Slashdot Mirror
Six Missing HDDs Contain Health Information of Nearly a Million Patients (corporate-ir.net)
Lucas123 writes: Health insurer Centene Corp. revealed that it is looking for six HDDs with information on 950,000 customers that went missing during a data project that was using laboratory results to improve the health outcomes of patients. The drives not only contain sensitive personal identification information, such as addresses, dates of birth and social security numbers, but they also contain health information. "While we don't believe this information has been used inappropriately," said Michael Neidorff, CEO of Centene.
"While I usually praise the high standard of editing," said readers of Slashdot everywhere.
Backup, encryption
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
Have you checked Hillary's server?
I just think it's hilarious you can take away everything that makes a free market insurance plan really insurance and expect Americans not to notice. I disagree a lot with what Bernie believes in, but he's the only Democratic candidate that actually says stuff that doesn't sound like complete lunacy when it comes to healthcare. Obama Care is a means to an end which is a single payer system. I'm not saying I agree with that, but the Obama Care system will collapse into a single payer or back into a free market insurance system. Although the middle ground may have been easier to pass than single payer, it's simply doesn't work. It was useful at setting up bureaucracies though.
With that said the government has a terrible history with protecting our information. I wouldn't hold then up as a shining beacon of light if I were you.
If you compile information into huge databases, this is what you can expect. Personally, I want all my medical records on paper charts stored in my doctor's office. Unless you agree to have your information published on the internet, don't accept electronic records. I assume that in this specific case the ssd's were lost. Even if they end up on eBay, the new owners will most likely clear the old data.
That policy choice would kill a lot of people because it would prevent data mining to learn how to generate better health outcomes.
Trade offs.
Researchers don't need SSN for patient. Just assign each patient a number and refer to them that way.
The CS professional should have sanitized the data before releasing it.
Researchers don't need SSN for patient. Just assign each patient a number and refer to them that way.
The CS professional should have sanitized the data before releasing it.
In this case, the intent was to use the lab results to ensure improved patient outcomes. This means that the data had to be trackable back to the patients that provided it, and then the lab results were to be fed back into the treatment of said patients.
So this was technically not "human trials research", it was a bioinformatics business process to manage outcomes. As such, it's HIPAA protected, certainly -- but also, 100% personally identifiable.
For the people I know who have bought private insurance, or participated in one of the exchanges, but not yet provided their social security number, there tends to be a lot of letters sent (on the order of one a month) from the insurer, asking for the social, nominally to inform the IRS of your insurance, with the implied threat that if you don't provide the social, the IRS is going to eat your babies.
In other words: health care providers really, really like your social. Typically, according to people in the billing industry whom I also happen to know, it so that when they screw up on their billing -- which they inevitably do -- they can send the bills to a collections agency easier, in order to damage your credit over their screwup, until you pay them for their inability to code a procedure "correctly" so the health insurance accepts the coding.
So they had the socials, probably for not very good reasons, and they used them as an identifier for notionally very good reasons of unique correlation, and then they lost the data because they were idiots who don't routinely protect HIPAA data to the level required to allow them use of it in the first place.
There are practically no real-world consequences for HIPAA violations like this.
Everybody will be fine. Except the patients. And who the fuck cares about those jerk-offs anyway?
You know that this would not have been a problem, had they had to store all the data on 5 1/4" floppy disks, right? The backup alarm on the semi truck would have been a dead giveaway...
I think shipping any sensitive data unencrypted should be a punishable offence even when the data is not stolen. Similar to driving around without your seatbelt. Its irresponsible behaviour that is easily prevented and comes from being lazy
If an experiment works, something has gone wrong.
..or did they. https://www.youtube.com/watch?...
If they are encrypted no worries. If they are not encrypted the board should each be given jail time 5 year minimum
Some IT guy took the drives home, wiped them, and is now using them in his home file server, or just straight-up sold them on Ebay. This happens all the time, I've seen it happen at every company I've worked for over the past 20 years. TFA has little actual information (and neither does the Reuters write up)...were they shipped some place? Were these in a server, laptops, desktops?
And yet on the IRS tax forms it's just a single question "Have you had health insurance", last year at least they didn't request any information to collaborate it...no policy numbers, corp, etc.
on 950,000 customers that went missing
-- Make America hate again!
They're professionals. The drives will be encrypted, right? Right?
I want a list of atrocities done in your name - Recoil
A good friend of mine does ITSEC at a major research hospital in Portland; they are actually quite intense on it all. They won't even deploy anything that uses lower than TLS 1.2, CISSP certification is required, etc.
Have they never heard of HIPPA? I worked for about 14 months doing exome sequencing for the Million Man thing at the VA - or at a contractor to the VA. All the external drives were encrypted with 16 digit pins. And after so many tries they'd lock up completely. So no brute forcing. The drives were made by Apricorn and carried FIPS 140.2 certifcations.
