Calling Dr. Moe, Dr. Larry and Dr. Curly: Advocate Medical Breach of Four Million Patient Records, and No Encryption

At my Oct. 2011 post "<b>Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure</b>" (<a href="http://hcrenewal.blogspot.com/2011/10/still-more-ehr-chaos-pandemonium-bedlam.html">http://hcrenewal.blogspot.com/2011/10/still-more-ehr-chaos-pandemonium-bedlam.html</a>) I thought I'd seen the worst.<br /><br />Yet another post to add to the category of medical record privacy/confidentiality/security (<a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy">http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy),</a> however:<br /><br /><blockquote class="tr_bq"><a href="http://www.healthcareinfosecurity.com/advocate-medical-breach-no-encryption-a-6021">Advocate Medical Breach: No Encryption?</a><br />Computer Theft Raises Questions About Unencrypted Devices<br />By Marianne Kolbasuk McGee, August 27, 2013.<span class="date"></span><br /><br />The recent theft of <b>four unencrypted desktop computers </b>from a Chicago area physician group practice may result in the second biggest healthcare <a href="http://www.healthcareinfosecurity.com/breach-response-c-324"><b>breach</b></a> ever reported to federal regulators. But the bigger issue is: Why do breaches involving unencrypted computer devices still occur?<br /><br />According to the Department of Health and Human Services' "wall of shame" website listing 646 breaches impacting 500 or more individuals since September 2009, more than half of the incidents involved lost or stolen unencrypted devices. Incidents involving data secured by encryption do not have to be reported to HHS.<br /><br />... The <b>four unencrypted but password-protected computers <span style="color: red;"><i>[passwords on PC's are bypassable by smart teenagers - ed.]</i></span> stolen during a burglary in July from an office of <a href="http://www.healthcareinfosecurity.com/breach-may-affect-4-million-patients-a-6018">Advocate Medical Group</a> in Illinois may have exposed information of about 4 million patients,</b> according to an Advocate spokesman. </blockquote><br />4 million is about 1.3 percent of the entire U.S. population (about <a href="https://www.google.com/search?q=us%20population">313.9 million</a> in 2012) ... on just four desktop computers.<br /><br />Try that with paper ...<br /><br />As to the subtitle of the article, "<b>Computer Theft Raises Questions About Unencrypted Devices</b>", I've written on that issue before.  I'd noted questions like that are remarkable considering both MacOS and Windows have built-in, readily available encryption, the latter for a few extra $ for the "deluxe version" (see <span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[0]"> </span><a class="" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[1]" href="http://en.wikipedia.org/wiki/FileVault" rel="nofollow" target="_blank">http://en.wikipedia.org/wiki/FileVault</a><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[2]"> and </span><a class="" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[3]" href="http://en.wikipedia.org/wiki/Bitlocker" rel="nofollow" target="_blank">http://en.wikipedia.org/wiki/Bitlocker</a><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]">).  </span></span></span><br /><br /><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]">Perhaps the best explanation in 2013 for unencrypted desktop PC's containing millions of confidential medical records is this picture, symbolic of the apparent attitudes of corporate and IT management on health IT security:</span></span></span><br /><br /><br /><table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnAsw6PW67gX6YJJIVtd1hEp5nCpuf5Re_XG0rDd2AJELzlw8B5pV9bvBxHPXa6DhmesPxvPoc8c_n3Y3u2s3Ki1GxEUgZ_jzbex53lu7i4-pc6eS4SKXr6axDPCCVSmKPpHg_UAPThsnN/s1600/stooges+police300px.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnAsw6PW67gX6YJJIVtd1hEp5nCpuf5Re_XG0rDd2AJELzlw8B5pV9bvBxHPXa6DhmesPxvPoc8c_n3Y3u2s3Ki1GxEUgZ_jzbex53lu7i4-pc6eS4SKXr6axDPCCVSmKPpHg_UAPThsnN/s1600/stooges+police300px.jpg" /></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]">Encryption?  We don't need no encryption.  We got triple protection already!</span></span></span></td></tr></tbody></table><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]"><br /></span></span></span><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]"><br /></span></span></span><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]">-- SS</span></span></span><br /><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]"><br /></span></span></span>

Calling Dr. Moe, Dr. Larry and Dr. Curly: Advocate Medical Breach of Four Million Patient Records, and No Encryption

At my Oct. 2011 post "Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure" (http://hcrenewal.blogspot.com/2011/10/still-more-ehr-…

Đọc thêm »

Union Charges Advocate Health Care Skimps on Capital Improvements in Minority Areas

In Chicago, <a href="http://www.suntimes.com/output/news/cst-nws-redline12.html">the Sun-Times reported</a> that the Service Employees Internation Union charged that Advocate Health Care, a not-for-profit hospital system, spends more on capital improvements on hospitals in predominantly white areas than it does on hospitals in areas with larger minority populations. The Union asserted that Advocate is not fulfilling its social mission, and thus questioned whether Advocate should keep its not-for-profit status. The state legislature may investigate. Advocate responded by saying its per-patient spending is higher in areas with larger minority populations.<br />Yet another case raising questions about whether a not-for-profit health care system is true to its mission....

Union Charges Advocate Health Care Skimps on Capital Improvements in Minority Areas

In Chicago, the Sun-Times reported that the Service Employees Internation Union charged that Advocate Health Care, a not-for-profit hospital system, spends more on capital improvements on hospitals in…

Đọc thêm »