Slashdot Mirror
Hacking the US Prescription System
An anonymous reader writes: It appears that most pharmacies in the US are interconnected, and a breach in one leads to access to the other ones. A security advisory released [Friday] shows how a vulnerability in an online pharmacy granted access to prescription history for any US person with just their name and date of birth.
From the description linked above: During the signup process, PillPack.com prompts users for their
identifying information. In the end of the signup rocess, the user is
shown a list of their existing prescriptions in all other pharmacies
in order to make the process of transferring them to PillPack.com easier.
... To replicate this issue, an attacker would be directed to the
PillPack.com website and choose the signup option. As long as the full
name and the date of birth entered during signup match the target, the
attacker will gain access to the target's full prescription history.
From TFA, regarding a persons prescription history, it says
It is assumed that this information comes from the various backend systems that interlink the pharmacies as described above.
I doubt it. I think it is far more likely that the pharmacy sells this information to insurance, pharmaceutical, and marketing companies. Big data is big business these days. So long patient confidentiality.
That being said, it is unconscionable how lax PillPack.com security procedures were.
This is just plain irresponsible behaviour by PillPack, nothing to do with hacking.
No, this is just plain irresponsible behavior by those who share infomation to PillPack and others.
Recently, I noticed that when I picked up a prescription for a (for me new) medication that's mostly used for one purpose, I suddenly got dozens of spam e-mails wanting to "help" me with a particular diagnosis I don't have. And that's the few that went through the double layer spam filter. It was way too pervasive to be a coincidence.
It's clear that the US prescription system leaks like a sieve, and that even spammers have access to people's prescription history.
Can we go back to paper prescriptions that don't enter a database, please?
Dude, I get spam for Viagra every day.
I've been taking moderately special purpose meds off and on for years (the sorts of things you take when you have a bone marrow transplant).
I have NEVER gotten any spam emails as a result (unless you count that "you really need to refill your prescription since you're about to run out of pills, you dolt!" sort that I get as a reminder from the drugstore)....
"I do not agree with what you say, but I will defend to the death your right to say it"
They know about my meds because I pretty much have to tell someone to get the prescription filled.
They know my email address since the same people I go to to get the prescription filled have my email address so they can send me reminders that my refills are due.
So, the pharmacy has my prescription history going way back (what, you think I change pharmacies every time I get a new prescription) and my email address. And I still have never gotten any spam advertising drugs.
Note that drug advertising to me wouldn't actually do any good, since I'm not an MD, and am incapable of prescribing drugs to myself (or anyone else). That sort of thing is best aimed at doctors and hypochondriacs (the kind who will nag their doctors about the new drugs they see on TV that sound like they'd be PERFECT for their problems)....
"I do not agree with what you say, but I will defend to the death your right to say it"
For that matter can we please go back to paper medical records too? How long will it be before all our medical histories become public knowledge?
While in theory, EMR's can do a lot of good by providing any doctor instant critical info but in the current big-data low security environment, no.
would seem that this would be a violation of HIPPA security rules, assume pharmacies are covered entities, which I think they are. Specifically, covered entities must maintain adequate:
Administrative Safeguards
Security Management Process. As explained in the previous section, a covered entity must identify and analyze potential risks to e-PHI, and it must implement security measures that reduce risks and vulnerabilities to a reasonable and appropriate level.
Technical Safeguards
Access Control. A covered entity must implement technical policies and procedures that allow only authorized persons to access electronic protected health information (e-PHI).
It would seem simply allowing access via a name and birthdate is a violation of the above requirements.
Source: http://www.hhs.gov/ocr/privacy...
I'm a consultant - I convert gibberish into cash-flow.
When you try to get a prescription filled in a pharmacy they take your ID and insurance card and send that off to your insurance company. If you have a prescription for something simple and cheap like penicillin that cost say $3 the conversation looks something like this:
Pharmacy (to insurance co): Joe Sucker gave me a $25 co pay card for penicillin.
InsCo: Tell him that it is $30 and you now owe us $22.
Pharmacy to Joe: You owe us $25.
If Joe had asked cash price, the conversation would have been:
Pharmacy (to Joe): That will be $3.
Joe: But I have a $25 co pay
Pharmacy: Do you want to pay $3 or $25?
Your pharmacist has sold your prescription data to some shady third party for advertising purposes. Somehow they managed to loophole that out of HIPAA - it's a 'service' for your own good - or something along those hallucinatory lines.
Supposedly you can opt out but you first have to know if you got opted in.
I'm actually surprised that this hasn't generated much flack, but there are so many things to get angsted at I think that most people are just overwhelmed. Personally, I ran out of extra angst a long time ago.
Faster! Faster! Faster would be better!