And yet on the IRS tax forms it's just a single question "Have you had health insurance", last year at least they didn't request any information to collaborate it...no policy numbers, corp, etc.
I didn't say they were telling the truth, and I (I hope) implied the opposite: They just want you to voluntarily disclose your social. I'm well aware that it's a check box.
One of the for-profit health insurance companies who just raked in a huge windfall as a result of the largest government-to-corporate handout in the history of government were too drunk on their power to bother with data security.
Yep, absolutely nobody is surprised by this in the least. Turns out hookers and blow don't manage this stuff very well on their own.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Why is a person's SSN and date of birth 'sensitive information.'
Now, I know that the Credit Industry wants to be able to use this information to obligate us to assume responsibility for any debt they might choose to inflict on us.
But how is it in our benefit for this to be Secret Information? The Social Security Administration was not intended to issue 'secret numbers' to people.
The Government should publish all SSNs and in effect disallow the Credit Agencies from using this information against us. It wouldn't even take the government to shut down this system. If 10% of the population decided that enough was enough and disclosed their SSNs with a statement 'this is not enough information to authorize credit disbursement' it would take down the system.
Comment removed based on user account deletion
Health insurer Centene Corp should be sued out of existence.
Researchers don't need SSN for patient. Just assign each patient a number and refer to them that way.
A better solution would be to get rid of the idiotic notion that SSNs can be both widely known and secret. Their use for authentication (rather than identification) should be banned. They should be considered public information.
Naaah, paper tape is more secure.
Beware of Sleestak
I got it! I was also pointing out that the actual IRS doesn't collect that info either, so their multiple request letters are completely bogus. They just want the info to sell it off to advertisers since it's worth more $$ with the SSN. Your comment makes me actually want to purposely not put my SSN on my insurance if I'm forced to use the exchange, just to tell them off when they try to "trick" me into giving it to them lol.
They view it as a large "click" in the ever-leftward ratchet.
"Reducing costs" involves treating the current medical treatments as a static tree to be plucked, hunter-gatherer style, rather than being a transient state in ever-increasing number of treatments and cures which, by definition, costs more.
Unlike a car or TV, medicine is a suite of different things, and you want corporations adding options hand-over-fist. There is simply more to buy year after year, and it naturally costs more.
How much more are new treatments desired than an iPhone? This driv3s investment. You will no more have new medicine at current rates (which is what saves lives) than you would have an iPhone under a single payer phone system.
A single-payer medical system is about as sensible as a single-payer consumer electronics system. Anyone wanna bet the rate of invention will keep up?
Not me, man. I want new stuff, electronics and medicine.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
America's healthcare costs are the highest because it's literally the only place that any money is available for R&D. All those countries that have single-payer? We're subsidizing them. And people say Americans don't support communism, we do it every time we go to the doctor or buy medicine. Only we're subsidizing the R&D that the entire world benefits from. Shove your single-payer up your red commie ass.
The HIPAA and HITECH Acts' Security Rule require hard drives containing personal health information (PHI) to be encrypted at rest.
Why weren't they?
Losing an encrypted drive is not a reportable incident. Losing one with 950,000 records in cleartext results in you getting your name up on the Wall of Shame at HHS' Office of Civil Rights (OCR) along with penalties of $100 to $50,000 _per_record_ up to a maximum of $1.5 million.
In this case, since Centene Corp. is guilty of "Willful Neglect", the penalty should be somewhere between $10,000 to $50,000 per record which puts them at the maximum penalty.
The difference between a company losing your information and the government losing it is very simple. You can sue the company and the government will enforce the ruling should you win. If you attempt to sue the government not only can it decline to accept the suit in the first place but it can also choose how or even if it will enforce the ruling should you win.
Get Echo on the job, she'll find them in no time. Unless Alpha took them, then you're all screwed.
Just a note, DBAN doesn't work on SSD's. But a hammer will make short work of them...
Select from tblFriends where interesting >= 4;
A single-payer medical system can be just as advanced as a private medical system. We see this every single day with new procedures being developed, tested, and made available to the general public in the many countries with single-payer systems. Quite a few of those systems have better outcomes than the US system for a whole range of diseases.
You've been lied to, and now you are arguing against your own future. Good jerrrrb!
You really believe that? Take a look at the medical research coming out of those countries before you proudly tell everyone just how little you know.
"While we don't believe this information has been used inappropriately," said Michael Neidorff, CEO of Centene.
That is the absolute lamest "don't worry" defense I've heard in a decade, hands-down.
So, what, you know an employee took it and wants hush money? No? Then how can you even claim data safety? OMFG.