Slashdot Mirror
Hacking the US Prescription System
An anonymous reader writes: It appears that most pharmacies in the US are interconnected, and a breach in one leads to access to the other ones. A security advisory released [Friday] shows how a vulnerability in an online pharmacy granted access to prescription history for any US person with just their name and date of birth.
From the description linked above: During the signup process, PillPack.com prompts users for their
identifying information. In the end of the signup rocess, the user is
shown a list of their existing prescriptions in all other pharmacies
in order to make the process of transferring them to PillPack.com easier.
... To replicate this issue, an attacker would be directed to the
PillPack.com website and choose the signup option. As long as the full
name and the date of birth entered during signup match the target, the
attacker will gain access to the target's full prescription history.
Sharing Is Caring!
So you enter someone's name and date of birth on this website, and it gives you all the details? How exactly is this a hack? If I asked the president of the US for the nuclear launch codes, just for laughs, and to my great surprise he would simply give them to me, would I have "hacked" the US nuclear missile system? Would I be thrown in jail for hacking?
This is just plain irresponsible behaviour by PillPack, nothing to do with hacking.
From TFA, regarding a persons prescription history, it says
It is assumed that this information comes from the various backend systems that interlink the pharmacies as described above.
I doubt it. I think it is far more likely that the pharmacy sells this information to insurance, pharmaceutical, and marketing companies. Big data is big business these days. So long patient confidentiality.
That being said, it is unconscionable how lax PillPack.com security procedures were.
Jolly good.. Now the name + the birthday is the secret needed to unlock any identity fraud? Not even including social security (which wasn't secret either)?
It's like the whole damn, dumb U.S and its networks are just configured as one big honey-pot, to make it easier to point and cry wolf.
just tried signing up, can`t even see my own info let alone someone else`s.
Pharmacies need to know what scripts you have open so they don't kill you. When you pick up a new prescription they will check with your insurance company what other prescriptions you may already have to ensure there are no adverse interactions between the new drug and what you're already taking. This doesn't excuse what was clearly poor design to have allowed this information to be so easily available, but this may not have been due to some conspiracy of greed.
I always thought we'd hear about the prescription system hacked for drugs, not for personal information.
There's a ton of pharmacies out there, how do "they" know where to send shipments? How do "they" verify that a shipment is going to an actual pharmacy and not a shell entity, especially if its CVS store #1887?
What about actual prescriptions? Many are electronically transmitted to the pharmacy. The schedule II ones (at least when I've been given oxycodone) are printed on paper, but how is that data correlated with the prescribing doctor as legitimate?
Is every order printed out on paper and cross checked by somebody?
Just keep your name and birthday secret.
would seem that this would be a violation of HIPPA security rules, assume pharmacies are covered entities, which I think they are. Specifically, covered entities must maintain adequate:
Administrative Safeguards
Security Management Process. As explained in the previous section, a covered entity must identify and analyze potential risks to e-PHI, and it must implement security measures that reduce risks and vulnerabilities to a reasonable and appropriate level.
Technical Safeguards
Access Control. A covered entity must implement technical policies and procedures that allow only authorized persons to access electronic protected health information (e-PHI).
It would seem simply allowing access via a name and birthdate is a violation of the above requirements.
Source: http://www.hhs.gov/ocr/privacy...
I'm a consultant - I convert gibberish into cash-flow.
When you try to get a prescription filled in a pharmacy they take your ID and insurance card and send that off to your insurance company. If you have a prescription for something simple and cheap like penicillin that cost say $3 the conversation looks something like this:
Pharmacy (to insurance co): Joe Sucker gave me a $25 co pay card for penicillin.
InsCo: Tell him that it is $30 and you now owe us $22.
Pharmacy to Joe: You owe us $25.
If Joe had asked cash price, the conversation would have been:
Pharmacy (to Joe): That will be $3.
Joe: But I have a $25 co pay
Pharmacy: Do you want to pay $3 or $25?
If the US healthcare system were to embrace capitalism, it would be a big improvement over the fourteenth-century guild feudalism we have now.
Sorry. All the momentum is in the opposite direction.
But you're definitely right.
They don't even require the last four of the SSN.
See e.g.
http://rights.com/2015/04/16/p...
Dear /. editors, I think you mean "process" instead of "rocess" ... thanks for your attention!
You should report your local podunk scammer pharmacy to your state attorney general's office.
Maybe they changed the website after this breach was reported. But now it requires a lot more information than just name and birthdate. Without the last four of the SSN, it will not advance.