Slashdot Mirror
Physician Operates On Server, Costs His Hospital $4.8 Million
Hugh Pickens DOT Com (2995471) writes "Jaikumar Vijayan reports at Computerworld that a physician at Columbia University Medical Center (CU) attempted to "deactivate" a personally owned computer from a hospital network segment that contained sensitive patient health information, creating an inadvertent data leak that is going to cost the hospital $4.8 million to settle with the U.S. Department of Health and Human Services (HHS). The error left patient status, vital signs, laboratory results, medication information, and other sensitive data on about 6,800 individuals accessible to all via the Web. The breach was discovered after the hospital received a complaint from an individual who discovered personal health information about his deceased partner on the Web. An investigation by the HHS Office for Civil Rights (OCR) found that neither Columbia University nor New York Presbyterian Hospital, who operated the network jointly, had implemented adequate security protections, or undertook a risk analysis or audit to identify the location of sensitive patient health information on the joint network. "For more than three years, we have been cooperating with HHS by voluntarily providing information about the incident in question," say the hospitals. "We also have continually strengthened our safeguards to enhance our information systems and processes, and will continue to do so under the terms of the agreement with HHS." HHS has also extracted settlements from several other healthcare entities over the past two years as it beefs up the effort to crack down on HIPAA violations. In April, it reached a $2 million settlement with with Concentra Health Services and QCA Health Plan. Both organizations reported losing laptops containing unencrypted patient data."
This is why you have IT staff, and you let them do their jobs. Typical "i'm a doctor, i went to school and know everything" mentality.
Too bad they didn't fine the actual doctor instead of the hospital as it was his personally irresponsible actions that caused the breech, not hospital policy.
---- Booth was a patriot ----
If they're gonna blame the doctor for "attempting to deactivate" something, they have to explain wth that means...otherwise it's just a scapegoat
It's not clear why a physician had a personally owned system connected to the network, or why he was attempting to deactivate it.
Of course it is. It was more convenient for him/her personally, despite putting sensitive patient data at risk in a venue beyond the doctor's ken.
It's a commons tragedy (the Bizzaro-World Spock-doctrine): better for one at the expense of the many.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
In which case he was entitled to 'deactivate it'. Not necessarilly to expose the information, but that may not have been his fault.
There almost has to be more to this story than we're hearing, and I'd be interested in the details. Why dopes one have to "reconfigure" a server to disconnect a single, personally owned computer from a network? The doctors I know would pull the ethernet cable, pick up the computer and go home, without even thinking about the sever.
No user should be able to do anything that would lead to this result. This is not the doctors fault. He may have violated a few policies, but to blame the entire incident on him is a bit ridiculous. This was a failure of their Network/Security team.
What's the point in having a "secure" HIPAA compliant network that anyone can connect any old computer to? If the admins had just locked out unauthorized MAC addresses this wouldn't have happened. It would have cost them less than 4.8 million to implement even at healthcare contractor rates.
I am becoming gerund, destroyer of verbs.
That's why you don't let Doctor Bashir play with the ship's phasers or the self-destruct sequence. There are other qualified high-rank officers to do that kind of work (when they're not mind-controlled by aliens or trapped in another plane of existence)
A friend of mine did a job as an IT intern for a big Dutch university hospital and he and all his colleagues could access all patient records without it even getting logged.
"We also have continually strengthened our safeguards" - Ha ha ha...
There was no IT security, control or safeguards. The doctor should not have been able to use his personal computer on the hospital net.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
I thought you were going to say: "Without him even logging in", since that would be even more likely.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
They get money that is provided to *them* to buy computers for continuing education - it's a convoluted mess and little can be done to stop it because they are required to use the things to 'learn' so many hours a day.
But the aggrieved patients whose information has become public knowledge get none of it. Something is wrong with that picture.
Having worked in IT and software development for a number of different health systems some common themes run true.
1) Over emphasis on the needs of the physicians over the needs of the patients and the other areas of the healthsystems. Many important IT choices are made by doctors and not the professionals who were hired to be experts in these areas. That and the physicians are notorious for having almost no respect for other professionals who are not a doctor.
2) Easy money. Money comes easy to these organizations. This plus...
3) Non-profit tax status and requirements to spend or invest profits earned. This creates an environment of plentiful budgets where waste runs rampant, and concern over things such as nepotism and incompetence aren't as important as they would be in other companies.
Of course with nepotism you get politics so thick you couldn't cut it with a carbide blade. This causes a technical brain drain to the point where you have a bloated IT department with 20 incompetent people for every person who knows what they are doing and is always taking the role of the Hero. The Hero can get things done and keep things secure despite all of the problems but eventually like everybody else, the Hero is a human being and has flaws like a human being. The Hero occasionally makes a mistake.
There is no cure.
"Consensus" in science is _always_ a political construct.
I have done IT work in clinic environments and every doctor I have worked with usually started the conversation with, "I'm really stupid about computers .... could you help me with ...." or something like that.
