Slashdot Mirror
Hacking the US Prescription System
An anonymous reader writes: It appears that most pharmacies in the US are interconnected, and a breach in one leads to access to the other ones. A security advisory released [Friday] shows how a vulnerability in an online pharmacy granted access to prescription history for any US person with just their name and date of birth.
From the description linked above: During the signup process, PillPack.com prompts users for their
identifying information. In the end of the signup rocess, the user is
shown a list of their existing prescriptions in all other pharmacies
in order to make the process of transferring them to PillPack.com easier.
... To replicate this issue, an attacker would be directed to the
PillPack.com website and choose the signup option. As long as the full
name and the date of birth entered during signup match the target, the
attacker will gain access to the target's full prescription history.
So you enter someone's name and date of birth on this website, and it gives you all the details? How exactly is this a hack? If I asked the president of the US for the nuclear launch codes, just for laughs, and to my great surprise he would simply give them to me, would I have "hacked" the US nuclear missile system? Would I be thrown in jail for hacking?
This is just plain irresponsible behaviour by PillPack, nothing to do with hacking.
From TFA, regarding a persons prescription history, it says
It is assumed that this information comes from the various backend systems that interlink the pharmacies as described above.
I doubt it. I think it is far more likely that the pharmacy sells this information to insurance, pharmaceutical, and marketing companies. Big data is big business these days. So long patient confidentiality.
That being said, it is unconscionable how lax PillPack.com security procedures were.
Jolly good.. Now the name + the birthday is the secret needed to unlock any identity fraud? Not even including social security (which wasn't secret either)?
I always thought we'd hear about the prescription system hacked for drugs, not for personal information.
There's a ton of pharmacies out there, how do "they" know where to send shipments? How do "they" verify that a shipment is going to an actual pharmacy and not a shell entity, especially if its CVS store #1887?
What about actual prescriptions? Many are electronically transmitted to the pharmacy. The schedule II ones (at least when I've been given oxycodone) are printed on paper, but how is that data correlated with the prescribing doctor as legitimate?
Is every order printed out on paper and cross checked by somebody?
would seem that this would be a violation of HIPPA security rules, assume pharmacies are covered entities, which I think they are. Specifically, covered entities must maintain adequate:
Administrative Safeguards
Security Management Process. As explained in the previous section, a covered entity must identify and analyze potential risks to e-PHI, and it must implement security measures that reduce risks and vulnerabilities to a reasonable and appropriate level.
Technical Safeguards
Access Control. A covered entity must implement technical policies and procedures that allow only authorized persons to access electronic protected health information (e-PHI).
It would seem simply allowing access via a name and birthdate is a violation of the above requirements.
Source: http://www.hhs.gov/ocr/privacy...
I'm a consultant - I convert gibberish into cash-flow.
When you try to get a prescription filled in a pharmacy they take your ID and insurance card and send that off to your insurance company. If you have a prescription for something simple and cheap like penicillin that cost say $3 the conversation looks something like this:
Pharmacy (to insurance co): Joe Sucker gave me a $25 co pay card for penicillin.
InsCo: Tell him that it is $30 and you now owe us $22.
Pharmacy to Joe: You owe us $25.
If Joe had asked cash price, the conversation would have been:
Pharmacy (to Joe): That will be $3.
Joe: But I have a $25 co pay
Pharmacy: Do you want to pay $3 or $25?
If the US healthcare system were to embrace capitalism, it would be a big improvement over the fourteenth-century guild feudalism we have now.