Another Reason to Put Everyone's Confidental Medical Information Into Today's Massively Secure (Surely They Are, No?) EHR systems

Office of Inspector General<br />Department of the Treasury <br />Oct. 17, 2013<br /><br />Audit report <br /><br /><b>INFORMATION TECHNOLOGY: OCC's (Office of the Comptroller of the Currency) Network and Systems Security Controls Were Deficient</b><br /><br />PDF available at: <a href="http://www.treasury.gov/about/organizational-structure/ig/Audit%20Reports%20and%20Testimonies/OIG-14-001.pdf">http://www.treasury.gov/about/organizational-structure/ig/Audit%20Reports%20and%20Testimonies/OIG-14-001.pdf</a> <br /><br />Highlights:<br /><br /><blockquote class="tr_bq">... To accomplish our objective, we performed a series of internal and external vulnerability assessments and penetration tests on OCC’s workstations, servers, network-attached peripherals (such as cameras and printers), infrastructure devices, and Internet websites.<br /><br />... We determined that OCC’s security measures were<b> not sufficient to fully prevent and detect unauthorized access into its network and systems by internal threats,or external threats that gained an internal foothold.</b> Also, OCC’s security measures were not adequate <b>to fully protect personally identifiable information (PII) from Internet-based threats. </b><br /><br />We found that default factory-preset administrative usernames and passwords were present in OCC’s systems. In one test we conducted, we discovered a default username and password of an internal service account on an OCC server which had local administrator privileges. We used those privileges and deployed our penetration test tool’s agents to the host server. That server contained password hashes for local and domain administrator accounts. Using these hashes, <b>we obtained a domain administrator’s password, which we then used to log on to the network domain controller. With full access given to a typical domain administrative account, we created a domain administrator account and thereby had full control of OCC’s network.</b><br /><br />... In accordance with our Rules of Engagement, we did not attempt to perform actions that would disrupt OCC’s operations, such as deleting data, powering off servers or other resources, locking out accounts, and similar activities, any of which could have resulted in interruption or shutdown of devices or services. However, malicious attackers would have no such restrictions against performing these actions<br /><br />... Because systems and devices connected to OCC’s internal network could freely communicate between one another, with very little internal partitioning, <b>we successfully attacked multiple OCC systems in a very short amount of time from a single workstation. </b></blockquote><br />I offer no additional comments other than, if Treasury's IT security is this lax, just imagine how secure your health information is, sitting on servers at Podunk Hollow General Hospital. <br /><br />-- SS

Another Reason to Put Everyone's Confidental Medical Information Into Today's Massively Secure (Surely They Are, No?) EHR systems

Office of Inspector GeneralDepartment of the Treasury Oct. 17, 2013Audit report INFORMATION TECHNOLOGY: OCC's (Office of the Comptroller of the Currency) Network and Systems Security Controls Were Def…

Đọc thêm »

But Don't Worry, Your Health Information is Secure: the Enforcers are Themselves Incompetent and Broke

Another in my <b>"But Don't Worry, Your Health Information is Secure"</b> series (see <a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy">http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy</a>) ... a promise blindly made by the healthcare information technology hyper-enthusiasts<span style="color: #1f497d;">.</span><br /><br /><blockquote class="tr_bq"><span style="color: #1f497d;">The Office of the Inspector General for HHS just issued a report finding that the Office of Civil Rights (OCR), <i>which is charged with enforcing the HIPAA/HITECH law</i>, had itself failed to adequately protect the security of the health information it handled. Specifically OIG found that OCR “focused on system operability to the detriment of system and data security.”</span></blockquote><br /><span style="color: #1f497d;">From <b>“The Office for Civil Rights Did Not Meet All Federal Requirements in Its Oversight and Enforcement of the Health Insurance Portability and Accountability Act Security Rule”</b>, p. ii (Nov. 2013).  <a href="http://oig.hhs.gov/oas/reports/region4/41105025.asp">http://oig.hhs.gov/oas/reports/region4/41105025.asp</a></span><a href="https://exchangeweb.drexel.edu/owa/redir.aspx?C=cnmQxxd1ok6fZ7r1yAFMffFwO7p2yNAIzU9ZEphzhXivZep_Icu-CQf-7PEVpCAa1XTvDnjs5d4.&URL=http%3a%2f%2foig.hhs.gov%2foas%2freports%2fregion4%2f41105025.asp" style="color: purple;" target="_blank"></a><br /><br /><div class="line">Summary:</div><div class="line"><br /></div><blockquote class="tr_bq">The Office for Civil Rights (OCR) did not meet certain Federal requirements critical to the oversight and enforcement of the Health Insurance Portability and Accountability Act Security Rule (Security Rule). <b>OCR had not assessed risks, established priorities, or implemented controls for its Federal requirements to provide for periodic audits of covered entities to ensure their compliance with Security Rule requirements. </b>In addition, OCR's Security Rule investigation files did not contain required documentation supporting key decisions made <b>because management had not implemented sufficient controls, including supervisory review and documentation retention, to ensure investigators follow investigation policies and procedures for properly initiating, processing, and closing Security Rule investigations.</b> Further, OCR had not fully complied with Federal cybersecurity requirements for its information systems used to process and store investigation data because it focused on system operability <span style="color: red;"><i><b>[I presume they mean 'interoperability' - ed.]</b></i></span> to the detriment of system and data security.<br /><br />We recommended that OCR (1) assess the risks, establish priorities, and implement controls for its HITECH auditing requirements; (2) provide for periodic audits in accordance with HITECH to ensure Security Rule compliance at covered entities; (3) implement sufficient controls, such as supervisory reviews and documentation retention, to ensure policies and procedures for Security Rule investigations are followed; and (4) implement the National Institute of Standards and Technology Risk Management Framework for systems used to oversee and enforce the Security Rule. In its comments on our draft report, OCR generally concurred with our recommendations and described the actions it has taken to address them. In specific comments on our second recommendation, however, <b>OCR explained that no funds had been appropriated for it to maintain a permanent audit program and that funds used to support audit activities previously conducted were no longer available.</b></blockquote><br />The enforcers are themselves negligent, incompetent and broke.  And hospitals are expected to keep electronic protected health information secure? <br /><br />I comment no further.  What more could I possibly write?<br /><br />-- SS<br /><br /><b>Dec. 9, 2013 Addendum:</b><br /><br />This woman would probably agree that this is a problem<br /><br /><blockquote class="tr_bq">Dec. 9, 2013<br /><a href="http://www.thestar.com/news/gta/2013/11/28/disabled_woman_denied_entry_to_us_after_agent_cites_supposedly_private_medical_details.html">http://www.thestar.com/news/gta/2013/11/28/disabled_woman_denied_entry_to_us_after_agent_cites_supposedly_private_medical_details.html </a><br /><br /><b>Disabled woman denied entry to U.S. after agent cites supposedly private medical details</b><br /><br />A Toronto woman is shocked after she was denied entry into the U.S. because she had been hospitalized for clinical depression.<br /><br />Ellen Richardson went to Pearson airport on Monday full of joy about flying to New York City and from there going on a 10-day Caribbean cruise for which she’d paid about $6,000.<br /><br />But a U.S. Customs and Border Protection agent with the Department of Homeland Security killed that dream when he denied her entry.<br /><br />“I was turned away, I was told, because I had a hospitalization in the summer of 2012 for clinical depression,’’ said Richardson, who is a paraplegic and set up her cruise in collaboration with a March of Dimes group of about 12 others.<br /><br />The Weston woman was told by the U.S. agent she would have to get “medical clearance’’ and be examined by one of only three doctors in Toronto whose assessments are accepted by Homeland Security. She was given their names and told a call to her psychiatrist “would not suffice.’’<br /><br />At the time, Richardson said, she was so shocked and devastated by what was going on, she wasn’t thinking about how U.S. authorities could access her supposedly private medical information.<br /><br />“I was so aghast. I was saying, ‘I don’t understand this. What is the problem?’ I was so looking forward to getting away . . . I’d even brought a little string of Christmas lights I was going to string up in the cabin. . . . It’s not like I can just book again right away,’’ she said, referring to the time and planning that goes into taking a trip as a disabled person.<br /><br />Richardson said she’d had no discussion whatsoever with the agent at the airport about her medical history or background. </blockquote><br />Read the whole thing.<br /><br />-- SS

But Don't Worry, Your Health Information is Secure: the Enforcers are Themselves Incompetent and Broke