That was from a doc who was 30 something. The older they get, the more tech phobic they are.
My wife is a provider and we have a contest to see who has the most "arrogant ass" story. Or who is more arrogant: doctors or IT/Software developers/engineers.
I won hands down - technology people are the arrogant asses.
Would a surgeon let an amateur operate on a patient? No. Do they think they are as good as competent CS experts? Yes. Pathetic.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The perfect example of a practicing doctor.
One branch of government profits from hospitals unintentionally misusing your private information, then another branch of government takes those profits to fund the intentional and illegal misuse of your private information.
In Ludlum's Bourne universe, I would conclude that the laptop has been viraled out. Fly those doctors to Malaysia!
In their education, professionals, whether physicians or IT admins, are often inculcated with a professional swagger to the effect that they assume superiority in any situation. It is wise not to trust the judgement of those who exhibit this characteristic. They are commonly blind to their own failings and dismissive to others' concerns. Sadly, many are most impressed by this phenomenon, which they misapprehend as, "confidence".
I surf only "anonymously" on slashdot(no account/login). Every time I load /. I use the following url:
http://slashdot.org/?nobeta=1
It 'generally remembers my preference' but more and more as I click the article/comment page I am redirected to beta version.
I can then manually change the url to remove the beta. in the url but that becomes a drag.
Did any of the boasters about alternative/new /. sites ever get off the ground?
No user should be able to do anything that would lead to this result. This is not the doctors fault. He may have violated a few policies, but to blame the entire incident on him is a bit ridiculous. This was a failure of their Network/Security team.
I second that notion. You have two issues here: the doctor should not have been able to reconfigure access in this way, and the IT staff should have spotted an unusual flow when the breach was active.
Clearly the [recital 2a] Googlebot and others were spidering patient data for some time, those 6,800 records would account for a lot of traffic. EVEN IF the queries were https encrypted or the URLs contained session hashes instead of data, logs would show web spiders accessing presumably 'internal use only' functions.
It is the responsibility of the senior IT administrator to establish a 'normal' baseline and track data flows at the router level, also set up an automated system which profiles web logs to profile transactions into as narrow a 'normal' definition as possible... and flag unusual patterns. If unusual flow is spotted this responsibility includes direct content sniffing of unencrypted communications.
No real hacker would identify as Googlebot when vacuuming out an internal-use database, for fear of setting off trip wires. If only such trip wires had been in place...
Ask Slashdot: How Do You Tell a Compelling Story About IT Infrastructure?
I hereby submit this one.
<blink>down the rabbit hole</blink>
doctors are independent contractors or something like that where they work for some outside company so they may need to have there machines to get work done.
Let's ignore how the IT dept should have some kind of network traffic scans to see this stuff, how the heck does a non-admin do something like this? And I'm not attributing it to malice, I'm sure this guy "meant well" and in the process managed to screw everything up. Otherwise, I'm going with "scapegoats" for 1000, Alex.
In the future, I would want to not be isolated from my friends in the Space Station.
Maybe true (some docs are independent contractors). But in any sort of hospital, anything computer related, has to go through IT. I can't imagine them letting anyone have a friggin server with an outside connection. Especially a system as large as this.
The only way I can put this together is that Columbia is so large that they've lost control of their network to the point where any half bright person could just set up a server. I'm pretty sure that if the doc had said "I need a personal server to go through the firewall" (and whatever else they have) he would have been laughed out the room.
Of course, TFA has no detailed information on what exactly happened so we are just guessing.
Faster! Faster! Faster would be better!
When Joe Office Worker gets it in his head that IT are not professional white collar workers who are their coworkers and not their lackies, this is the result. "I own a computer at home, I can do this better than some dumb IT Janitor/Plumber" And people wonder why IT thinks they're idiots.
The fact that the system allowed this to occur is the responsibility of the hospital. The advantage of this for us geeks is that we can point to it when discussing security with senior management; that sort of scale of fine does get their attention. OTOH if we don't make the effort to ensure our systems are secure, we deserve the kicking.
No user should be able to do anything that would lead to this result. This is not the doctors fault. He may have violated a few policies, but to blame the entire incident on him is a bit ridiculous. This was a failure of their Network/Security team.
I second that notion. You have two issues here: the doctor should not have been able to reconfigure access in this way, and the IT staff should have spotted an unusual flow when the breach was active.
You missed the part where the doctor is actually a developer and was essentially working in IT....
And we wonder why doctor costs keep going up. Stuff like this comes back and costs patients money. Insurance pays for it, hospitals pay to be insured, patients pay to visit doctor.
In medical, not knowing and asking questions is accepted and encouraged.
Humility in medical is a MUST.
In technology, not knowing is a sign of being stupid. It is a sign of incompetence.
I have worked on operating systems. I once asked about some esoteric fact about networking that would have required a week of reading and experimentation and I was told that I was "stupid" and I did not "belong here" (that was on a Cousera Networking class, BTW).
Humility in tech is a sign of "weakness" and "stupidity".
