Slashdot Mirror
'Wall of Shame' Exposes 21M Medical Record Breaches
Lucas123 writes "Over the past three years, about 21 million patients have had their unencrypted medical records exposed in data security breaches that were big enough to require they be reported to the federal government. Each of the 477 breaches that were reported to the Office for Civil Rights (OCR) involved 500 or more patients, which the government posts on what the industry calls 'The Wall of Shame.' About 55,000 other breach reports involving fewer than 500 records where also reported to the OCR. Among the largest breaches reported was TRICARE Management Activity, the Department of Defense's health care program, which reported 4.9 million records lost when backup tapes went missing. Another five breaches involved 1 million or more records each. Yet, only two of the organizations involved in the breaches have been fined by the federal government."
Unless the various companies that lose the data are punished, nothing will change.
Be seeing you...
Now that the US government is taking over healthcare this problem will disappear!
I'm impressed. I wouldn't have guessed that insurance outfits had anybody familiar with the concept of 'shame' available to coin such a nickname...
On March 9, Blue Cross Blue Shield of Tennessee (BCBS) was fined the maximum $1.5 million for 57 unencrypted computer hard drives that were stolen from a leased storage facility in 2009. BCBS has since encrypted all of its hard drives, representing 885TB of data.
BCBS said it spent more than 5,000 man-hours on the encryption effort, which cost the company $6 million.
Say they used new HHD-s at $100 for a 1TB HDD -> HDD cost=$88,500. F*** it... let's be generous and say all the equipment amounts for $1M.
The rest should be labour-cost, isn't it? Which means $1000/h... Seems to be a good trade to be in.
Questions raise, answers kill. Raise questions to stay alive.
No, No, No - you have it all wrong.
Say $100K for the drives, another 50K for the 'Enterprise Level' software, another 100K for labor.
The other 5.5 million for upper level executive compensation.
Thinking this stuff through is hard.
Faster! Faster! Faster would be better!
And why do we care who has our medical information?
Because in the US, we've decided that the only people that get health care are those with jobs. So getting a job is deeply tied to one's state of health. Accidental leaking of your health care information could lead to losing your job, or failure to obtain one. Other laws try to tackle that, but nonetheless, we all have the fear that if our potential employer (especially) knew how much we might really cost, we wouldn't get that job. And the fact of the matter is that no employer wants to employ a sick person if they can help it.
We'd be better off decoupling health care from employment. One side effect would be that medical information wouldn't be so secret. This is rather important when you consider that that information should perhaps be shared among health care providers, patients with the same ailments, and especially, family (possibly distantly related but genetically susceptable, for instance).
1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.
I'd like to think that they use higher-grade drives than you buy at Fry's or where-ever. Would also assume RAID5 or better. Add in the fact they were probably plugged into a DMX or similar & $6M starts sounding reasonable.
Why they weren't encrypted from the start is the real question.
Umm... where's the news? This website has been around for YEARS. The breaches aren't anything new and anyone that is affected should've been alerted per HIPAA.
Why they weren't encrypted from the start is the real question.
HIPAA only recently grew teeth that makes non-compliance painful.
Small doctors offices are ripe for this. The software they use is a joke. Their security is horrendous. Easy to find sql passwords. Entire health claims stored in plain text. Claim files being sent via modem transmissions. Doctors that refuse to update their software or windows environment because they are cheap... List goes on.
I work with BCBS, they are idiots. It usually takes three people to give me three different wrong answers. It probably took 10 people per hard drive.
Thats not exactly true. There are many private medical facilities that have rejected government funding (medicare/medicaid) and a few that have totally rejected electronic medical records with good reason.
For example, The Surgery Center of Oklahoma only uses paper records (much more difficult for the government and third parties to "leak"). What's interesting about private medical facilities like this that reject medicare/medicaid is that they know the TRUE cost of performing an operation and post it on their website,
http://surgerycenterok.com/pricing.php
One of the doctors at that particular medical center has a blog that some might find worth reading,
http://032a410.netsolhost.com/WordPress/?cat=6
It usually takes three people to give me three different wrong answers.
That's grossly inefficient... in some of the places I worked, I only needed a single person (my manager) to get 3 different wrong answers.
Questions raise, answers kill. Raise questions to stay alive.
But you're still in their database, no? No matter how they keep it. I agree that's probably better than being in some insecure online system, but I was thinking more of a "pay and go" system. Like, I can show up at my barber, pay him $16 in cash, get a haircut, and leave, all without him tracking me across future visits and such. Seems like I should be able to show up with some minor treatable problem and have the clinic fix it, or maybe just get a checkup, pay them on the spot, all without getting into their database at all. But it doesn't seem to be possible.
The only database you're in is a paper file cabinet at that hospital. What are the chances those paper files are leaked onto the internet or stolen from someone's parked car? Nearly zero.
"Among the largest breaches reported was TRICARE Management Activity, the Department of Defense's health care program, which reported 4.9 million records lost when backup tapes went missing."
Submitter should have dug a little bit further. TRICARE was the agency where the records originated, but SAIC was the "business associate" that actually lost the records belonging to TRICARE.
