiality, ect. I hope something serious comes from this.
At my clinic where there is an EHR (Electronic Health Record) there is built in redundancy with multiple servers in different locations. It is hard to believe that a hospital system as big as Providence (which owns hospitals in multiple NW states) could have something as stupid as someone taking home a backup in their car.
sig here
I can see hard disks being stolen..... but not tapes in the one case. Thieves like to take items with obvious value. Am I missing something here? Isn't it possible the workers simply sold the data?
Why couldnt he just scp the crap to his home computer and tape it there? Seems rather simple to me. Oh wait! maybe thats not secure enough....
Which is why I refuse to divulge my SSN# to Medical Clinics. I either make one up or flatly refuse. They say, well we need it. I say for what. They say that is how we sort our records. I tell them to make up a number and use that instead, while reminding them it is illegal to use a SSN for anything but SS.
Cue the "bandwidth of a station wagon of backup tapes" cliches? If it's stuff they really don't want stolen, why not buy a safe for his car? Better yet, give him a company truck/van with secure storage. If they have 365,000 patients (customers) then they can surely afford to protect their information.
Now I don't have cancer anymore!
Owned.
At least the tapes were encrypted (not the disks in this incident). Even though this case doesn't affect me this was the first question that (always) pops in my head.
:).
:).
:).
For much the same reasons cited here our company backups are taken offsite (daily) -- only difference is that instead of tapes and disks we found that for speed, volume, and cost it was better to go with external hard drives (I figured this out almost ten years ago myself
Even though we are a small organization (under a few hundred employees) the data is encrypted. That was step one and one of the most important IMHO. The average Joe who finds / steals any of our external drives (which has never happened thankfully) would be hard pressed to even figure out the filesystem (Ext3). Not that that would really slow down anybody who knows what they're doing -- nor was it done for security (I just like / trust Linux
Of course I can think of other problem areas where data is flying around unencrypted and sensitive. The Department of Employment Security (which many states all report to for and through payroll to track dead beat dads) takes their data with your social security number in a plain ASCII text file sent through the US mail on a floppy. What happens when you lose a floppy, or what do they do with the processed disks?
Fortunately and unfortunately we need and there will be laws requiring any such sensitive information to be encrypted for "National Security" (Big Brother [tm]) reasons. It's only a matter of time. It is unfortunate that it will take a law and more bureaucratic BS to make this happen, it is fortunate for all our privacy and the fact someone has to program this (more work for me
For some reason this is seaming to be a popular activity. I remember hearing a few years back in school about a sysadmin bringing the tapes home for offsite backup. There actually was an incident where he needed to get information off the tapes. Each tape he tried was corrupted. After doing some investigation, it turned out that the magnetic field from his car's seat heater was corrupting them.
Bottom Line: Secure transport and storage plans are required no matter how sensitive or mission critical your information is.
Proof by very large bribes. QED.
Ski Mask - $3
Running Shoes - $50
Thousands of stolen medical records -
PRICELESS
you are right,
the tapes are probably in a dumpster close to the thiefs house.
Maybe they drove to Target or somewhere and threw them out.
Then they get down to the serious business of striping the car for parts.
What sane company in this day and age is moving such a small amount of data around on tapes? Suppose (liberally) an average of 100K of data on each of their 365,000 patients. That would fit ten times over on one hard disk. Furthermore the entire database could be sent over a T1 in
... and daily diffs probably in a few minutes.
100000 * 8 * 365000 / 1500000 / 60 / 60 / 24 == 2.2 days
I just think it's really funny how many people still feel like storage and bandwidth are so scarce. A patient database is nothing compared to volume of porno and bittorrents that flows through the internet all day long
I also work at a healthcare provider adn deal with this exposure every day. Normal backups provides us no disaster recovery value because our recover point objective is measured in minutes. Tape simply can't meet it. Likewise if we were to attempt to restore the entire operation from tape it would take months. Just acquiring hardware would take weeks. But our recovery time objective is forty-eight hours. Basically, if we go longer than that we are out of business. So long term, our DR strategy is based on storage and app level replication between data centers. But as it stands, we only have one site. Consequently we send our backups offsite, essentially as a placebo. But it gets better. We don't have the drive resources to duplicate tape, so we send the originals offsite. That means that if we need to do a restore we must wait an hour for someone to retrieve the tape and reinject it into our library.