Another in my "But Don't Worry, Your Health Information is Secure" series (see http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy) ... a promise blindly made by the healthcare infor…

Đọc thêm »

N.S.A. Able to Foil Basic Safeguards of Privacy on Web, Including Medical Records - Yet Another Reason To Be Concerned About What You Tell Your Physician

There's already a major issue with privacy and protection of medical records in electronic form.  See the multiple blog posts at this query link:  <a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy">http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy</a><br /><br />Now this from the New York Times:<br /><br /><blockquote class="tr_bq"><a href="http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html?pagewanted=all&_r=1&">N.S.A. Able to Foil Basic Safeguards of Privacy on Web</a><br />By NICOLE PERLROTH, JEFF LARSON and SCOTT SHANE<br />September 5, 2013<br /><br />The <a class="meta-org" href="http://topics.nytimes.com/top/reference/timestopics/organizations/n/national_security_agency/index.html?inline=nyt-org" title="More articles about National Security Agency, U.S.">National Security Agency</a> is winning its long-running secret war on encryption, using supercomputers, technical trickery, court orders and behind-the-scenes persuasion to undermine the major tools protecting the privacy of everyday communications in the Internet age, according to newly disclosed documents.<br /><br />The agency has circumvented or cracked much of the encryption, or digital scrambling, that guards global commerce and banking systems, <b>protects sensitive data like trade secrets and medical records</b>, and automatically secures the e-mails, Web searches, Internet chats and phone calls of Americans and others around the world, the documents show.  </blockquote><br />But don't worry, your electronic medical records are secure, and will NEVER be used for political purposes by your adversaries...<br /><br /><blockquote class="tr_bq"><div itemprop="articleBody">Beginning in 2000, as encryption tools were gradually blanketing the Web, the N.S.A. invested billions of dollars in a clandestine campaign to preserve its ability to eavesdrop. Having lost a public battle in the 1990s to insert its own “back door” in all encryption, it set out to accomplish the same goal by stealth. </div><div itemprop="articleBody"><br /></div><div itemprop="articleBody">The agency, according to the documents and interviews with industry officials,<b> deployed custom-built, superfast computers to break codes</b>, and began<b> collaborating with technology companies in the United States and abroad to build entry points into their products. </b>The documents do not identify which companies have participated. </div></blockquote><br />At least we may have gotten faster PC's as a side result of the research that supported these efforts.<br /><br /><blockquote class="tr_bq">... the agency used its influence as the world’s most experienced code maker to covertly introduce weaknesses into the encryption standards followed by hardware and software developers around the world.<br /><br />Some of the agency’s most intensive efforts have focused on the encryption in universal use in the United States, including <a href="https://www.globalsign.com/ssl-information-center/what-is-ssl.html" title="More about SSL">Secure Sockets Layer</a>, or SSL; <a href="http://gadgetwise.blogs.nytimes.com/2011/05/17/vpn-for-the-masses/" title="More about VPN">virtual private networks</a>, or VPNs; and the protection used on fourth-generation, or 4G, smartphones. Many Americans, often without realizing it, rely on such protection every time they send an e-mail, buy something online, consult with colleagues via their company’s computer network, or use a phone or a tablet on a 4G network.  </blockquote><br />Might as well just send them a copy of all your communications to spare them the effort...<br /><br /><blockquote class="tr_bq">... Ladar Levison, the founder of Lavabit, wrote <a href="http://lavabit.com/">a public letter</a> to his disappointed customers, offering an ominous warning. “Without Congressional action or a strong judicial precedent,” he wrote,<b> “I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States.” </b> </blockquote><br />Hey, how about let's ALL have our medical records stored by health IT companies providing ASP (<span dir="auto">Application service provider, <a href="http://en.wikipedia.org/wiki/Application_service_provider">http://en.wikipedia.org/wiki/Application_service_provider</a>) offsite EHR hosting </span>services to hospitals and clinics...<br /><br />From the site "techdirt.com":<br /><br /><blockquote class="tr_bq">Allegedly <a href="http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security" target="_blank">the NSA and GCHQ (<span class="st">UK Government Communications Headquarters)</span> have basically gotten backdoors into various key security offerings used online</a>, in part by controlling the standards efforts, and in part by sometimes <i>covertly</i> introducing security vulnerabilities into various products. They haven't "cracked" encryption standards, but rather just found a different way in. The full report is worth reading ... (<a href="http://www.techdirt.com/articles/20130905/12295324417/nsa-gchq-covertly-took-over-security-standards-recruited-telco-employees-to-insert-backdoors.shtml">http://www.techdirt.com/articles/20130905/12295324417/nsa-gchq-covertly-took-over-security-standards-recruited-telco-employees-to-insert-backdoors.shtml</a>).</blockquote><br />Half facetiously: unless you're a real nobody, if you, say, contracted V.D. from that sexy prostitute at that Vegas Convention, you perhaps better not tell your doctor about it.<br /><br />Maybe this is what it will take to get the government to start taking electronic medical record privacy, confidentiality and security more seriously.<br /><br />Our legislators, like everyone else, have a stake in the game.<br /><br />-- SS<br /><br /><br />

N.S.A. Able to Foil Basic Safeguards of Privacy on Web, Including Medical Records - Yet Another Reason To Be Concerned About What You Tell Your Physician

There's already a major issue with privacy and protection of medical records in electronic form.  See the multiple blog posts at this query link:  http://hcrenewal.blogspot.com/search/label/medical%20…

Đọc thêm »

Calling Dr. Moe, Dr. Larry and Dr. Curly: Advocate Medical Breach of Four Million Patient Records, and No Encryption

At my Oct. 2011 post "<b>Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure</b>" (<a href="http://hcrenewal.blogspot.com/2011/10/still-more-ehr-chaos-pandemonium-bedlam.html">http://hcrenewal.blogspot.com/2011/10/still-more-ehr-chaos-pandemonium-bedlam.html</a>) I thought I'd seen the worst.<br /><br />Yet another post to add to the category of medical record privacy/confidentiality/security (<a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy">http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy),</a> however:<br /><br /><blockquote class="tr_bq"><a href="http://www.healthcareinfosecurity.com/advocate-medical-breach-no-encryption-a-6021">Advocate Medical Breach: No Encryption?</a><br />Computer Theft Raises Questions About Unencrypted Devices<br />By Marianne Kolbasuk McGee, August 27, 2013.<span class="date"></span><br /><br />The recent theft of <b>four unencrypted desktop computers </b>from a Chicago area physician group practice may result in the second biggest healthcare <a href="http://www.healthcareinfosecurity.com/breach-response-c-324"><b>breach</b></a> ever reported to federal regulators. But the bigger issue is: Why do breaches involving unencrypted computer devices still occur?<br /><br />According to the Department of Health and Human Services' "wall of shame" website listing 646 breaches impacting 500 or more individuals since September 2009, more than half of the incidents involved lost or stolen unencrypted devices. Incidents involving data secured by encryption do not have to be reported to HHS.<br /><br />... The <b>four unencrypted but password-protected computers <span style="color: red;"><i>[passwords on PC's are bypassable by smart teenagers - ed.]</i></span> stolen during a burglary in July from an office of <a href="http://www.healthcareinfosecurity.com/breach-may-affect-4-million-patients-a-6018">Advocate Medical Group</a> in Illinois may have exposed information of about 4 million patients,</b> according to an Advocate spokesman. </blockquote><br />4 million is about 1.3 percent of the entire U.S. population (about <a href="https://www.google.com/search?q=us%20population">313.9 million</a> in 2012) ... on just four desktop computers.<br /><br />Try that with paper ...<br /><br />As to the subtitle of the article, "<b>Computer Theft Raises Questions About Unencrypted Devices</b>", I've written on that issue before.  I'd noted questions like that are remarkable considering both MacOS and Windows have built-in, readily available encryption, the latter for a few extra $ for the "deluxe version" (see <span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[0]"> </span><a class="" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[1]" href="http://en.wikipedia.org/wiki/FileVault" rel="nofollow" target="_blank">http://en.wikipedia.org/wiki/FileVault</a><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[2]"> and </span><a class="" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[3]" href="http://en.wikipedia.org/wiki/Bitlocker" rel="nofollow" target="_blank">http://en.wikipedia.org/wiki/Bitlocker</a><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]">).  </span></span></span><br /><br /><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]">Perhaps the best explanation in 2013 for unencrypted desktop PC's containing millions of confidential medical records is this picture, symbolic of the apparent attitudes of corporate and IT management on health IT security:</span></span></span><br /><br /><br /><table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnAsw6PW67gX6YJJIVtd1hEp5nCpuf5Re_XG0rDd2AJELzlw8B5pV9bvBxHPXa6DhmesPxvPoc8c_n3Y3u2s3Ki1GxEUgZ_jzbex53lu7i4-pc6eS4SKXr6axDPCCVSmKPpHg_UAPThsnN/s1600/stooges+police300px.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnAsw6PW67gX6YJJIVtd1hEp5nCpuf5Re_XG0rDd2AJELzlw8B5pV9bvBxHPXa6DhmesPxvPoc8c_n3Y3u2s3Ki1GxEUgZ_jzbex53lu7i4-pc6eS4SKXr6axDPCCVSmKPpHg_UAPThsnN/s1600/stooges+police300px.jpg" /></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]">Encryption?  We don't need no encryption.  We got triple protection already!</span></span></span></td></tr></tbody></table><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]"><br /></span></span></span><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]"><br /></span></span></span><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]">-- SS</span></span></span><br /><span data-ft="{"tn":"K"}" data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0]"><span data-reactid=".r[2a5gp].[1][4][1]{comment10200246430313520_4728545}.[0].{right}.[0].{left}.[0].[0].[0][2].[0].[4]"><br /></span></span></span>

