Slashdot Mirror
US Healthcare Records Offered For Sale Online
An anonymous reader writes:Three U.S. healthcare organisations are reportedly being held to ransom by a hacker who stole data on hundreds of thousands of patients. The hacker has also put the 650,000 records up for sale on dark web markets where stolen data is traded. Prices for the different databases range from $100,000 to $411,000. Buyers have already been found for some of the stolen data, the hacker behind the theft told news site Motherboard. No information about the size of the ransom payment sought by the data thief has emerged, although he did say it was "a modest amount compared to the damage that will be caused to the organisations when I decide to publicly leak the victims."
The government will probably just hire him or her.
Where do I sign up?
The last time I requested my medical records from my doctor I was told that they could not provide many of them (especially the expensive MRI images), and of those they could provide they would charge a high fee for duplication. I was looking at paying somewhere between $50-100. I'm fairly certain they were doing this to prevent me from moving to another practice.
If this guy had my records I'd be happy to pay him $10 for them.
Because it's usually not easy to find them, and once you do, you notice that they sit in a country that doesn't even pick up the phone when you call them to ask for them to be handed over.
Nobody outside the "west" gives a shit about data theft.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I can recall several reasons — all of which I've encountered here on /. over the years and they've achieved acclaim and high moderations:
In Soviet Washington the swamp drains you.
Mi, you don't have to worry. Obama sold out to the HMOs and conservative and took single payer off the table first thing. That is why we have a confusing and expensive morass of shit to deal with for the ACA.
Silence is a state of mime.
Can anyone give me one reason why the authorities shouldn't find the hacker and promptly execute him?
Yeah, didn't think so...
Short answer: Jurisdiction
But can anyone give me one reason why the authorities shouldn't find the person responsible for implementing these insecure systems and promptly put them in a pillory?
PS: anybody know why my arm keeps going numb?
Yes, and keep it down - your mom is trying to sleep.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
But can anyone give me one reason why the authorities shouldn't find the person responsible for implementing these insecure systems and promptly put them in a pillory?
Because he's a rich white CIO and has plenty of money and corporate power behind him to make sure he faces no consequences?
Oh, sorry, that might have been four reasons, not one.
Now, then, who's gonna do one damn thing about the system that perpetuates such circumstances? I'll be out back listening to the crickets.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
It's telling that most of the posts advocating violence in this thread come from ACs. What's wrong boys, afraid to stand behind you rhetoric?
Linux, you magnificent bastard, I read the fucking manual!
since i have never received any healthcare (and according to my HC plan, never will), i have no health care records.
PS: anybody know why my arm keeps going numb?
If it gets bad enough just cut it off. Luckily since it's numb you won't even need to worry about anesthetic!
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
My medical records have my d.o.b, SSN, name, address, and everything needed to use my ID to get credit, file taxes, and get a host of legal docs and IDs.
Say that after someone uses your name and SSN to open a property loan under your name (and default on it, naturally).
Breakfast served all day!
You don't do that with countries that have nukes.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If this hack was made on systems which were accessible from the Internet, why the frack were they accessible from the Internet in the first place?? If an organization is too cheap, or too lazy, or too inept, or all-of-the-above, to put in place the serious security protections needed for an Internet-facing server, then said organization should never put sensitive data on any of their Internet-facing servers. Even if the organization is on top of things security-wise, if there is no really REALLY good reason for said data to be on an Internet-facing server, do NOT put it on one. Network Security for Dummies.
Ask the content industry how well that worked out.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
You can always do it the old fashioned way.
A Pirate and a Puritan look the same on a balance sheet.
You forgot the best reason:
The "hacker" was an agent used to "leak" the documents, sell them to the pharma companies, and provide plausible deniability when people start complaining about all the junk mail they're getting.
“He’s not deformed, he’s just drunk!”
Under the GOP system there was already a risk pool of last resort.
Much less intrusive than trying to re-engineer the entire industry and less of a constitutional issue than forcing a consumer product on people.
A Pirate and a Puritan look the same on a balance sheet.
It's not about the insurers, it's about many of us not wanting to be forced into a system bigger and more corrupt than the VA. If you get screwed over by single payer, you have zero recourse. So then what, we have to have private insurance along with our single payer? I'd rather just have the private insurance and be done with it.