Let's review here: we have a fake DR strategy which adds an hour to every file restore and exposes us to data theft. Sounds good huh? I have repeatedly told our brass it would be better to do nothing, but their position is "We don't want to tell the newspapers we had no DR strategy when the disaster strikes."
How do we remediate this? Well, we could encrypt the tape but that is a big pain in the ass and has its own disadvantages. Really, the answer is to get off our ass and build a DR data center so the potentially deadly placebo goes away.
It is cowardly, and a betrayal of whatever it means to be a Jew, to act as a white man
-James Baldwin
Google's page count mysteriously jumps by 365,000 records. Coincidence? You decide.
It took me a minute to decypher that cyrptic comment, but look at these two parts from the article together:
In an announcement yesterday, Providence Home Services, a division of Seattle-based Providence Health Systems, said the records and other data were on several disks and tapes stolen from the car of a Providence employee at his home. The incident was reported by the employee on Dec. 31, according to the health care system.
The data on the tapes was encrypted, Walker said. The data on the disks was in a proprietary file format that was not encrypted, but "is stored in a way that would make it difficult, if not impossible, for someone to access it, then make any sense out of it," he said.
So think about it - Tapes AND Disks were stolen (at first I had thought it was just tapes). The hard to read media (tapes) were encrypted. But it doesn't matter, chuck 'em in the river because the DISKS (fasr easier to read by any fool with a computer) have data that is in a format that is just "hard to read"!!
Give me five minutes with Emacs and/or a Hex editor and/or Strings and I'll bet I could start churning SSN's out of the files right quick! I don't care if they are ISAM or DB2 or Pig-Latin! Security by file format obscurity is zero security, that data has to be treated as widely known at this point.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
...butt plug can stop..
a matter of the human factor and murphys laws...
I see lots of data theft / data loss. It seems that every month 100k+ people are affected when a company looses their personal information. I see these companies claim that they have no proof that the data is being used / read. I see these companies apologise for the loss and apologise for the inconvience and apologise for not keeping better track of customer data. I don't see the MASSIVE fines needed to get these companies to stop loosing our data.
Until the cost of loosing data becomes greater than the cost of maintaining an EFFECTIVE and SECURE data storage/backup process this isn't going to stop... ever.
In nature, there are neither rewards or punishments, there are only consequences.
At the ISP I used to work for, I always made it a habit to never stop anywhere or to talk to anyone on the walk to the bank. This helps ensure that you don't wind up with the "Its a Wonderful Life" accident and misplace $8000.
Of course, it doesn't help when the bank that your manager has forced you to use has really poor security of their safety deposit box. Banks are unbelieveable. Unbelieveably stupid that is.
I was screaming at my boss that we need to replace our tape drive. The backups were not restorable. Then I was fired and given compensation, which was good, I was about to quit. Six months later, a RAID crashed. My ex boss had to tell 300 persons: "All your work from five years is lost, sorry." Really sweat. People cheered when that guy was fired. They had a huge contingency plan, but they never validated a single backup. Never understimate the power of stupidity.
please excuse my apathy
inside job.
Only paying him 45k a year. You get what you pay for.
At least you're honest. Try reading the article. The car wasn't stolen; just the media.
Some see the vessel as half full; others see it as half-empty; We pour it out on the floor and laugh
Tiny companies (with whom I've worked) generally take their backup tapes to the bank each day and rotate them in and out of their safety deposit boxes. Although this still exposes the tapes to being stolen from the employee, it is still better than no backups.
But a company that has 1/3 million patient records should be well beyond letting someone "take the data home" for a DRP.
A fireproof safe is far better than a Pinto.
A Passionate Independent Musician
This must be some new meaning of the word encrypted that I was previously unaware of.
$20 says the worker is the one that "stole" the tapes. Who randomly walks up to a car and says "Oh look! Patent info! I'll take this home right away and start using my cryptography techniques to unlock it right away!"
Ex nihilo nihil fit.
I work for a healthcare organization in the same state as Providence (the number of them is pretty small so you could probably guess). Just last month we were reviewing policies to cover just this contingency.
Washington law demands that notification occur if there's any chance that the information could be used criminally. Since we too operate in Washington, we're also complying with that law.
Essentially you must notify each person directly unless the cost of doing so is upwards of a million dollars or so. There's then some contingencies where you can take out ads in major newspapers.
