Calling Dr. Moe, Dr. Larry and Dr. Curly: Advocate Medical Breach of Four Million Patient Records, and No Encryption

At my Oct. 2011 post "<b>Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure</b>" (<a href="http://hcrenewal.blogspot.com/2011/10/still-more-ehr-chaos-pandemonium-bedlam.html">http://hcrenewal.blogspot.com/2011/10/still-more-ehr-chaos-pandemonium-bedlam.html</a>) I thought I'd seen the worst.<br /><br />Yet another post to add to the category of medical record privacy/confidentiality/security (<a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy">http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy),</a> however:<br /><br /><blockquote class="tr_bq"><a href="http://www.healthcareinfosecurity.com/advocate-medical-breach-no-encryption-a-6021">Advocate Medical Breach: No Encryption?</a><br />Computer Theft Raises Questions About Unencrypted Devices<br />By Marianne Kolbasuk McGee, August 27, 2013.<span class="date"></span><br /><br />The recent theft of <b>four unencrypted desktop computers </b>from a Chicago area physician group practice may result in the second biggest healthcare <a href="http://www.healthcareinfosecurity.com/breach-response-c-324"><b>breach</b></a> ever reported to federal regulators. But the bigger issue is: Why do breaches involving unencrypted computer devices still occur?<br /><br />According to the Department of Health and Human Services' "wall of shame" website listing 646 breaches impacting 500 or more individuals since September 2009, more than half of the incidents involved lost or stolen unencrypted devices. Incidents involving data secured by encryption do not have to be reported to HHS.<br /><br />... The <b>four unencrypted but password-protected computers <span style="color: red;"><i>[passwords on PC's are bypassable by smart teenagers - ed.]</i></span> stolen during a burglary in July from an office of <a href="http://www.healthcareinfosecurity.com/breach-may-affect-4-million-patients-a-6018">Advocate Medical Group</a> in Illinois may have exposed information of about 4 million patients,</b> according to an Advocate spokesman. </blockquote><br />4 million is about 1.3 percent of the entire U.S. population (about <a href="https://www.google.com/search?q=us%20population">313.9 million</a> in 2012) ... on just four desktop computers.<br /><br />Try that with paper ...<br /><br />As to the subtitle of the article, "<b>Computer Theft Raises Questions About Unencrypted Devices</b>", I've written on that issue before.  I'd noted questions like that are remarkable considering both MacOS and Windows have built-in, readily available encryption, the latter for a few extra $ for the "deluxe version" (see <span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[0]"> </span><a class="" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[1]" href="http://en.wikipedia.org/wiki/FileVault" rel="nofollow" target="_blank">http://en.wikipedia.org/wiki/FileVault</a><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[2]"> and </span><a class="" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[3]" href="http://en.wikipedia.org/wiki/Bitlocker" rel="nofollow" target="_blank">http://en.wikipedia.org/wiki/Bitlocker</a><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]">).  </span></span></span><br /><br /><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]">Perhaps the best explanation in 2013 for unencrypted desktop PC's containing millions of confidential medical records is this picture, symbolic of the apparent attitudes of corporate and IT management on health IT security:</span></span></span><br /><br /><br /><table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnAsw6PW67gX6YJJIVtd1hEp5nCpuf5Re_XG0rDd2AJELzlw8B5pV9bvBxHPXa6DhmesPxvPoc8c_n3Y3u2s3Ki1GxEUgZ_jzbex53lu7i4-pc6eS4SKXr6axDPCCVSmKPpHg_UAPThsnN/s1600/stooges+police300px.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnAsw6PW67gX6YJJIVtd1hEp5nCpuf5Re_XG0rDd2AJELzlw8B5pV9bvBxHPXa6DhmesPxvPoc8c_n3Y3u2s3Ki1GxEUgZ_jzbex53lu7i4-pc6eS4SKXr6axDPCCVSmKPpHg_UAPThsnN/s1600/stooges+police300px.jpg" /></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]">Encryption?  We don't need no encryption.  We got triple protection already!</span></span></span></td></tr></tbody></table><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]"><br /></span></span></span><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]"><br /></span></span></span><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]">-- SS</span></span></span><br /><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]"><br /></span></span></span>

Calling Dr. Moe, Dr. Larry and Dr. Curly: Advocate Medical Breach of Four Million Patient Records, and No Encryption

At my Oct. 2011 post "Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure" (http://hcrenewal.blogspot.com/2011/10/still-more-ehr-…

Đọc thêm »