You're an idiot. We won't get the NHS. We will get more of what we already have in terms of Medicaid and Medicare. You lot are simply too cheap.
The NHS would collapse based on what Americans of both parties are willing to spend on public healthcare.
A Pirate and a Puritan look the same on a balance sheet.
Hey, if it leads to single payer, let's grease that slope and tilt it up to 90 degrees. The records are being made public anyway. We may as well get some service for it.
“He’s not deformed, he’s just drunk!”
Send them a strongly worded letter about how angry you are with them!
Since HIPAA allows virtually everyone other than yourself to access your medical records, you might want to go to this site and buy access to your own records while the opportunity exists.
Yeah, you can pretty much bet that outside of someone completely incompetent setting up their network security (which is always a possibility), it came down to "Secure implementation costs $X. Less secure implementation costs $LESS_THAN_X." and some exec or bean-counter said "Go with $LESS_THAN_X".
Mr. Hu is not a ninja.
Can anyone give me one reason why the authorities shouldn't find the hacker and promptly execute him?
Yeah, didn't think so...
Our FBI can do that only if it can be shown that the hacker annoyed Hollywood in some way. To protect yourself in the future, see your doctor and ask if there isn't some way you can work a copyrighted song lyric into your medical file.
There is a saying that only way to truly secure your server is to disconnect it from the network. However HIPAA requires EMR, so that's not an option.
So I have to ask, why are you calling for the victim to be executed and replaced with somebody who is known for less than ethical behavior?
This is similar to how Islamic countries give lashings to raped women for adultery and then let the rapist go scott free because it wasn't his fault that the woman's looks were tempting.
Under socialistic systems, everyone gets the same crappy care. See VA hospitals for example.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
I think he meant kidnapping (see also the practice of 'extraditing' former Third Reich fugitives to Israel in the 1950's, 1960's, 1970's... not so much these days, mostly due to attrition).
Could be a new and improved use of Guantanamo Bay, truth be told.
Quo usque tandem abutere, Nimbus, patientia nostra?
However HIPAA requires EMR, so that's not an option.
Curious as to why that can't be on its own network (or at least a network of VPNs...)
Quo usque tandem abutere, Nimbus, patientia nostra?
Woooosh...
In Soviet Washington the swamp drains you.
Identification (Numbers etc) isn't secret. That's what makes them useful. It is also way too easy to prove you're someone you're not, simply by providing enough (one??) piece of identifying information. Two Factor Authentication should be more or less standard operations now. But it is inconvenient.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Because you inevitably have to be able to transfer those records to another health care provider (and/or the patient himself) when the patient either requests it or authorizes it, as per the law. Sure, you can keep it within a secure network, but there is basically no such thing as perfect security.
Remember, the employees are typically the weakest link. No CIO in the world (or anybody else for that matter) can 100% guarantee the security of any system that has more than one authorized user, no matter the circumstances.
Or look at the countries with better healthcare outcomes than the US, for much less money. I'll wait for you to complain about how large the US is, and I'll point out that healthcare scales very well - more people to serve = more taxpayers = money to pay for their care. Then I guess I'll wait for some nebulous argument about "diverse cultures" and how the countries which pay less for comparable or better care don't have such "problems" or some other nonsense, and point out that that argument has no bearing on anything what-so-ever, it is just a convenient excuse used by people to forgive broken systems without having to admit failings of anyone.
You are flogging a dead horse. No, wait, you are the dead horse.
FYI, they also measure outcomes differently in different countries, so that even if the statistics are correct, they are measuring entirely different datasets.
For instance, it is often touted that infant mortality rates are lower in certain countries. While that Statistic is accurate as a statement, the two countries are measuring it differently. In the US, Premature births of all types and kinds are included, where they are not in other countries. And if you include premature birth rates, the Actual statistics flip.
If people die of cancer waiting for treatment, and they aren't counted as "cancer patients" because they never were.
Statistics are meaningless unless they are being used the exact same way across the board, and they are not.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Got a citation for that? Because I have one that shows you are spouting more libertarian BS:
The real "Libtards" are the Libertarians!