There's some strange exceptions to the rule. If our hospital accidentally sends clinical information to the wrong insurance provider and it's your normal mix-up rather than a potentially criminal act, that doesn't require notification. It sounds like if it wasn't the case, people would get notified all the time.
I expect to hear about this tomorrow when we go to work. I work fairly closely with the woman who manages these risks in our organization and she'll likely be hearing all about it. Scary stuff.
Don't tell anyone about it.
I would
CATS/Diebold '08- All your vote are belong to us!
Upon what are you basing this statement?
I can tell you, from first-hand experience, that the majority of companies do *not* encrypt their backup data. I could (but won't) name a dozen Fortune 100 companies that I know for a fact don't encrypt backups. I could (but won't) name dozens of Fortune 500 companies that don't. I could (but won't) name dozens of health-care companies/organizations that don't.
Why don't they? It's freakin' expensive. The argument can be made that losing data (like this) can be a lot more expensive (and I'd agree whole-heartedly), but getting the bean-counters to recognize that is a lot harder.
Encrypting the backups for one or two systems is pretty easy. The software is readily available, and the processing overhead is easily managed on a couple of boxes. Encrypting the enterprise is much harder. Either you try and manage keys and processor overhead on a few thousand systems, or you go with SAN devices to do the encryption... which ain't cheap.
Trust me, I architect solutions like this for a living. It's expensive. Really, really expensive.
What genius of a CIO thought an employee taking copies of tapes home in their car constituted a good disaster recovery plan? Especially in light of the flurry of highly publicized losses of customer information in recent months. My head is spinning just thinking about all the ways that a set of tapes in someone's car could be compromised.
If this isn't a case where a C-level executive loses his/her job -- in a very public way -- for allowing such a boned-headed plan to be put in place then I don't know what sort of gaffe could ever qualify. I'll be surprised if there aren't lawsuits filed over this by Monday.
CUR ALLOC 20195.....5804M
A company I used to work for in the wagering business used 9 track tapes (many states specify it in their laws, so we just used 'em everywhere). Not only are the channels not arranged to standard form, but the data itself is encrypted according to a variable password. The only clear block on the tape is the first, which gives you the sequence and index of the password. Then you have to get the book out, look up the password to restore the tape.
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
All they need now is a wedding and some rain...
This would apply to many other situations - toxic waste, other safety issues.
So what if the beagles ignore you? Send them a double registered letter cc'd to your lawyer?
Well, finally a Slashdot post I can write about with some experience. FWIW, I'm a physician in Portland and medical informatics is an interest of mine.
First of all, while it may shock many IT people that hospitals would use such rudimentary forms of backup and with little encryption, you have to understand that the state of IT in the medical world is backwards. Very backwards. There are a variety of reasons for this. One is that information systems are designed by IT people with little to no understanding of how the healthcare system works (which is understandable - many people in healthcare have little understanding of how it works). At the same time, you have healthcare professionals who really don't understand the full potential of how IT can be applied to healthcare or what its limitations are, but at the same time will complain about solutions that the IT world comes up with. There's this chasm between the two worlds and what you end up getting is a solution that no one likes and you end up having to go back to the drawing board over and over and over. It is absolutely amazing how much money gets sunk into medical IT and how very little progress it has made.
Another reasons includes the vast amounts of red tape in the medical world that are MEANT to prevent lawsuits and provide the best quality healthcare. But there's so much that it what it really ends up doing is bringing any kind of progress or new idea to a grinding halt. There is no industry I can think of which is so ill adapted to making changes even when they're necessary or make sense. The legal world has the medical world frozen in fear of the next litigation. The result is a paradoxical decrease in healthcare quality and increased costs.
Medical information privacy is one of those issues that seems to always be #1 on the list of concerns of electronic medical records. This has always been rather strange to me. How many people are really all that concerned with someone knowing about their cold, or their broken leg? Most people don't have much they would really care about hiding in their medical records. Of course, there are the people with mental illness, HIV, or sexually transmitted diseases. But even then, what exactly is this thief going to do with that information? IMHO medical information privacy is more of a theoretical concern than a real-life concern.