Calling Dr. Moe, Dr. Larry and Dr. Curly: Advocate Medical Breach of Four Million Patient Records, and No Encryption

At my Oct. 2011 post "Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure" (http://hcrenewal.blogspot.com/2011/10/still-more-ehr-…

Đọc thêm »

But don't worry, your EHR information is secure

My last reminder of this issue was almost a half-year ago, but I think a repeat is in order. <br /><br />More bugs squashed: <br /><br /><a href="http://www.zdnet.com/microsoft-fixes-critical-windows-ie-flaws-for-patch-tuesday-7000012352/" target="_blank">Microsoft fixes critical Windows, IE flaws for Patch Tuesday</a><br /><br /><blockquote class="tr_bq">Microsoft has released four critical security updates for Windows and Internet Explorer, along with a bevy of other products, in order to <a href="http://technet.microsoft.com/en-us/security/bulletin/ms13-mar">protect against at least 19 vulnerabilities</a> identified in its software.<br /><br />On deck this month, there are four "critical" vulnerabilities that affect Windows, Internet Explorer, Office, and Windows Server, including one for Silverlight that affects both Windows and Mac machines.<br /><br />The most severe Internet Explorer flaw affected all versions of Windows XP (Service Pack 3) and above, including Vista, Windows 7, and Windows 8 — including tablets running Windows RT — running Internet Explorer 6 and above. <b>The flaw could have allowed a hacker to access the vulnerable system with the same user rights.</b><br /><br />... The <a href="http://technet.microsoft.com/en-us/security/bulletin/ms13-mar">other vulnerabilities rated as "important"</a> could allow data and information disclosure, or an elevation of privileges on affected machines. These affect SharePoint, OneNote, Outlook for Mac, and kernel-mode drivers in Windows-based machines. </blockquote><br />I note that Windows XP is now more than a decade old, but Windows RT is brand-spanking new. <br /><br />In a Nov. 2012 post somewhat vexatiously entitled "<a href="http://hcrenewal.blogspot.com/2012/11/why-its-crazy-to-want-your-most.html" target="_blank">Why It's Crazy to Want Your Most Confidential Information Put into An Electronic Medical Records System</a>" about Windows 8 flaws, <b>I had indicated how common Microsoft products were in hospital IT.</b><br /><br />I stand by that vexatious title.<br /><br />But don't worry, your confidential medical information is secure, and your safety against malfunctioning IT that loses your critical medical information after hackers invade is assured, in our current rushed national health IT rollout.<br /><br />What is the answer?  Until this technology has significantly been secured and debugged, this old triad applies:<br /><br /><ul><li>If you want your information secure, don't put it on a computer.</li><li>If you must put it on a computer but still want some degree of security, don't put the computer on a network.</li><li>If you must put the computer on a network, especially a network connected to the Internet, your information is no longer secure.  </li></ul>It's premature in my view to be building and operationalizing national health records networks.  Unless, that is, patient information privacy, security and confidentiality are secondary considerations.<br /><br />(In my view, they are seen by the national IT builders and promoters as secondary considerations, but the builders and promoters will never admit it, perhaps even to themselves.)<br /><ul></ul>-- SS <br /><br />

But don't worry, your EHR information is secure

My last reminder of this issue was almost a half-year ago, but I think a repeat is in order. More bugs squashed: Microsoft fixes critical Windows, IE flaws for Patch TuesdayMicrosoft has released four…

Đọc thêm »

Why It's Crazy to Want Your Most Confidential Information Put into An Electronic Medical Records System

Besides the reasons I outlined in posts retrievable by these query links (<a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20confidentiality" target="_blank">link</a>, <a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy" target="_blank">link</a>), there's this from ZDNet.com:<br /><br /><blockquote class="tr_bq"><a href="http://www.zdnet.com/microsoft-warns-of-first-critical-windows-8-rt-security-flaws-7000007175/?s_cid=e539" target="_blank">Microsoft warns of first critical Windows 8, RT security flaws </a><br /><br />It's been less than a month since Windows 8 and Windows RT-powered Surface tablets were launched and went on sale, but Microsoft is already warning that the two next-generation operating systems contain <a href="http://technet.microsoft.com/en-us/security/bulletin/ms12-nov">critical security vulnerabilities that are due to be patched</a> this coming Tuesday.<br /><br />Among the various flaws, <b>versions from Windows XP (Service Pack 3) all the way through to Windows 8 are affected</b>, including versions of the Office suite, and versions of Windows Server. Released only in September, Windows Server 2012 requires patching to maintain maximum security.<br /><br />The latest vulnerabilities include three critical security vulnerabilities for Windows 8, and one critical security vulnerability for the Surface-based Windows RT operating system. These flaws are considered "critical" and could allow remote code execution on vulnerable systems. </blockquote><br />I note that Windows XP was released worldwide for retail sale on <a href="http://en.wikipedia.org/wiki/Windows_XP" target="_blank">October 25, 2001</a>, which was more than eleven years ago.  That security vulnerabilities are still being patched in 2012 is stunning.  Also, many enterprise information systems and most hospital clients (workstations) run on Windows-based servers and Windows installed local machines (UNIX, MacOS and other OS's are very rare on general-purpose hospital workstations).<br /><br />From a Microsoft website <a href="http://www.microsoft.com/industry/government/health/physician.aspx" target="_blank">here</a>: <br /><br /><div style="padding-left: 20px;"><div class="contentText1 padding_btm1">... The partners listed below are CCHIT 07/08 certified and fully utilize the Microsoft database and server platform.</div><div><table border="0" cellpadding="2" cellspacing="0" style="width: 100%px;"> <tbody><tr align="left" class="padding_btm1" valign="top"> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#Abraxas_Medical_Solutions">Abraxas Medical Solutions</a> </td> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#gehealthcare">GE Healthcare</a> </td> </tr><tr align="left" class="padding_btm1" valign="top"> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#Allscripts">Allscripts</a> </td> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#gMed">gMed</a> </td> </tr><tr align="left" class="padding_btm1" valign="top"> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#Aprima_Medical_Software_Inc.">Aprima Medical Software Inc.</a> </td> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#Greenway_Medical_Technologies">Greenway Medical Technologies</a> </td> </tr><tr align="left" class="padding_btm1" valign="top"> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#ASG_Software_Solutions">ASG Software Solutions</a> </td> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#Henry_Schein">Henry Schein, Inc.</a> </td> </tr><tr align="left" class="padding_btm1" valign="top"> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#Eclipsys">Eclipsys</a> </td> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#McKesson">McKesson</a> </td> </tr><tr align="left" class="padding_btm1" valign="top"> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#e-MDs">e-MDs</a> </td> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#NextGen">NextGen</a> </td> </tr><tr align="left" class="padding_btm1" valign="top"> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#GEMMS">GEMMS, Inc.</a> </td> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#urochartehr">UroChartEHR</a> </td> </tr><tr align="left" class="padding_btm1" valign="top"> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx#gloStream">gloStream</a> </td> <td><a class="normalLink" href="http://www.microsoft.com/industry/government/health/physician_partners.mspx">Learn more about our partners</a> </td> </tr></tbody></table></div></div><div><br />This partial list includes many very large HIT sellers.  There are many others as well.</div><br />By simple reckoning, it's likely we'll be seeing critical security vulnerabilities in Windows 8 - in 2023.<br /><br />It goes without saying that these security problems will continue to be exploited by identity thieves, medical information merchants, and others with no rights to "protected" information. <br /><br />In my opinion, the (still not yet realized) convenience of being able to have one doctor transmit your record to another, thus avoiding a FAX machine, the Postal Service or the telephone, and the <a href="http://hcrenewal.blogspot.com/2012/09/wsj-koppel-and-soumerai-major-glitch.html" target="_blank">trillion-dollar</a> "solution" to the nearly non-existent problem of being found unconscious in some foreign land with no ID, no companions, and some hidden, critical medical condition not findable on physical exam and bloodwork, EKG, x-rays etc. that will cause death if not treated in minutes, is not worth the risk of having one's most private information spilled all over the Internet.<br /><br />EHR's should not be accessible on networks beyond a physician's office or the robustly encrypted network of a hospital, and the information security personnel kept on very short leashes, for the foreseeable future.<br /><br />I am unwilling to cede my own privacy to cybernetic utopians who ignore alarming evidence - plain to see at the aforementioned query links at the top of this post - nor can I in good faith recommend doing so to the public in 2012.<br /><br />Considering the information in the many posts at the aforementioned query links (as here: <a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20confidentiality" target="_blank">link</a>, <a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy" target="_blank">link</a> -- be aware you need to hit "older posts" at the bottom of each page to see all of them), that position is straightforward. <br /><br />-- SS<br /><br /><b>11/9/2012 Addendum:</b><br /><br />Also see my Oct. 2012 post "<a href="http://hcrenewal.blogspot.com/2012/10/computer-viruses-are-rampant-on-medical.html" target="_blank">Computer Viruses Are 'Rampant' on Medical Devices in Hospitals</a>." <br /><br />-- SS

