Slashdot Mirror
Why Chinese Hackers Would Want US Hospital Patient Data
itwbennett (1594911) writes In a follow-up to yesterday's story about the Chinese hackers who stole hospital data of 4.5 million patients, IDG News Service's Martyn Williams set out to learn why the data, which didn't include credit card information, was so valuable. The answer is depressingly simple: people without health insurance can potentially get treatment by using medical data of one of the hacking victims. John Halamka, chief information officer of the Beth Israel Deaconess Medical Center and chairman of the New England Healthcare Exchange Network, said a medical record can be worth between $50 and $250 to the right customer — many times more than the amount typically paid for a credit card number, or the cents paid for a user name and password. "If I am one of the 50 million Americans who are uninsured ... and I need a million-dollar heart transplant, for $250 I can get a complete medical record including insurance company details," he said.
Time for medicare for all in the usa also the million-dollar heart transplant is loaded with markup where you can likely go out side of the usa and pay way less for it.
also due to court rulings in favor of inmate care you can just go to prison / jail to get one as well.
http://www.cbsnews.com/news/pr...
Are there documented cases where the uninsured poor have bought blackmarket medical records to get healthcare? This seem preposterous.
and more likely some hacker group wanting to sell SS# and CC# on the black market.
That's my opinion.
The thesis is that you can waltz into a doctor's office AND a hospital with faked records and get the treatment needed. Basically the important bit is the insurance info - what has happened to "you" is less important than what you want to eventually happen to you (in the example given, a heart transplant).
I kinda doubt this, at least in a general sense. First off, you can show all the insurance cards and 'insurance info' to the medical provider all you want. The provider is going to query the insurance company before doing anything expensive. Fine, you say, call them all you want, the 'patient' is insured (it's just not the right patient). Now comes the hard part. The minute that the insurance company starts getting claims from both Peoria and Trenton, NJ flags are going to go up. Other old records would be sought (for something big like a transplant or joint replacement) which would likely not match.
Anything remotely resembling a heart transplant is going to fall apart unless both the real and fake patient have nearly identical physiques, ages and problems. More routine issues could go undetected for a while but persistent discrepancies would show up and as soon as the insurance company flagged the claim as problematic, big ticket items would be placed on hold until things go cleared up. When I worked in an early Medicaid HMO in the 1980's we had some problems with folks 'sharing' the Medicaid ID card (no picture, just a printout basically). It was pretty obvious when the patient's weight varied 30 pounds every other week. We soon insisted on photo ID.
And, in fact, the feds also insist on photo ID these days. Yes, if you're bleeding out we don't ask for it up front but as soon as your blood pressure normalizes we're poking around to figure out just who you are.
So it's possible that that full on medical records might be of value, but it's going to be much harder to monetize than a credit card number and likely would be of limited use. That doesn't mean that the information shouldn't be sealed up, of course. I'm just not sure how big a deal this is. And, in the case of the Community breach, they apparently did not get that information anyway.
Faster! Faster! Faster would be better!
If I am one of the 50 million Americans who are uninsured ... and I need a million-dollar heart transplant, for $250 I can get a complete medical record including insurance company details
Something tells me it would be a little trickier than that given all that is involved in that million-dollar heart transplant. Not to mention all the local news coverage, the calls to the insurance company prior to surgery given the high cost of the surgery, getting on the waiting list, etc, etc. Not to say that it's not possible that people buy the records for getting medical care, but maybe that example isn't the best in the world.
In reality, I imagine it's the SSN coupled with a wealth of information about that person that is really what is so valuable. That can be used for any number of things other than medical care specifically. It's only naturally to link the source of the data to the ultimate purpose, but in this case I don't think they are so closely intertwined. It's simply valuable data held in a hospital network.
The parasites in congress are the problem, not the answer. They're feeding their friends, the lawyers. Let's be honest; It's a lot better for me to order tests than to evaluate a person. The insurance company doesn't pay me to do the latter, and the lawyers are waiting for me to do the former. The more tests I do, the harder a case they have to demonstrate, and the lower my insurance, so higher my profit. It's really simple. Keep electing your lizards instead of their lizards, and healthcare will continue to be defensive.
Medical records are insecure... so it's time to migrate to a system like the UK where they contain comprehensive information about each person? Am I actually reading this?
Until patient confidentiality is enshrined into laws with real teeth and my insurance company, employer, or local black market guru can't get their hands on them I think I'll pass.
If video games influenced behavior the Pac Man generation would be eating pills and running away from their problems.
No, it's the people with diabetes, or cancer. You steel a record that is as close as possible to your own, and you use it. God help the real patient, who has to worry about doctors looking at the thieves' medical results.
excitingthingstodo.blogspot.com
to all the important or otherwise image conscious people who have diseases and conditions they don't want made public.
My God can beat up your God. Just kidding...don't take offense. I know there's no God.
Sorry, our DNA is copyrighted and adding it to our records would be an infringement on the copyright.
This isn't being collected for individuals. That's to much work. It will be used for bulk insurance fraud. A portfolio of bogus patients to be mixed into a doctors insurance billing.
No one is uninsured now. Obamacare magically fixed that on January first, 2014. This article must be all FUD and spin.
How does this have anything to do with Obama? Or are you a bot or human acting as a proxy for a bot?
I don't think the data is private primarily to prevent fraud. My first guess was medical tourism. Overseas drug prescriptions, &c. &c.