The employers follow that ideology. Like Google and everyone else in Silicon Valley.
Not knowing "everything" is a sign of stupidity.
As far as tech hiring people are concerned, all of us are stupid - and bring in the H1-bs.
I love tech but I really hate this arrogant attitude that is so pervasive in tech - and why I left - and still here because of my avocation.
Maybe true (some docs are independent contractors). But in any sort of hospital, anything computer related, has to go through IT.
A while ago some article around here mentioned a group of doctors who had privileges at a local hospital. The hospital required the medical group to agree to hospital IT policies, security audits and unannounced penetration tests in order to connect the group's computers to the hospital network.
I see it as an issue of low accountability for the most part, having different IT areas budgeted and the need to spend that budget before the year is out or otherwise we won't get the same amount of money next year. That's the mentality that most organizations take with silo-ing of budgets but to me seems to be a waste.
In my organization, they have outsourced the servers and support for the EMR to the EMR manufacturer for them to host in the "cloud" while adding more Citrix redirections and latency for the users. The entire EMR support staff is several orders of magnitude larger than the database / networking / software engineers combined. The people that they do hire to write support side software are imbeciles at best and have been here for several years -- no one is fired for incompetence but layoffs do occur.
Unfortunately, the higher ups in the C-level do not seem to understand the sandcastle that they've built within the hospital and IT department as their vision of what should be and the reality of it are completely divorced. I can see it as a physician with engineering and consulting experience who works in the ED day in and day out but the C-levels who are mostly non-physicians do not see the cruft that's built up or the inefficiencies that they have introduced.
If I had my way, I would bring everything in-house, bring in more open source systems, and hire engineers to write custom applications. Nonetheless, there is so much you can do when your ONE community hospital.
As to IT supporting its users, the issue is very simple and cuts across the entire healthcare system. Engineers do not talk to clinicians about the systems that they build and in so doing build clinical systems for engineers. I understand the mindset but as a emergency physician that has to see many patients in the day, the system that they've hoisted on us becomes a PITA to work with as the workflow I have created for myself does not equate with the workflow software engineers "think" that I should have. I want more input from physicians into the systems that are built. I want the engineers to come to the ER or to the inpatient floors or to the office to see how we work and help us perform in efficiently and safely.
don't look at me - I didn't set permissions [...] The receptionist got to have a long chat with the Sr. Partner spearheading the project about the use of the company PCs.
I would suggest the Sr. Partner was (like TFS and GP) blaming the wrong person. If your receptionist can delete your billing system, you are doing computers wrong and should probably just give up the whole technology thing.
We see the same attitude when companies threaten/injunct/sue academics who discuss technical flaws in security systems. As if showing that the security is lame caused the security to be lame.
Science is all about firing a drunk pig out of a cannon just to see what happens.
Money: The universal problem-fixing tool!
That's the "funny" thing about government agencies. We pay an awesome amount of taxes to support their existence, then when they actually have to DO something, we need to pay them again to do it.
That would be like me getting $100k a year to be a software engineer, but then when my boss gives me work, he pays me more money to do the work. Of course a dream scenario like that can only happen when the money is going toward pure waste, and not actually benefiting any person.
This kind of arrogance comes from literally being the smartest person in the room most of the time and from talking to idiots all day - something doctors do all the time. don't blame the doctors, look at the patients...
Below the speed of light Special Relativity is one of the most accurate theories in physics - above the speed of light..
I have probably forgotten more about IT than most even know. However, while I think I am competent in what I do, I do not know everything, nor is it really reasonable to do so. That is why specializations exist. Don't talk to the Network guy regarding your DB problems, or your DB guy about your Coding issues... Sure they may have some related experience and overlap, but likely won't be as knowledgeable as someone that does that as their core. Same with Doctors, they will all have a common background, but asking the ass doctor about your shoulder joint issue might get you the answer you need, but then again you might be better served by asking the right person.
I have been in the field long enough both in education and work, and have worked with enough people, to come to a pretty easy conclusion. Whatever you think you know, you don't know as much as you think... People that like above arrogantly attest that they know everything about everything are bullshitting you. Many are good enough to get the broad strokes and then figure out the actual details later, but that isn't quite the same thing.
Anyway this sort of cross arrogance is more about thinking something is easy when it is not, and "how hard can it be? I'm a smart person!". In most cases, sure you can do it, but likely not well. Like I have never done plumbing before. But "How hard can it be?", I could give it a shot, read a book, watch a few youtube videos... What I produce might work, but will it be good? Probably not. It will probably take me much longer to produce something that functions in a non-optimized way, that may or may not violate whatever building standards exist in my local area, which if discovered would have to be ripped out and replaced by a professional anyway. Where a professional would presumably know how to design the best system, do it in a much quicker fashion, and adhere to whatever rules or standards exist that are required. Sound similar?
I just wanna know what "deactivate" means in this context. Cause if it means shutting it off." I do not see how data leakage was even possible.