And then of course, there's the REAL reason people are considered with medical information being digitized identity theft for money reasons. I really blame the credit card industry for this more than anyone else. It's surprising to me that they could simply issue a credit card if someone just writes down a name, social security number and address. In this day and age with inexpensive biometric security systems, one would think they could require a submission of a fingerprint (or two). Hell, nowadays with branch offices literally EVERYWHERE, they could simply request you come in with your driver's license. It seems to me that it would be in a bank's best financial interests to do something like this.
Just my $0.02.
"The only normal people are the ones you don't know very well."
Not to mention the fact that they severely violated HIPPA The "Health Information Portability Accountibilty Act which is supposed to prevent boneheaded acts like this. If I am not mistaken he (or she) now faces a $25000.00 fine. Apparently many missed the memo on HIPAA compliance.
Mwa ha ha ha!!!
Contact me for the address where you can send the reward check.
I cried real tears when Li Mu Bai died.
That's an awful big number for the number of patients getting home health and hospice from a hospital system that's just one of several competing in two piddly states. If there were 365,000, there must have been many in there more than once. Not to mention that many of the hospice patients are now metabolically different.
Hell my brother had it car broken into once. The window smashed by a chunk of concrete (it was still inside) and the only thing missing was his coat, sunglasses and a broken camera we were always too lazy to simply take out.
Comment removed based on user account deletion
C'mon, who needs 'em? Do-it-yourself kidney transplant kit anyone? If you match the wrong bloodtype, my nose flashes red! Or maybe that was the organic "anesthetic" at work...
RTFA, the disks weren't encrypted. They can just grab all the personal data they want off of the disks. They are relying on security by obscurity because they say its a proprietary format. Any format someone can make, someone else can make something to read it. How hard is it to search for SSN in a data file?
And even better, what if the plain text on the disks is also on the tapes? Since you have the plain text original, you can easily decrypt the final encrypted version.
They are just trying to make it sound good when in reality, if the thieves realize what they have, they can make a killing off of it.
Reminds me of the sketch John Cleese did for LiveVault http://www.backuptrauma.com/video/default2.aspx.
:)
I specifically remember there being something in there about leaving tapes on the seat of a car
At first me think, oh good! 365 000 Medical Patents data stolen!
Me think lots of job for patent lawyer.
But then me put glasses on, and read again, me see it's really Patients, not Patents, and noone cares for Patients anyway.
--- 11 PAT3NT POW3R !!! 11 ---
What's the rfc for that? and does this transport mechanism support drm?
You use a private car for such a delivery?
You use your own basement as a "disaster recovery" site?
These sounds more like an excuse for some other dirty thing, like data loss, to be covered up.
And, of course, we all suppose that those backups have been recorded with strong cryptography, right?
In any case it seems that the major threat to information security is humanity.
Maybe Computers will never be as intelligent as Humans.
For sure they won't ever become so stupid. [VR-1988]
Didn't say (or didn't mean at least) that it was. But if you're looking to rob someones car, wouldn't you go for the most obvious and expensive things? Car radio, purse, iPod, etc. Why would someone grab a bunch of computer tapes? Just seems a bit comical to me...
This why there are companies that specialized in off site back ups.
1) Make back ups
2) Pay company to pick up the DLT's
3) Tapes get dropped off to secure facility.
Some companies that come to mind are
a) Iron Mountain
b) IG2
Hell, if there is a problem; they will come back to your shop in a couple of hours with the tapes in question.
Why do I get the feeling that this used to be done; but the practice of cost cutting changed that plan. No, I don't have inside info; just a gut feeling. On a side note; I work in a data center and I have seen cost cutting plans by various companies in action. Tapes no longer get shipped off site; they just site there in a cage on the floor.
Practices like these are disconcerting; makes me wonder why I still work in this business. Cutting costs still seems to me the norm. Everything is fine and dandy until you have to restore the tapes or fix an outage. Sorry for going OT; but it is getting a tad bit depressing with the current state of affairs.
Backup tapes and disks with data on 365,000 patients were stolen out of the car of a worker at a healthcare company in Portland.
Ironically, several Britney Spears, Backstreet Boyz and N*SYNC cds were still found in the back seat, unharmed.
He who knows best knows how little he knows. - Thomas Jefferson
Depends on the keying structure. I work on an old MPE/iX machine that uses flat table crap (I'm babysitting the POS atm, in fact), and the difficulty would arise if the tables were keyed with third or fourth tables that weren't included in the backup, or were included on a different tape...This crap happens all the time, and generally you just have to "know" that those things are connected in that way. So you could end up with a SSN and a name, but no way to connect them.