So it's not for the name, address, date of birth, social security number etc. that can be used for any lucrative form of identity theft? That's a relief!
I'm not an expert, but I play one on slashdot.
If I am one of the 50 million Americans who are uninsured ... and I need a million-dollar heart transplant, for $250 I can get a complete medical record including insurance company details.
It would be less painful to just kill yourself than to receive an organ transplant based on someone else's medical record and then wait for rejection to set in.
Time to add DNA information to our medical records!
That is not necessary. All they need to do is ask for a government issued photo ID card, and make sure the name on the card matches the name on the insurance form. My experience is that about 100% of doctors and hospitals already do that. TFA claims that just knowing an SSN and DOB is enough, and that is not true.
I'm serious. Where did you go to school? Because I want to make sure that absolutely nobody I know goes there. Wow. If your plan was to take the daily prize for grammatical errors, missing words, lack of sense, and so on, well, congratulations as we have a winner.
You're (you might notice that I spelled that correctly) the only person I know of to ever mention individual state laws as a health care problem. A law can simply be passed making health care a federal matter to deal with that. And tuition to medical schools has always been high. This is not a recent occurrence. Outside of Los Angeles there just aren't all that many plastic surgery doctors so that's not really a problem either. However, this a shortage of general practitioners among younger doctors and that is because it doesn't pay as well as specialty medicine does, but doctors are going into all the specialist fields. There's no explosion of cosmetic doctors. And the system can only support so many specialists. Every medical school candidate simply can't go into the same specialty because there aren't enough training opportunities.
Getting a record that is close to your own would be of no benefit. If you need a heart transplant, you get the records of a patient that is worse off than you, so that you can gain a better position on the transplant waiting list.
When our name is on the back of your car, we're behind you all the way!
It's FAR more likely they use that information to bilk insurance companies directly.
Because nobody could possibly figure out how to make a fake photo ID?
Because nobody could possibly figure out how to make a fake photo ID?
That requires far more effort than just downloading an SSN and DOB, especially faking a modern ID with holograms, embossing, and maybe an embedded chip. It also increases the legal consequences if you get caught.
They were looking for ancient Western secret to short life.
This is just more evidence that the medical industry is not prepared to provide adequate protection for online medical records. I remember a televised discussion of online medical records and privacy concerns. The reporter asked the executive in charge of a major online records project about the potential security risks of online medical records. The exec replied "Well, we use a username and password for access, so it's secure" (cue face-palm). I know HIPAA compliance does a lot, but we have hospitals that are more than a decade behind the times in terms of security, they are not at all prepared to provide online access to records and patient privacy from determined hackers.
So that they know who to send the "we realize you're not getting decent healthcare but come to China and have that rectified asap" letters?
Requiem for the American Dream
whoosh!
The reference claims medical identity theft is the most common type of identity theft. but I dont beleive because there are relatively few cases in news about it compared to fake credit card and account withdrawals. It might be source of the most general identity thefts, due the looseness of medical record keeping.
"IDG News Service's Martyn Williams set out to learn why the data .. was so valuable. The answer is depressingly simple: people without health insurance can potentially get treatment by using medical data of one of the hacking victims."
And the people seeking such medical treatment wouldn't be aware that their medical history would be totally different than the real patent. And the medical establishment wouldn't be able to detect then the same people applied for medical treatment in two seperate medical facalities. This whole story is just so much cyber bullshit, an excuse to insert a free advert for some American medical insurance company.
See subject and do what it says
All they need to do is ask for a government issued photo ID card, and make sure the name on the card matches the name on the insurance form. My experience is that about 100% of doctors and hospitals already do that. TFA claims that just knowing an SSN and DOB is enough, and that is not true.
All they need to do is look up the patient's electronic medical record (if they ever get that working), and see that the height, weight, blood pressure, and contact information are all different.
I don't know how somebody could get my SSN and DOB, and figure out where I get my health insurance. If they did, I'd get their bills, and I'd know that something was wrong.
Hospitals do get patients coming into the ER with fake names, and they have systems in place for dealing with it. There were a couple of articles about that in the medical journals recently. Some guy said he thought he had leukemia, and had been treated in another hospital under another name. They called the other hospital and that story seemed to check out, although they had to make sure he really had leukemia.
If you really wanted to go to an ER with a fake name, you could get away with it, but all they'll do is stabilize you. If you need expensive ongoing treatment, you'd have to come back regularly.
It doesn't make sense. I can't imagine how somebody could use just your name, DOB and SS to get health care that they couldn't get in simpler ways.
Uhhh.. The Doctors couldn't get their work done, so we ran a cable between these two network ports and everything works fine now. What does that ASA thing do?
Cheap storage VM.
Nobody is getting a heart or kidney transplant by stealing someone else's medical identity, that's just ridiculous, impersonating someone else's medical history is not going to result in proper diagnosis or treatment.
A +2 Hell yeah! to you sir!
Best retort to Grammer/spelling Nazi I have seen yet.
It always amuses me how the pendants seem to exemplify the very things they wish to bitch about.
The worst being the ones who like to use antiquated meanings or rules that have long since fallen out of conventional usage.
The world owes you much for this post. (^;
Donald Trump, on a crusade to make Nixon look respectable
Better check your history.
NO Republican voted for the PPACA health care bill. It was passed on a holiday evening by a vote on strictly partisan lines. 34 Democrats voted against it. Practically no one had even read the 2700 page bill (I did, eventually). The day after the House passed the Senate bill, the House tried to repeal it.