Why It's Crazy to Want Your Most Confidential Information Put into An Electronic Medical Records System

Besides the reasons I outlined in posts retrievable by these query links (link, link), there's this from ZDNet.com:Microsoft warns of first critical Windows 8, RT security flaws It's been less than a …

Đọc thêm »

Computer Viruses Are "Rampant" on Medical Devices in Hospitals

As if there weren't enough problems with hospitals as computing backwaters, now there's this:<br /><br /><blockquote class="tr_bq"><a href="http://www.technologyreview.com/news/429616/computer-viruses-are-rampant-on-medical-devices/" target="_blank"><b>Computer Viruses Are "Rampant" on Medical Devices in Hospitals</b></a><br /><br />A meeting of government officials reveals that medical equipment is becoming riddled with malware.<br /><br />Technology Review<br />Published by MIT<br />David Talbot<br />Wednesday, October 17, 2012 <br /><br />Computerized hospital equipment is increasingly vulnerable to malware infections, according to participants in a recent government panel. These infections can clog patient-monitoring equipment and other software systems, at times rendering the devices temporarily inoperable.<br /><br /><b>While no injuries have been reported</b>, the malware problem at hospitals is clearly rising nationwide, says Kevin Fu, a leading expert on medical-device security and a computer scientist at the University of Michigan and the University of Massachusetts, Amherst, who took part in the panel discussion.</blockquote><br />I note the seemingly universal refrain<b> </b>"<b>no injuries have been reported</b>" once more (see <a href="http://hcrenewal.blogspot.com/search/label/Patient%20care%20has%20not%20been%20compromised" target="_blank">this query link</a> to similar statements regarding IT malfunctions), which is irrelevant since reporting mechanisms for medical errors are <a href="http://www.seattlepi.com/local/article/Despite-law-medical-errors-likely-go-unreported-889076.php" target="_blank">noted to be deficient</a>.<br /><br /><blockquote class="tr_bq">Software-controlled medical equipment has become increasingly interconnected in recent years, and many systems run on variants of Windows, a common target for hackers elsewhere. The devices are usually connected to an internal network that is itself connected to the Internet, and they are also vulnerable to infections from laptops or other device brought into hospitals.  <b><span style="color: red;"><i>[I note that it should be impermissible to connect "alien" machines to a hospital<span style="color: black;">'s</span> network without authorization, and that attaining that level of security protection is not difficult - ed.] </i></span> </b>The problem is exacerbated by the fact that manufacturers often will not allow their equipment to be modified, even to add security features.<br /><br />In a typical example, at Beth Israel Deaconess Medical Center in Boston, 664 pieces of medical equipment are <b>running on older Windows operating systems that manufactures will not modify or allow the hospital to change</b>—even to add antivirus software—because of disagreements over whether modifications could run afoul of U.S. Food and Drug Administration regulatory reviews, Fu says.</blockquote><br />In other words, let's run at high risk if it avoids the time and expense of FDA reviews that would ensure the equipment is safe and operates as expected with the software updates.<br /><br /><blockquote class="tr_bq">As a result, these computers are frequently infected with malware, and one or two have to be taken offline each week for cleaning, says Mark Olson, chief information security officer at Beth Israel.</blockquote><br />It is unclear how the servers running the hospital information system, electronic health records systems, physician order entry systems etc. are immune to spread of the malware.<br /><blockquote class="tr_bq"><br />"I find this mind-boggling," Fu says. "Conventional malware is rampant in hospitals because of medical devices using unpatched operating systems. There's little recourse for hospitals when a manufacturer refuses to allow OS updates or security patches."<br /><br />The worries over possible consequences for patients were described last Thursday at a meeting of a medical-device panel at the National Institute of Standards and Technology Information Security and Privacy Advisory Board, of which Fu is a member, in Washington, D.C. At the meeting, Olson described <b>how malware at one point slowed down fetal monitors used on women with high-risk pregnancies being treated in intensive-care wards.</b></blockquote><br />In its face, that is potentially catastrophic depending on the degree of "slowdown" and whether data is lost.<br /><br /><blockquote class="tr_bq"><b>"It's not unusual for those devices, for reasons we don't fully understand, to become compromised to the point where they can't record and track the data,</b>" Olson said during the meeting, referring to high-risk pregnancy monitors. "Fortunately, we have a fallback model because they are high-risk [patients]. They are in an IC unit—there's someone physically there to watch. <b>But if they are stepping away to another patient, there is a window of time for things to go in the wrong direction."</b></blockquote><br />The reasons seem obvious to anyone who's had a serious malware infection on their PC.  I've only had one - a computer I bought at a fleamarket for $7 was so severely infected it was unusable for even basic tasks, and was resistant to virus removal.  I solved that problem by installing a fresh copy of the OS, immediately followed by all patches and the latest anti-malware software.<br /><br /><blockquote class="tr_bq">The computer systems at fault in the monitors were replaced several months ago by the manufacturer, Philips; the new systems, based on Windows XP, have better protections and the problem has been solved, Olson said in a subsequent interview.</blockquote><br />This implies the older systems were running on Win 98 or earlier or an old version of Win NT.  Amazing.<br /><br /><blockquote class="tr_bq">At the meeting, Olson also said similar problems threatened a wide variety of devices, ranging from compounders, which prepare intravenous drugs and intravenous nutrition, to picture-archiving systems associated with diagnostic equipment, including massive $500,000 magnetic resonance imaging devices.<br /><br />Olson told the panel that infections have stricken many kinds of equipment,<b> raising fears that someday a patient could be harmed.</b> "We also worry about situations where blood gas analyzers, compounders, radiology equipment, nuclear-medical delivery systems, could become compromised to where they can't be used, or they become compromised to the point where their values are adjusted without the software knowing," he said. He explained that when a machine becomes clogged with malware, it could in theory "miss a couple of readings off of a sensor [and] erroneously report a value, which now can cause harm."</blockquote><br />I opine that harm could already have occurred; it just may not been recognized as such nor reported.  Disappearing data and other EHR failure modes known to have caused harm and/or deaths could be related to malware, for example.<br /><br /><blockquote class="tr_bq">... Malware problems on hospital devices <b>are rarely reported to state or federal regulators</b>, both Olson and Fu said. This is partly because hospitals believe they have little recourse. Despite FDA guidance issued in 2009 to hospitals and manufacturers—encouraging them to work together and stressing that eliminating security risks does not always require regulatory review—many manufacturers interpret the fine print in other ways and don't offer updates, Fu says. And such reporting is not required unless a patient is harmed. "Maybe that's a failing on our part, that we aren't trying to raise the visibility of the threat," Olson said. "But I think we all feel the threat gets higher and higher."</blockquote><br />I note that health IT related problems are also rarely reported, with only one vendor being the exception (see my post on the <b>FDA MAUDE</b> voluntary reporting database <a href="http://hcrenewal.blogspot.com/2011/01/maude-and-hit-risk-mother-mary-what-in.html" target="_blank">here</a>).  The reasons likely are not because "hospitals believe they have little recourse" - the real reasons may be fear, complacency and/or incompetence.<br /><blockquote class="tr_bq"><br />Speaking at the meeting, Brian Fitzgerald, an FDA deputy director, said that in visiting hospitals around the nation, he has found Beth Israel's problems to be widely shared. <b>"This is a very common profile," </b>he said. The FDA is now reviewing its regulatory stance on software, Fitzgerald told the panel. "This will have to be a gradual process, because it involves <b>changing the culture,</b> changing the technology, bringing in new staff, and making a systematic approach to this," he said.</blockquote><br />Changing the culture would be nice, considering we are now entering a national rollout of complex enterprise clinical resource and workflow control systems anachronistically known as "electronic medical records."<br /><br /><blockquote class="tr_bq">In an interview Monday, Tam Woodrum, a software executive at the device maker GE Healthcare, said manufacturers are in a tough spot, and the problems are amplified as hospitals expect more and more interconnectedness. He added that despite the FDA's 2009 guidance, regulations make system changes difficult to accomplish: "In order to go back and update the OS, with updated software to run on the next version, <b>it's an onerous regulatory process."</b></blockquote><br />My comment is, if you can't take the heat of work in the real-world medical setting, if you cannot be part of the medical team, then get out of the clinic.  You're likely to do more harm than good.<br /><br /><blockquote class="tr_bq">John Halamka, Beth Israel's CIO and a Harvard Medical School professor, said he began asking manufacturers for help in isolating their devices from the networks after trouble arose in 2009: the Conficker worm caused problems with a Philips obstetrical care workstation, a GE radiology workstation, and nuclear medical applications that "could not be patched due to [regulatory] restrictions." He said, "No one was harmed, but we had to shut down the systems, clean them, and then isolate them from the Internet/local network."<br /><br />He added: "<b>Many CTOs <span style="color: red;"><i>[chief technology officers - ed.]</i></span> are not aware of how to protect their own products with restrictive firewalls</b>. All said they are working to improve security but have not yet produced the necessary enhancements."</blockquote><br />Then why are they CTO's?<i><b> </b></i> Is this the phenomenon of generic or underqualified managers rearing its head?<i><b><br /></b></i><br /><blockquote class="tr_bq"><br />Fu says that medical devices need to stop using insecure, unsupported operating systems. "More hospitals and manufacturers need to speak up about the importance of medical-device security," he said after the meeting. "<b>Executives at a few leading manufacturers are beginning to commit engineering resources to get security right</b>, but there are thousands of software-based medical devices out there."</blockquote><br />One can only wonder if others have done a Ford Pinto cost-benefit analysis and decided the costs of settlement from injured and dead patients is less than the cost of remediation. <br /><br />-- SS

