Spyware Prank Exposes Hospital Medical Records

cheerytt writes "Let this be a lesson to all the broken-hearted geeks out there. A 38-year-old Ohio man is set to plead guilty to federal charges after spyware he meant to install on the computer of a woman he'd had a relationship with ended up infecting computers at a children's hospital. Spyware was sent to the woman's Yahoo e-mail address in the hope it would be used to monitor what his former girlfriend was doing on her PC. But instead, she opened the spyware on a computer in the hospital's pediatric cardiac surgery department. The spyware sent more than 1,000 screen captures via e-mail, including details of medical procedures, diagnostic notes and other confidential information relating to 62 patients. The man will pay $33,000 to the hospital for damages and faces a maximum sentence of five years in prison."

Comments

The Woman

[some_guy_88]

So what's happening to the woman who stupidly ran an exe she recieved in an email?

Re:The Woman

[mcvos]

Whitelist, don't blacklist, it's the first rule of security.

Except when you're mandated to provide general internet access.

If for whatever silly reason you need to provide general, unprotected internet access, you do that with seperate machines, isolated from the hospital medical record stuff.

Whichever way you spin this, it's a horrible, gaping hole in the security of the hospital's computer system. The people who set it up and authorised it need to be fired and replaced by people who know something about (the need for) security.

HIPAA - SHMIPAA

[C18H27NO3]

I wonder how it came to be that one would be permitted to check web-based email in the hospital's pediatric cardiac surgery department?
This incident could very well be the least of their problems for all they know.
The fact that it was able to install and send screenshots willy-nilly to Graham and who-knows-where-else is a HIPAA nightmare.


Just for grins I went looking through their employment opportunities to see if any IT jobs opened up recently and stumbled upon this:
(Not relevant to this thread but interesting, nonetheless

Nicotine-free hiring policy
Because itâ(TM)s important for healthcare providers to promote a healthy environment and lifestyle, Akron Childrenâ(TM)s Hospital has a nicotine-free hiring policy.
Newly hired employees are tested for nicotine as part of a pre-employment panel of medical tests.
Akron Childrenâ(TM)s will not hire applicants who test positive for nicotine use.
If you test positive for nicotine, the offer of employment made to you will be rescinded.
If after 90 days you successfully quit using nicotine, you may reapply for employment.

Who is really at fault?

[89cents]

a) The man for emailing the spyware?

b) The woman for opening it and infecting the computer?

c) Yahoo for not blocking it?

d) The hospital for not only allowing internet access from a computer with personally identifiable information, but for also allowing the spyware to get installed.

e) Some combination of the above?

Re:Who is really at fault?

[wordsnyc]

d) The hospital for not only allowing internet access from a computer with personally identifiable information, but for also allowing the spyware to get installed.

Bingo. They failed to take steps a reasonably prudent person would have taken to protect patient confidentiality under Federal law. Spyware installation via email is not exactly news.

Re:Who is really at fault?

[Dhalka226]

d) The hospital for not only allowing internet access from a computer with personally identifiable information, but for also allowing the spyware to get installed. Bingo. They failed to take steps a reasonably prudent person would have taken to protect patient confidentiality under Federal law.

Consultant goes to see hospital directors, stamps feet, and IT get overridden.

You make a compelling argument for not firing the IT guy for what happens which, let's face it, is probably what will happen after they scapegoat him if anything bad happens to the hospital.

However, "they" in the GP's post referred to "the hospital." In that sense it doesn't really matter if it's an incompetent IT staffer, a cranky doctor or poor executive management. Something that needed to be done under the law wasn't done, and the result was the leaking of confidential medical information. The hospital still deserves both blame and punishment for that.

Re:Not a Prank

[coaxial]

why is this that fellow that is responsible for getting the records - this was obviously not his goal and if he is charged for it then it is just laughable.

What the hell is this supposed to mean? Since when has committing a crime unintentionally ever been a defense?

"Oh officer! I wasn't INTENDING to kill all the cancer stricken orphans when I driving drunk, speeding, and firing my gun wildly! I just intending to disturb the peace!"
"Oh! Well, that's a horse of a different color! I'll let you go with a warning then. Just try and keep it down next time. People are trying sleep around here."
"Will do!"

but why is the hospital getting the money - they are guilty of criminal negligence in handling patients' data so they should be paying not getting paid.

1. It's criminal trespassing to access a computer without permission. Which he did by sending the spyware to someone with the intent to observe them.
2. The hospital didn't hand out the data. It was stolen. It's still theft even if I leave the door wide open. It wasn't his. He has it, as a result of his actions.

to me it looks like one more example of justice system malfunctioning. It is not a great malfunction but shows that punishment and the crime are matched not by the facts but by the random acts of gov. officials. Was it not something that american constitution tried to prevent?

The opinion of someone who is woefully ignorant of the law, the intent of the law, common law, and basic morality, but yet somehow is an expert on constitutional law.

It must be tough being so smart and surrounded by so many people that are blind to your brilliance.

Go home and cry in your Ayn Rand novel.