Slashdot Mirror
Physician Operates On Server, Costs His Hospital $4.8 Million
Hugh Pickens DOT Com (2995471) writes "Jaikumar Vijayan reports at Computerworld that a physician at Columbia University Medical Center (CU) attempted to "deactivate" a personally owned computer from a hospital network segment that contained sensitive patient health information, creating an inadvertent data leak that is going to cost the hospital $4.8 million to settle with the U.S. Department of Health and Human Services (HHS). The error left patient status, vital signs, laboratory results, medication information, and other sensitive data on about 6,800 individuals accessible to all via the Web. The breach was discovered after the hospital received a complaint from an individual who discovered personal health information about his deceased partner on the Web. An investigation by the HHS Office for Civil Rights (OCR) found that neither Columbia University nor New York Presbyterian Hospital, who operated the network jointly, had implemented adequate security protections, or undertook a risk analysis or audit to identify the location of sensitive patient health information on the joint network. "For more than three years, we have been cooperating with HHS by voluntarily providing information about the incident in question," say the hospitals. "We also have continually strengthened our safeguards to enhance our information systems and processes, and will continue to do so under the terms of the agreement with HHS." HHS has also extracted settlements from several other healthcare entities over the past two years as it beefs up the effort to crack down on HIPAA violations. In April, it reached a $2 million settlement with with Concentra Health Services and QCA Health Plan. Both organizations reported losing laptops containing unencrypted patient data."
This is why you have IT staff, and you let them do their jobs. Typical "i'm a doctor, i went to school and know everything" mentality.
Too bad they didn't fine the actual doctor instead of the hospital as it was his personally irresponsible actions that caused the breech, not hospital policy.
---- Booth was a patriot ----
If they're gonna blame the doctor for "attempting to deactivate" something, they have to explain wth that means...otherwise it's just a scapegoat
It's not clear why a physician had a personally owned system connected to the network, or why he was attempting to deactivate it.
Of course it is. It was more convenient for him/her personally, despite putting sensitive patient data at risk in a venue beyond the doctor's ken.
It's a commons tragedy (the Bizzaro-World Spock-doctrine): better for one at the expense of the many.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
What's the point in having a "secure" HIPAA compliant network that anyone can connect any old computer to? If the admins had just locked out unauthorized MAC addresses this wouldn't have happened. It would have cost them less than 4.8 million to implement even at healthcare contractor rates.
I am becoming gerund, destroyer of verbs.
Having worked in IT and software development for a number of different health systems some common themes run true.
1) Over emphasis on the needs of the physicians over the needs of the patients and the other areas of the healthsystems. Many important IT choices are made by doctors and not the professionals who were hired to be experts in these areas. That and the physicians are notorious for having almost no respect for other professionals who are not a doctor.
2) Easy money. Money comes easy to these organizations. This plus...
3) Non-profit tax status and requirements to spend or invest profits earned. This creates an environment of plentiful budgets where waste runs rampant, and concern over things such as nepotism and incompetence aren't as important as they would be in other companies.
Of course with nepotism you get politics so thick you couldn't cut it with a carbide blade. This causes a technical brain drain to the point where you have a bloated IT department with 20 incompetent people for every person who knows what they are doing and is always taking the role of the Hero. The Hero can get things done and keep things secure despite all of the problems but eventually like everybody else, the Hero is a human being and has flaws like a human being. The Hero occasionally makes a mistake.
If, in a democracy, the government money isn't being spent as if it is the people's money, the people are doing something wrong. And the whole point of public law is that it imposes sanctions "in the public interest", not for the sake of the specific victim. (Sometimes this justifies stupidity, e.g. anti-marijuana law, but mostly it's why we have a civilisation and not a libertarian dystopia.)
Any personal damages can still be claimed in civil court.
I won hands down - technology people are the arrogant asses.
Though you would never guess that by reading slashdot comments.
In their education, professionals, whether physicians or IT admins, are often inculcated with a professional swagger to the effect that they assume superiority in any situation. It is wise not to trust the judgement of those who exhibit this characteristic. They are commonly blind to their own failings and dismissive to others' concerns. Sadly, many are most impressed by this phenomenon, which they misapprehend as, "confidence".
