Slashdot Mirror
Hacking the US Prescription System
An anonymous reader writes: It appears that most pharmacies in the US are interconnected, and a breach in one leads to access to the other ones. A security advisory released [Friday] shows how a vulnerability in an online pharmacy granted access to prescription history for any US person with just their name and date of birth.
From the description linked above: During the signup process, PillPack.com prompts users for their
identifying information. In the end of the signup rocess, the user is
shown a list of their existing prescriptions in all other pharmacies
in order to make the process of transferring them to PillPack.com easier.
... To replicate this issue, an attacker would be directed to the
PillPack.com website and choose the signup option. As long as the full
name and the date of birth entered during signup match the target, the
attacker will gain access to the target's full prescription history.
From TFA, regarding a persons prescription history, it says
It is assumed that this information comes from the various backend systems that interlink the pharmacies as described above.
I doubt it. I think it is far more likely that the pharmacy sells this information to insurance, pharmaceutical, and marketing companies. Big data is big business these days. So long patient confidentiality.
That being said, it is unconscionable how lax PillPack.com security procedures were.
This is just plain irresponsible behaviour by PillPack, nothing to do with hacking.
No, this is just plain irresponsible behavior by those who share infomation to PillPack and others.
Recently, I noticed that when I picked up a prescription for a (for me new) medication that's mostly used for one purpose, I suddenly got dozens of spam e-mails wanting to "help" me with a particular diagnosis I don't have. And that's the few that went through the double layer spam filter. It was way too pervasive to be a coincidence.
It's clear that the US prescription system leaks like a sieve, and that even spammers have access to people's prescription history.
Can we go back to paper prescriptions that don't enter a database, please?
They know about my meds because I pretty much have to tell someone to get the prescription filled.
They know my email address since the same people I go to to get the prescription filled have my email address so they can send me reminders that my refills are due.
So, the pharmacy has my prescription history going way back (what, you think I change pharmacies every time I get a new prescription) and my email address. And I still have never gotten any spam advertising drugs.
Note that drug advertising to me wouldn't actually do any good, since I'm not an MD, and am incapable of prescribing drugs to myself (or anyone else). That sort of thing is best aimed at doctors and hypochondriacs (the kind who will nag their doctors about the new drugs they see on TV that sound like they'd be PERFECT for their problems)....
"I do not agree with what you say, but I will defend to the death your right to say it"
would seem that this would be a violation of HIPPA security rules, assume pharmacies are covered entities, which I think they are. Specifically, covered entities must maintain adequate:
Administrative Safeguards
Security Management Process. As explained in the previous section, a covered entity must identify and analyze potential risks to e-PHI, and it must implement security measures that reduce risks and vulnerabilities to a reasonable and appropriate level.
Technical Safeguards
Access Control. A covered entity must implement technical policies and procedures that allow only authorized persons to access electronic protected health information (e-PHI).
It would seem simply allowing access via a name and birthdate is a violation of the above requirements.
Source: http://www.hhs.gov/ocr/privacy...
I'm a consultant - I convert gibberish into cash-flow.