Computer Viruses Are "Rampant" on Medical Devices in Hospitals

As if there weren't enough problems with hospitals as computing backwaters, now there's this:Computer Viruses Are "Rampant" on Medical Devices in HospitalsA meeting of government officials reveals tha…

Đọc thêm »

Manipulation of 12,000 Medical Records Made Easy by EHR

<div id="article-text">This from a hospital in Canberra, Australia using a common ED EHR in that part of the world, <a href="http://www.isofthealth.com/en-AU/Solutions/ANZ%20Department/%7E/media/Files/Brochures%20and%20Fast%20Facts/iSOFT%20Edis%20v9%20Release%20110610%20lhigh%20res%20but%20no%20marks.ashx" target="_blank">iSOFT</a>:<br /><br /><blockquote class="tr_bq"><a href="http://www.scmagazine.com.au/News/307389,canberra-hospital-embroiled-in-data-scandal.aspx" target="_blank">Canberra Hospital embroiled in data scandal</a><br />SBI Magazine (Secure Business Intelligence)<br /><span id="ctl00_ctl00_ContentPlaceHolder1_LeftColumnPlaceHolder_Article_DateTimeLiteral">Jul 5, 2012  </span><br /><br />A Canberra Hospital executive has admitted to manipulating Emergency Department records to make wait times and stays appear shorter than they were.<br /><br />The executive told the Director-General of the Health Directorate they had made "approximately 20 to 30 changes to hospital records" a day from "late 2010" onwards.<br /><br /><i>ABC [Australian Broadcasting Corp.] News</i> reported that the matter <a href="http://www.abc.net.au/news/2012-07-04/canberra-hospital-data-tampering/4108894?section=act" target="_blank" title="ABC News">has been referred to police</a>, while the executive has been suspended without pay.<br /><br />Though the data manipulation was initially said to be motivated by concerns over job security, changes in 2011 and early 2012 were said to have been made <b>due to "managerial pressure" to improve publicly-reported performance statistics.</b></blockquote><br />This raises the issue that data manipulation might have been performed not just to improve reported statistics, but to cover up medical error, computer related or not, and thus deny injured patients or their heirs the right to legal redress.<br /><br /><blockquote class="tr_bq">"The only thing that worked to achieve benchmark targets was to alter the data," the executive later told investigators at PricewaterhouseCoopers (PwC), which was engaged by Health to perform a forensics analysis. The analysis is detailed in a new Auditor-General report (<a href="http://www.audit.act.gov.au/auditreports/reports2012/Report%20No.%206%20Emergency_Department_Performance_Information.pdf" target="_blank">pdf</a>).<br /><br />In total, PwC found <b>11,700 performance records</b> - about six percent of all records stored in the hospital's <a href="http://www.isofthealth.com/" target="_blank">iSOFT</a> emergency department information solution (EDIS) - had been altered.<br /><br />It is believed more staff at Canberra Hospital altered records than the executive that has so far admitted responsibility.  "While an executive has admitted to changing EDIS records, <b>it is probable that EDIS records have also been manipulated by other persons with access to the system,</b>" the federal auditor-general noted overnight. </blockquote><br />This is another area where electronic records make possible tasks that are probably impossible with paper.  Altering 11,000+ records would be hard in paper charts, as the alterations would likely stick out in a pronounced manner. <br /><br /><blockquote class="tr_bq">"The executive’s admission to Audit does not appear to account for all of the changes to EDIS records that have been made to improve timeliness performance."<br /><br />For example, changes to EDIS records, albeit a much smaller number, appear to have been made on days when the executive was on leave (seven days in total in 2010-11 and early 2011-12). </blockquote><br /><b><span style="font-weight: normal;">I am saddened to note, a proper term for this activity might indeed be "<a href="http://en.wikipedia.org/wiki/Conspiracy_%28crime%29" target="_blank">conspiracy</a>":  </span></b>a <b>conspiracy</b> is an agreement between two or more persons to break the law at some time in the future.<b><span style="font-weight: normal;"></span></b><br /><br /><blockquote class="tr_bq"><b>User access control, IT security failures</b><br /><br />Poor controls such as generic logins and inadequate user and password security made it easy for insiders to game the data.<br /><br />While EDIS was on approximately 259 workstations across the hospital and 253 users had permission to run the software, there were only 23 user accounts.<br /><br />Of these user accounts, only eight were in regular use, including four named administrator accounts (specific to administrative staff) and four generic user accounts: CLERK, NURSE, DOCTOR and BEDMAN.<br /><br />The generic accounts could be used by personnel across the hospital, not just within the Emergency Department.<br /><br />Passwords for the four generic user accounts were "very poor" and had "never been changed". Password expiry was set at a default 999 days.<br /><br />Audit logs were equally poor, not proactively checked and unreliable.</blockquote><br />The proper term for these arrangements might be "gross mismanagement" of clinical information technology. <br /><br /><blockquote class="tr_bq">"<b>A feature of the logging record is that it logs the changed field in EDIS and a number of other fields simultaneously, while not identifying which field was changed and what its original value was</b>," auditors noted.<br /><br />"Audit also notes that the logging record is also ineffective, because <b>every entry in EDIS is logged from “Workstation 14”.  </b><br /><br />"Although EDIS has been disseminated widely throughout the Canberra Hospital each of these users logs into EDIS using the common “Workstation 14”. <br /><br />"This practice, combined with the use of generic user accounts, makes the EDIS logging information useless for investigations of unauthorised activity."<br /><br />Furthermore, <b>it was possible to edit EDIS records up to 72 hours after a patient’s treatment</b>, providing a generous window for later unauthorised changes to the records.</blockquote><br />These "features" sound like seller misdesign with regard to the metadata (logging records).<br /><br /><blockquote class="tr_bq"><b>Noticing anomalies</b><br /><br />It was only in April this year that a full inquiry was commissioned after "anomalies" in performance figures were spotted by the Australian Institute of Health and Welfare (AIHW).<br /><br />The AIHW found an unusually high number of emergency patients that were reported to have <b>been seen at exactly within the required time for their illness category</b>.<br /><br />For example, there was an unusually high number of patients who were reported to have been seen at exactly 30 minutes or 60 minutes.<br /><br />In addition, an unusually high number of people checked out of the Emergency Department precisely 240 minutes after their recorded arrival.</blockquote><br />If you're going to engage in this type of activity, at least be competent at it...instead of setting up a red flag bigger than the flag that used to fly over the Kremlin.<br /><br /><blockquote class="tr_bq">The records that were manipulated mean that publicly reported information relating to the timeliness of access to the Emergency Department and overall length of stay in the Emergency Department have been inaccurately reported.<br /><br />The report could not ascertain the level of over‐estimation due to the lack of a clear audit trail identifying what were legitimate and what were fabricated entries in patients’ records.  </blockquote><br />Timelines can be critical to proving medical negligence in court.  Further, if time data could have been manipulated, it seems clinical data could have been manipulated as well. <br /><br />EHR data manipulation is of unknown magnitude worldwide, but I can imagine if it's easy to do and the benefits potentially substantial, electronic records could possibly be <b>less</b> trustworthy than paper records. <br /><br />-- SS<br /><br />Addendum:  while on the topic of clinical IT Down Under, there's also this:<br /><br /><blockquote class="tr_bq"><a href="http://www.goldcoast.com.au/article/2012/07/06/429621_gold-coast-news.html" target="_blank"><b>Coast medical records system 'dangerous'</b></a><br />Stephanie Bedo <br />Goldcoast.com.au<br /><br /><div class="article-info">July 6, 2012 </div></blockquote><blockquote class="tr_bq"><div class="article-info">SENIOR doctors say Gold Coast Heath's new multimillion dollar electronic medical record system is <b>'inadequate and dangerous' and could put patients' lives at risk</b>.</div><br />Doctors have complained about the system, saying some patient documents are missing, it has log-in problems and 10-minute delays in accessing critical information.<br /><br />Gold Coast Health was the first region in the state to move to electronic record-keeping, rolled out progressively from October last year.<br /><br />Queensland Health spent about <b>$200 million</b> on the electronic medical record roll-out last year, which was <b>delayed by 12 months because of problems with the software provider.</b><br /><br />... Hospital cardiologist Dr Greg Aroney raised concerns about the system at a Griffith University forum on the future of health on the Gold Coast this week.<br /><br /><b>"Our system is totally inadequate and dangerous," </b>Dr Aroney said.</blockquote><br /><br />Read the whole story at this link:   <a href="http://www.goldcoast.com.au/article/2012/07/06/429621_gold-coast-news.html">http://www.goldcoast.com.au/article/2012/07/06/429621_gold-coast-news.html</a><br /><br />A similar story from the states where the doctors' complaints were actually ignored is at my Sept. 2011 post <b>"<a href="http://hcrenewal.blogspot.com/2011/09/blake-medical-center-fla-ignores-letter.html" target="_blank">Blake Medical Center (Bradenton, Fla.) Ignores Health IT Warning Letter From 100 Staff Physicians</a>."  </b><br /><br />Let's hope the Australian physicians' complaints are taken more seriously.<br /><br />-- SS<br /><span id="ctl00_ctl00_ContentPlaceHolder1_LeftColumnPlaceHolder_Article_SourceLabel"></span></div>