Or, depending, you could end up with a 300 character long string of integers and no way to tell where the SSN began/ended. If the item stored before/after it was a date, you'd be good, but if it was some weirdass key, you might have no idea.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
he took them home as part of a disaster recovery plan
In my country in the middle of Europe, that itself would be a crime. No one could possess any personal data (including making copies of personal documents) the law does not say explicitly he can. 8 years in prison.
There you are, staring at me again.
Encrypting is not always the proper solution either. One has to understand that computer security is more about risk management rather than nuts and bolts systems engineering. For tapes that go out of a facility, encyption is usually best, however there are risks involved with encrypting itself. For one thing, if the keys or passwords get lost (or stolen, by a disgruntled employee for example), the data is gone because at that point no one can recover it. For another, the software or algarithm has a flaw that won't allow decryption for some reason (it can happen). Point being, truly understanding information systems security is more complex than most people think.
Of course, there's a privacy, breach of trust yadda yadda issue. But it's not like the thief can actually do anything with that data, right? There's no one he can sell it to, or something... right?
I expect the disks to just turn up in a dumpster somewhere, sometime soon.
Okay, granted, "I'll make photocopies of the paper files and put them in the back of my Gremlin" doesn't come close to any standard of privacy protection, with or without the law. But HIPAA's so far-reaching that it can sort of paralyze people and organizations, to the point where the guy who's willing to cut corners can feel like he's cutting through the B.S. and just getting things done.
HIPAA's a pretty big nonspecific anxiety for lots of people in health care. Health insurers have teams of lawyers, and hire outside lawyers, just to consult over the implications of the thing and to train their people and so on.
"Fundamentalism" isn't about divine morality. It's about human authority.
My Honda Civic is open for business. I specialize in offsite data storage.
we have a fake DR strategy which adds an hour to every file restore and exposes us to data theft.
So why don't you just send blank tapes (to go through the motion) and keep the real ones on-site to speed up your recovery time and eliminate the theft possibility?
In case disaster strikes your primary site (flood, fire, etc), you downtime will be longer than 2 hours and the company is out of business anyway, so the off-site tapes won't do any good anyway.
Oliver.
From TFA:
"The tapes and disks were taken home by the employee as part of a backup protocol that sent them off-site to protect them against loss from fires or other disasters. That practice, which was only used by the home health care division of the hospital system, has since been stopped, said health system spokesman Gary Walker."
This was part of the company's protocol? An employee taking the shit home and leaving it in his car? Personal/medical/financial data for umpteen hundreds of thousands of people? What happened to HIPAA?
Whomever came up with this "protocol, as well as the empoyee, should be fired and prosecuted.
Perhaps if this finally happens to a children's hospital someone in this "WON"T SOMEONE THINK OF TEH CHILDREN!??!?!?11!!~~!!tilde!!!OMGWTFBBQ!!!" culture we've got will actually do something about it.
Cripes... people were fired up over Janet Jackson's tits, but not over this?
...Rob
The American Dream isn't an SUV and a house in the suburbs; it's Don't Tread On Me.
So that's, what, a $20 million fine?
Stop! Dremel time!
The procedure should have been to go directly from the data center to a bank - and deposit the backups in a safe deposit box. The data should never make a pit-stop in someone's driveway. :(
Unless you get attacked on the way to the bank (and if you think that likely, take steps to provide security for the transfer - maybe an armored car if it is that sensitive), there shouldn't be an opportunity for anyone to gain access to the data. Usually keeping a low profile, and varying the times and days you make the deliveries is sufficient.
For smaller businesses this can be as simple as backing up the encrypted data onto a gigabyte usb drive - which can be delivered to the bank unobtrusively.
Additionally, there are companies that provide the service of picking up and securing backup media - if you don't have the resources or want to hassle with it yourself.
Lodragan Draoidh
The more you explain it, the more I don't understand it. - Mark Twain
So... the data was obviously encrypted, right? AFAIC that should be standard operating procedure with offsite backups of sensitive data.
In many places social security numbers are used as medical ids. I noticed this while visiting many doctors after an auto accident in 2003, even though my health insurance card no longer uses socials (switch due to a California law). I dont know how they got my social, but they had it. I just cross my fingers and watch my financial records.