I beat the system by having no significant medical records in the last 10 years :P One finger X-ray (no break, yay) and like 2 appointments for allergies. Good luck blackmailing me with that, lol. I just stay exceptionally healthy. Take that, hackers! lol.
If you read the article, you will see that the main problem is of proper handling of the backups, not the actual server application or database, or with other words, here the problem is the "meatware", not the "software"
I think this is all kind of backwards. Since moving to the US a decade or so ago from a country with universal healthcare* the biggest problem I've had is with getting my health records passed from one provider to the next when I change jobs / locations / insurers. I'd love it if someone hacked all my health records and put them on the web for everyone (including myself), since that'd actually mean my various providers could see what the last person produced. I really don't give a shit if my next door neighbor knows I have elevated cholesterol and am on anti-anxiety meds. Shit, if they knew that I was so stressed I was having panic attacks, maybe they'd stop firing up their fucking leaf blower at 8am sharp out of concern for my wellbeing. But I digress.
The reason Americans are so paranoid about 'other people' seeing their healthcare records is some of the 'other people' are for-profit health insurers and before 2010 (when key provisions of the Patient Protection and Affordable Care Act aka 'Obamacare' came into force) they could and did deny coverage to people with pre-existing conditions. It's not surprising that there's a bit of a social lag here - three generations of Americans have had to be scared about whether their for-profit healthcare provider could find a way to weasel out of actually paying for necessary healthcare, and it's going to take a while for people to realize they don't have to give a shit any more.
* Good luck guessing which country I moved from - every other first world country on earth has universal healthcare, as do many of those who can't easily claim 'first world' status.
To hell with fines. Felony-grade jail time in no less than medium-security, from top people on down, with the parole condition that upon release they never work with customer information or data again.
Nobody has to "hack" your medical record. HIPAA guarantees you a copy, so go ask for it.
If, instead, your beef is that the doctors treating you don't talk to each other, find some that do. Electronic health records make this trivially possible, and there are lots of Keysers out there practicing managed care.
Finally, do you really think that "for-profit insurers" are the only reason Americans expect their medical records to be confidential? I understand that you have Nothing To Hide, but "too much patient privacy" is the last thing wrong with healthcare in America.
DATABASE WOW WOW
The Cloud will fix this! See, if everything is in the cloud then everyone's records can be accessed without authorization at the same time, thus negating the need for the Wall of Shame! Or at least just have one name on the Wall. But then that's not much of a wall. Snippet of Shame? One-liner of Shame?
And what does your play-wife have to say about all of that? Is she concerned for her medical privacy in general, or just when you're around? Also, who was this other person at your work-wife? HOW was this other person "at" your work-wife? Answers. I demand answers.
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
Before passage, the HIPPA bill was much debated. Privacy advocates wanted two big things, (a) opt-in rather than opt-out and (b) the right for patients to refuse permission for their health into to be used in ways they don't want while still receiving treatment. They privacy advocates lost.
The result is that now, when you visit the doctor you get a multi-page privacy disclosure. You are allowed to request changes in how your health info is treated. However, the provider has the right to refuse treatment if you request even the slightest deviation. That means that providers can write their software presuming that 100% of patients consent to the most invasive and insecure privacy practices.
It should be the right of every patient to forgo the advantages of digitally stored health records and to opt-out without being sent packing without treatment. One should even have the right to seek treatment anonymously and pay cash. Even that is forbidden by state and federal laws regarding record keeping by providers.
I'm afraid that the only way out for US citizens determined to protect their privacy is itself a felony. I speak of identity theft -- fraudulently using someone else's identity to get health care.
HIPPA was supposed to protect patient privacy. Instead, it merely adds to the mindless and wasteful bureaucracy of health care while institutionalizing privacy invasive practices, giving legal cover to abusers, and criminalizing individual tactics to protect themselves. In addition, HIPPA preempted many state laws that provided better privacy protections than HIPPA.
TFA (second page):
On March 9, Blue Cross Blue Shield of Tennessee (BCBS) was fined the maximum $1.5 million for 57 unencrypted computer hard drives that were stolen from a leased storage facility in 2009. BCBS has since encrypted all of its hard drives, representing 885TB of data. BCBS said it spent more than 5,000 man-hours on the encryption effort, which cost the company $6 million.
Say they used new HHD-s at $100 for a 1TB HDD -> HDD cost=$88,500. F*** it... let's be generous and say all the equipment amounts for $1M. The rest should be labour-cost, isn't it? Which means $1000/h... Seems to be a good trade to be in.
If only it was as easy as just buying new HDs and installing them in the systems. Sorry, but they are most likely dealing with multiple enterprise levels systems, some that have to be FDA approved, between multiple vendors. They have to make sure they can encrypt all the drives, that the vendors will still support the system in question, that the FDA is ok with it, fully tested, and that in all that there is no downtime. Like it or not, you're talking about multiple projects involving lots of people and probably a decent amount of upgrades. I bet there is some vendor paid money in there, but not much as $6m is nothing when paying GE to upgrade an already existing system because they won't support or sign off on either you doing your own work or the new configuration.
Otherwise, if you think you can take your laptop upgrading skills into healthcare levels, feel free to get a directorship in healthcare IT and show them all up by spending one sixth of what the other people are spending without having any major issues that would cause more problems than what you're trying to avoid.