Manipulation of 12,000 Medical Records Made Easy by EHR

This from a hospital in Canberra, Australia using a common ED EHR in that part of the world, iSOFT:Canberra Hospital embroiled in data scandalSBI Magazine (Secure Business Intelligence)Jul 5, 2012  A…

Đọc thêm »

Banking as the Standard Healthcare Should Look Up To On Medical Information Security?

At past posts "<a href="http://hcrenewal.blogspot.com/2012/03/at-my-oct.html" target="_blank">Don't Worry, Your Electronic Medical Records Are Getting Safer With Every Passing Day</a>", "<a href="http://hcrenewal.blogspot.com/2011/09/another-episode-of-dont-worry-your.html" target="_blank">Another Episode of "But Don't Worry, Your Records are Safe...</a>" and "<a href="http://hcrenewal.blogspot.com/2011/10/still-more-ehr-chaos-pandemonium-bedlam.html">Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure</a>", "<a href="http://hcrenewal.blogspot.com/2012/04/dont-worry-your-records-are-safe-part.html" target="_blank">Don't Worry, Your Records are Safe - Part IV</a>" and others, I wrote on the issue of medical record security.<br /><br />Banking has been held as the standard as to which medicine has been compared, with medicine being called archaic and behind the times for its reliance on paper.  Banking security is cited as a reason why electronic medical records can also be secured.<br /><br />There's this:<br /><br /><blockquote class="tr_bq"><b><a href="http://news.sky.com/story/952931/fraud-ring-in-hacking-attack-on-60-banks" target="_blank">Fraud Ring In Hacking Attack On 60 Banks</a>  <br /><br />June 27, 2012 <br /><br />Some 60m euro is stolen from bank accounts in a massive cyber raid, after fraudsters raid dozens of banks around the world.<br /><br />By Pete Norman, Sky News Online</b><br /><br />Sixty million euro has been stolen from bank accounts in a massive cyber bank raid after fraudsters raided dozens of financial institutions around the world.<br /><br />According to a joint report by software security firm McAfee and Guardian Analytics, more than 60 firms have suffered from what it has called an "insider level of understanding".<br /><br />"The fraudsters' objective in these attacks is to siphon large amounts from high balance accounts, hence the name chosen for this research - Operation High Roller," the report said.<br /><br />"If all of the attempted fraud campaigns were as successful as the Netherlands example we describe in this report, <b>the total attempted fraud could be as high as 2bn euro (£1.6bn)."</b><br /><br />The automated malicious software programme was discovered to use servers to process thousands of attempted thefts from both commercial firms and private individuals.<br /><br />The stolen money was then sent to so-called mule accounts in caches of a few hundreds and 100,000 euro (£80,000) at a time.<br /><br />Credit unions, large multinational banks and regional banks have all been attacked.<br /><br />Sky News defence and security editor Sam Kiley said: "It does include British financial institutions and <b>has jumped over to North America and South America.</b><br /><br />"What they have done differently from routine attacks is that they have got into the bank servers and constructed software that is automated.<br /><br />"It can get around some of the mechanisms that alert the banking system to abnormal activity."<br /><br />The details of the global fraud come just a day after the MI5 boss warned of the new cyber security threat to UK business.<br /><br />McAfee researchers have been able to track the global fraud, which still continues, across countries and continents.<br /><br />"They have identified 60 different servers, many of them in Russia, and they have identified one alone that has been used to steal 60m euro," Kiley said.<br /><br />"There are dozens of servers still grinding away at this fraud – in effect stealing money."</blockquote><br />That's all very reassuring.   Let's put all of our personal medical secrets online ASAP.  Don't worry, your information's safe and secure.<br /><br />-- SS<br /><br /><br />

Banking as the Standard Healthcare Should Look Up To On Medical Information Security?