I hope somebody involved in enforcing HIPAA can start slapping large punitive fines on companies that use such slapdash practices for handling sensitive medical records. They need a large tangible downside to realize that sending hundreds of thousands of unencrypted medical records to an employee's home is not a money-saving strategy.
It sounds like the employee likely left the whole box of tapes and disks in the cabin of the car in plain view overnight.
For the patients' sake, let's hope their medical staff is more thoughtful than their IT staff. I can hear the surgeon now, "Wash my hands? They look clean, what could possibly go wrong?"
http://www.fortwayne.com/mld/fortwayne/news/local/ 13716471.htm
The legal world has the medical world frozen in fear of the next litigation.
Boy am I sick of hearing this canard. Here's an easy way of preventing lawsuits: Don't screw up. That's what I have to do in my profession. Blaming the law for holding you accountable is common, but really makes no sense.
You can't spend time in a hospital and miss the disorganization, negligence and sheer ineptitude. In my family, nobody gets hospitalized without a bodyguard to make sure that they get the right medicine, at the right time, that the right hand knows not to do X because the left hand just performed procedure Y, and that the weakened patient isn't overwhelmed by lazy doctors and nurses who care mostly about dispatching their case efficiently.
Everyone I know has the same experience -- Yet the medical community, very aware of the level of errors, acts suprised when they are held responsible!
But enough anecdotal evidence:
That's right, doctors' errors are at least the eighth leading cause of death in this country. And the problem is the lawyers?
... Americans have fewer doctors per capita than most Western countries. We go to the doctor less than people in other Western countries. We get admitted to the hospital less frequently than people in other Western countries. We are less
The response of the medical industry is to continue their practices, blame lawyers, and lobby congress for protection from accountability. I remember when the IOM study came out, it was proposed that hospitals be legally required to report these errors -- think about that: There is no reporting mechanism for, and no regulation of, hospital errors!. The American Medical Assoc. (the doctors' lobby) resisted, saying the potential penalties would discourage doctors from complying. By that reasoning, I shouldn't have to report running that guy over the other day -- I might be held responsible!
It can be done better:
When anesthesiologists were facing high error rates and corresponding malpractice costs, they took a different approach: They systematically studied the problem and tried to reduce errors. As a result, deaths due to anesthesia dropped from 1 in 5,000 to 1 in 200,000-300,000. And insurance premiums dropped 37%. You can read about it here or pay for the full story here.
And most of the industrialized world countries manage to deliver better care for far less. According to a study reported here, Americans spend $5,267 per capita on health care every year, almost two and half times the industrialized world's median of $2,193;
The interesting thing is that you can have medical research studies where we have a federal mandate (not George/Dick action, this means we have to do it) to use paper forms.
So, when we have a requirement to keep the data on such forms, we could courier it, but then confidentiality and other issues come into play. It's easier to have a hand off of the physical forms from one person (the clinician or someone on the clinical staff) to another (the researcher or someone on the research staff).
Now, a lot of times, the data has been masked in such a way that you shouldn't be able to figure out who it is: e.g. PatientID is in a table we make, VisitID is the same, we only record Month and Year instead of a full birthdate, there's no name on it, we do record gender, but if the research project or medical form includes certain data (patient U5036 (fake ID) reports he was born FEB 1935, spouse U5036A reports she was born MAR 1935, married DEC 1955, reports accident JAN 1998 (details)) - well, if you were patient and good at searching, you could probably reconstruct who it was, with access to public records).
So, just because it's patient records is not the problem - the problem is it included credit card, medical insurance policy/carrier, birthdate, SSN data that makes it useful for fraud.
Of course, because it is medical data on patients, there are blackmail risks, in that patients in confidence may report things they definitely do NOT want public information, such as say same-gender relationships of a sexual nature or some such.
-- Tigger warning: This post may contain tiggers! --
Atleast here something physical went missing. How about "open" wireless networks or unguarded network connections within the reach of the "customers" of a hopsital? Nobody would ever know.
For example: last year some security experts had access (in some cases read/write) to 1.2 million records for 2 weeks at 2 hospitals in the Netherlands by access their networks.
I guess that there are more than 1 record per person, but consider the Netherlands has a population of only 16 million.
You can damn well bet they have information theft criminals on their payrolls too.
-Clio
Karma: Bad (mostly from not giving a fuck)
Blog: http://clintjcl.wordpress.com