No user should be able to do anything that would lead to this result. This is not the doctors fault. He may have violated a few policies, but to blame the entire incident on him is a bit ridiculous. This was a failure of their Network/Security team.
I second that notion. You have two issues here: the doctor should not have been able to reconfigure access in this way, and the IT staff should have spotted an unusual flow when the breach was active.
Clearly the [recital 2a] Googlebot and others were spidering patient data for some time, those 6,800 records would account for a lot of traffic. EVEN IF the queries were https encrypted or the URLs contained session hashes instead of data, logs would show web spiders accessing presumably 'internal use only' functions.
It is the responsibility of the senior IT administrator to establish a 'normal' baseline and track data flows at the router level, also set up an automated system which profiles web logs to profile transactions into as narrow a 'normal' definition as possible... and flag unusual patterns. If unusual flow is spotted this responsibility includes direct content sniffing of unencrypted communications.
No real hacker would identify as Googlebot when vacuuming out an internal-use database, for fear of setting off trip wires. If only such trip wires had been in place...
Ask Slashdot: How Do You Tell a Compelling Story About IT Infrastructure?
I hereby submit this one.
<blink>down the rabbit hole</blink>
I won hands down - technology people are the arrogant asses.
The difference is technology people are typically arrogant about technology, what should be their area of expertise, whereas most of the arrogant ass doctors I've encountered are arrogant about everything. The technology guy isn't going to walk into the doctor's office and start telling him about how to do doctoring stuff. A great many people will tell tell technology people all about how to do their job.
In any field I usually take arrogance as a sign of incompetence. Typically smart people think they know less then they really do and stupid people usually think they know more. The caveat being perception of arrogance is somewhat relative also. Arrogant people usually perceive anyone who knows more about something then they do as arrogant. That being said though, there are definitely a lot of incompetent technology people, almost certainly a lot more then there are incompetent doctors.
Who is John Galt?
Let's ignore how the IT dept should have some kind of network traffic scans to see this stuff, how the heck does a non-admin do something like this? And I'm not attributing it to malice, I'm sure this guy "meant well" and in the process managed to screw everything up. Otherwise, I'm going with "scapegoats" for 1000, Alex.
In the future, I would want to not be isolated from my friends in the Space Station.
"Hey, doc! I've done some first aid before. Mind if I treat your patient?"
"Hell no!"
"Why not?"
"Because I spent years obtaining an advanced degree, and have spent years since practicing and keeping my skills up to date."
"Well, then, doc, for the exact same reason, KEEP YOUR HANDS OFF OF MY NETWORK".
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
I see it as an issue of low accountability for the most part, having different IT areas budgeted and the need to spend that budget before the year is out or otherwise we won't get the same amount of money next year. That's the mentality that most organizations take with silo-ing of budgets but to me seems to be a waste.
In my organization, they have outsourced the servers and support for the EMR to the EMR manufacturer for them to host in the "cloud" while adding more Citrix redirections and latency for the users. The entire EMR support staff is several orders of magnitude larger than the database / networking / software engineers combined. The people that they do hire to write support side software are imbeciles at best and have been here for several years -- no one is fired for incompetence but layoffs do occur.
Unfortunately, the higher ups in the C-level do not seem to understand the sandcastle that they've built within the hospital and IT department as their vision of what should be and the reality of it are completely divorced. I can see it as a physician with engineering and consulting experience who works in the ED day in and day out but the C-levels who are mostly non-physicians do not see the cruft that's built up or the inefficiencies that they have introduced.
If I had my way, I would bring everything in-house, bring in more open source systems, and hire engineers to write custom applications. Nonetheless, there is so much you can do when your ONE community hospital.
As to IT supporting its users, the issue is very simple and cuts across the entire healthcare system. Engineers do not talk to clinicians about the systems that they build and in so doing build clinical systems for engineers. I understand the mindset but as a emergency physician that has to see many patients in the day, the system that they've hoisted on us becomes a PITA to work with as the workflow I have created for myself does not equate with the workflow software engineers "think" that I should have. I want more input from physicians into the systems that are built. I want the engineers to come to the ER or to the inpatient floors or to the office to see how we work and help us perform in efficiently and safely.