At past posts "Don't Worry, Your Electronic Medical Records Are Getting Safer With Every Passing Day", "Another Episode of "But Don't Worry, Your Records are Safe..." and "Still More Electronic Medica…

Đọc thêm »

Don't Worry, Your Electronic Medical Records Are Getting Safer With Every Passing Day

At my Oct. 2011 post "<a href="http://hcrenewal.blogspot.com/2011/10/still-more-ehr-chaos-pandemonium-bedlam.html">Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure</a>" and others in this query link on medical record privacy, <a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy">http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy</a> I wrote:<br /><br /><blockquote><span style="font-weight: bold;">"Don't worry, your medical data's safe."<br /></span></blockquote><br />In Jan 2012 I then posted about Joseph Conn of ModernHealthcare.com's article "<a href="http://hcrenewal.blogspot.com/2012/01/2011-closes-on-note-of-electronic.html">2011 Closes on a Note of Electronic Medical Record Privacy Breach Shame</a>."<br /><br />Don't worry, though; the IT industry's leader, finance, to which medicine is always compared, has gotten closer to getting the situation under control:<br /><br />From MSNBC:<br /><span style="font-size:130%;"><br style="font-weight: bold;"><a style="font-weight: bold;" href="http://redtape.msnbc.msn.com/_news/2012/03/30/10940640-mastercard-visa-confirm-credit-card-data-theft-described-as-massive"></a></span><blockquote><span style="font-size:130%;"><a style="font-weight: bold;" href="http://redtape.msnbc.msn.com/_news/2012/03/30/10940640-mastercard-visa-confirm-credit-card-data-theft-described-as-massive">MasterCard, Visa confirm credit card data theft described as 'massive'</a></span><br />March 30, 2012<br />By Bob Sullivan<br /><br />Law enforcement officials are investigating what appears to be a massive theft of U.S. consumers' credit card data, MasterCard and Visa confirmed Friday. The computer security expert who first reported the theft said it might involve as many as <span style="font-weight: bold;">10 million MasterCard and Visa accounts</span>, making it <span style="font-weight: bold;">one of the largest known credit card heists.</span><br /><br />"MasterCard is currently investigating a potential account data compromise event of a U.S.-based entity and, as a result, we have alerted payment card issuers regarding certain MasterCard accounts that are potentially at risk," that association said in a statement. "Law enforcement has been notified of this matter and the incident is currently the subject of an ongoing forensic review by an independent data security organization."<br /><br />The theft was first reported by well-known computer security journalist Brian Krebs on his blog, KrebsonSecurity.com. Krebs said the crime involves compromise of a credit card payment processor — <span style="font-weight: bold;">a "middle man" that handles transactions between retailers and banks</span> <span style="font-weight: bold; font-style: italic;"><span style="color: rgb(255, 0, 0);">[like</span> </span><a style="font-weight: bold; font-style: italic;" href="http://hcrenewal.blogspot.com/2009/10/private-medical-records-offered-for.html">these middlemen</a><span style="font-weight: bold; font-style: italic;"> <span style="color: rgb(255, 0, 0);">in medicine? - ed.]</span></span><span style="color: rgb(255, 0, 0);"> </span><br /><br />The name of that institution is unknown, but processors have long been a target of identity thieves because of the enormous amounts of data they control. In 2008, Princeton, N.J.,-based Heartland Systems was hacked, exposing tens of millions of credit card account numbers to theft.<br /><br />Krebs reported that hackers had access to the unknown processors data from Jan 21 through Feb 25, and were able to siphon off enough data to easily create counterfeit cards. <span style="font-weight: bold;">His sources called the leak "massive."<br /><br />... </span>Gartner security expert Avivah Litan said she's been told that the stolen data is already being used on the street by identity thieves.<p>"I’ve spoken with folks in the card business who are <span style="font-weight: bold;">seeing signs of this breach mushroom.</span> Looks like the hackers have started using the stolen card data more recently," she said.</p></blockquote><br />Read the whole article at the link.<br /><br />Don't let this trouble you, however. The problem is getting closer to a solution with each mega-break in.<br /><br />They'll have it fixed any day now, so have no fear telling your EHR-equipped doctor all your private and most sensitive medical business.<br /><br />-- SS

Don't Worry, Your Electronic Medical Records Are Getting Safer With Every Passing Day

At my Oct. 2011 post "Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure" and others in this query link on medical record privac…

Đọc thêm »

Proposed new Consumer Privacy Bill of Rights: Is It Too Late For Healthcare?

From the White House:<br /><blockquote><a href="http://www.whitehouse.gov/the-press-office/2012/02/23/fact-sheet-plan-protect-privacy-internet-age-adopting-consumer-privacy-b">http://www.whitehouse.gov/the-press-office/2012/02/23/fact-sheet-plan-protect-privacy-internet-age-adopting-consumer-privacy-b</a><br /><br />The White House<br />Office of the Press Secretary<br />For Immediate Release<br />February 23, 2012<br /><br style="font-weight: bold;"><span style="font-weight: bold;">Plan to Protect Privacy in the Internet Age by Adopting a Consumer Privacy Bill of Rights</span><br /><br /><p class="rtecenter"><strong>CONSUMER PRIVACY BILL OF RIGHTS</strong></p> <p>The Consumer Privacy Bill of Rights applies to <em>personal data</em>, which means any data, including aggregations of data, that is linkable to a specific individual. Personal data may include data that is linked to a specific computer or other device. The Administration supports Federal legislation that adopts the principles of the Consumer Privacy Bill of Rights. Even without legislation, the Administration will convene multi-stakeholder processes that use these rights as a template for codes of conduct that are enforceable by the Federal Trade Commission. These elements—the Consumer Privacy Bill of Rights, codes of conduct, and strong enforcement—will increase interoperability between the U.S. consumer data privacy framework and those of our international partners.</p> <ol><li><strong>I</strong>NDIVIDUAL <strong>C</strong>ONTROL: <strong>Consumers have a right to exercise control over what personal data companies collect from them and how they use it.</strong> Companies should provide consumers appropriate control over the personal data that consumers share with others and over how companies collect, use, or disclose personal data. Companies should enable these choices by providing consumers with easily used and accessible mechanisms that reflect the scale, scope, and sensitivity of the personal data that they collect, use, or disclose, as well as the sensitivity of the uses they make of personal data. Companies should offer consumers clear and simple choices, presented at times and in ways that enable consumers to make meaningful decisions about personal data collection, use, and disclosure. Companies should offer consumers means to withdraw or limit consent that are as accessible and easily used as the methods for granting consent in the first place.</li><li><strong>T</strong>RANSPARENCY: <strong>Consumers have a right to easily understandable and accessible information about privacy and security practices.</strong> At times and in places that are most useful to enabling consumers to gain a meaningful understanding of privacy risks and the ability to exercise Individual Control, companies should provide clear descriptions of what personal data they collect, why they need the data, how they will use it, when they will delete the data or de-identify it from consumers, and whether and for what purposes they may share personal data with third parties. </li><li><strong>R</strong>ESPECT FOR <strong>C</strong>ONTEXT: <strong>Consumers have a right to expect that companies will collect, use, and disclose personal data in ways that are consistent with the context in which consumers provide the data.</strong> Companies should limit their use and disclosure of personal data to those purposes that are consistent with both the relationship that they have with consumers and the context in which consumers originally disclosed the data, unless required by law to do otherwise. If companies will use or disclose personal data for other purposes, they should provide heightened Transparency and Individual Control by disclosing these other purposes in a manner that is prominent and easily actionable by consumers at the time of data collection. If, subsequent to collection, companies decide to use or disclose personal data for purposes that are inconsistent with the context in which the data was disclosed, they must provide heightened measures of Transparency and Individual Choice. Finally, the age and familiarity with technology of consumers who engage with a company are important elements of context. Companies should fulfill the obligations under this principle in ways that are appropriate for the age and sophistication of consumers. In particular, the principles in the Consumer Privacy Bill of Rights may require greater protections for personal data obtained from children and teenagers than for adults.</li><li><strong>S</strong>ECURITY: <strong>Consumers have a right to secure and responsible handling of personal data.</strong> Companies should assess the privacy and security risks associated with their personal data practices and maintain reasonable safeguards to control risks such as loss; unauthorized access, use, destruction, or modification; and improper disclosure. </li><li><strong>A</strong>CCESS AND <strong>A</strong>CCURACY: <strong>Consumers have a right to access and correct personal data in usable formats, in a manner that is appropriate to the sensitivity of the data and the risk of adverse consequences to consumers if the data is inaccurate.</strong> Companies should use reasonable measures to ensure they maintain accurate personal data. Companies also should provide consumers with reasonable access to personal data that they collect or maintain about them, as well as the appropriate means and opportunity to correct inaccurate data or request its deletion or use limitation. Companies that handle personal data should construe this principle in a manner consistent with freedom of expression and freedom of the press. In determining what measures they may use to maintain accuracy and to provide access, correction, deletion, or suppression capabilities to consumers, companies may also consider the scale, scope, and sensitivity of the personal data that they collect or maintain and the likelihood that its use may expose consumers to financial, physical, or other material harm.</li><li><strong>F</strong>OCUSED <strong>C</strong>OLLECTION: <strong>Consumers have a right to reasonable limits on the personal data that companies collect and retain.</strong> Companies should collect only as much personal data as they need to accomplish purposes specified under the Respect for Context principle. Companies should securely dispose of or de-identify personal data once they no longer need it, unless they are under a legal obligation to do otherwise.</li><li><strong>A</strong>CCOUNTABILITY: <strong>Consumers have a right to have personal data handled by companies with appropriate measures in place to assure they adhere to the Consumer Privacy Bill of Rights.</strong> Companies should be accountable to enforcement authorities and consumers for adhering to these principles. Companies also should hold employees responsible for adhering to these principles. To achieve this end, companies should train their employees as appropriate to handle personal data consistently with these principles and regularly evaluate their performance in this regard. Where appropriate, companies should conduct full audits. Companies that disclose personal data to third parties should at a minimum ensure that the recipients are under enforceable contractual obligations to adhere to these principles, unless they are required by law to do otherwise.</li></ol></blockquote><br />For an example of some of the major problems with healthcare data, see my Oct. 2009 post "<a href="http://hcrenewal.blogspot.com/2009/10/health-it-vendors-trafficking-in.html">Health IT Vendors Trafficking in Patient Data?</a>"<br /><br />I like the proposals.<br /><br />The question is, regarding electronic health data: are these Federal proposals too little, too late?<br /><br />Complex systems such as massive computer networks (with myriad stakeholders seeking to 'game' the system, skirt the boundaries of the law, and make handsome profits) can become uncontrollable.<br /><br />-- SS

Proposed new Consumer Privacy Bill of Rights: Is It Too Late For Healthcare?

From the White House:http://www.whitehouse.gov/the-press-office/2012/02/23/fact-sheet-plan-protect-privacy-internet-age-adopting-consumer-privacy-bThe White HouseOffice of the Press SecretaryFor Immed…

Đọc thêm »

2011 Closes on a Note of Electronic Medical Record Privacy Breach Shame

At my Oct. 2011 post "<a href="http://hcrenewal.blogspot.com/2011/10/still-more-ehr-chaos-pandemonium-bedlam.html">Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure</a>" and others in this query link on medical record privacy, <a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy">http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy</a> I wrote:<br /><br /><blockquote><span style="font-weight: bold;">"Don't worry, your medical data's safe."</span></blockquote><br />Joseph Conn of ModernHealthcare.com apparently disagrees (with my sarcasm, that is) and states the obvious outright. I post his story with few comments and several emphases which are mine:<br /><br /><blockquote><span style="font-size:130%;"><a style="font-weight: bold;" href="http://www.modernhealthcare.com/article/20111222/blogs02/312229963">Year closes on a note of breach shame</a></span><br />Modern Healthcare<br />Dec. 2012<br /><br /><div style="border-width: medium; border-style: none; border-color: -moz-use-text-color; text-align: left; background-color: rgb(255, 255, 255); color: rgb(0, 0, 0); overflow: hidden; text-decoration: none;"> <p>Three-eighty. Three-eighty. Do I hear four hundred?</p> <p>With 2011 winding down, there are now <span style="font-weight: bold;">3</span><span style="font-weight: bold;">80 major data breaches involving 500 or more patients' records</span> listed on the "wall of shame" website kept by HHS' Office for Civil Rights.</p> <p>So far, from the first wall postings in September 2009 through the latest on Dec. 8 this year, there have been <span style="font-weight: bold;">18,059,831 "individuals affected,"</span> and even that massive number is an undercount of the breach problem.</p> <p>First, the <span style="font-weight: bold;">civil rights office hasn't yet released the records of tens of thousands of breaches it has received under a federal reporting mandate on breaches affecting fewer than 500 patients per incident</span>. I've been asking for electronic copies of those records since June. I hope to hear soon on an appeal of a decision last fall by HHS, claiming that the civil rights office can <a href="http://www.modernhealthcare.com/article/20111012/BLOGS02/310129999">hide those reports</a> while it "investigates" an <span style="font-weight: bold;">estimated 30,000 or more breaches</span> they describe.</p> <p>Second, even the OCR's posted numbers are low. </p> <p>A Nov. 4 public notice on a breach reported by the <a href="http://www.uclahealth.org/body.cfm?id=465">UCLA Health System</a> states that "some personal information on <span style="font-weight: bold;">16,288</span> patients" was stolen, but the wall of shame lists the "individuals affected" in the UCLA incident as <span style="font-weight: bold;">2,761.</span></p> <p>UCLA spokeswoman Dale Tate said in an e-mail that the nearly six-times-larger number in its notice "represents the number of individuals who had some information on the hard drive," while the 2,761 figure sent to the OCR "represents the number of people that met the specific criteria" under the federal breach notification rule. </p> <p>Under the federal rule, Tate says, "the information for these individuals could possibly cause more than a minimal amount of financial, reputational or other harm." Information on the rest of the individuals, Tate said, did not meet the criteria.</p> <p>Not to get too harpy, <span style="font-weight: bold;">but this breach stuff is long past being ridiculous.</span></p> <p>The lawyers are already all over it, and maybe that's what it will take for the industry to finally start addressing the problem. Brian Kabateck, a California lawyer, thinks so.</p> <p>In the past three months, his Los Angeles law firm <span style="font-weight: bold;">has filed a pair class-action breach suits against two of the most highly regarded healthcare systems in the state</span>, University of California, Los Angeles and Stanford, as well as one of the latter's business associates, Multi-Specialty Collection Services. </p> <p>"I think this is a short blip on the radar," Kabateck said. As the settlement costs pile up, he said, "I think <span style="font-weight: bold;">big institutions are going to learn</span>—<span style="font-weight: bold;">five years from now</span>, these lawsuits are going to be obsolete." </p> </div></blockquote>Class-action lawsuits are needed as much for health IT risk and safety issues causing near-misses, injuries and death as for security breaches, I note.<br /><br />I think five years is highly overoptimistic as well on the breach issue, considering the degree of "institutional learning" that's occurred on <a href="http://www.ischool.drexel.edu/faculty/ssilverstein/cases/">how to do health IT "right"</a> over the past ~ three decades, and considering that the breaches that are increasing, not decreasing, in intensity and severity across all industry sectors. That includes industry sectors far better equipped to manage IT security than hospitals.<br /><br /><blockquote>Right now, though, Kabateck says, "This is <span style="font-weight: bold;">not to the level of being an epidemic</span>, but it's close."</blockquote><br />I think it is epidemic.<br /><br />Rather than being a miracle that will revolutionize medicine, health IT is like any other information and communication technology (ICT): it has unintended consequences (UC's) that can dilute or even negate its advantages. The issue of damaged medical record privacy, confidentiality and security is but one UC of health IT.<br /><br />-- SS

2011 Closes on a Note of Electronic Medical Record Privacy Breach Shame

At my Oct. 2011 post "Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure" and others in this query link on medical record privac…

Đọc thêm »

Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure

<span style="font-weight: bold;">Case 1. Tumult</span><br /><blockquote>October 5, 2011<br />New York Times<br /><a href="http://www.nytimes.com/2011/10/06/us/stanford-hospital-patient-data-breach-is-detailed.html?_r=1">Patient Data Landed Online After a Series of Missteps</a><br /><br />By KEVIN SACK<br /><br />Private medical data for nearly 20,000 emergency room patients at California’s prestigious Stanford Hospital were exposed to public view for nearly a year<span style="font-weight: bold;"> because a billing contractor’s marketing agent sent the electronic spreadsheet to a job prospect as part of a skills test</span>, the hospital and contractors confirmed this week. The applicant then sought help by unwittingly <span style="font-weight: bold;">posting the confidential data on a tutoring Web site</span>. <span style="font-weight: bold;"><span style="font-style: italic; color: rgb(255, 0, 0);">[Got all that? - ed.]</span></span><br /><br />In an e-mail sent to a victim of the breach, the billing contractor, Joe Anthony Reyna, president of Multi-Specialty Collection Services in Los Angeles, explained that his marketing vendor, Frank Corcino, had received the data directly from Stanford Hospital, converted it to a new spreadsheet and then forwarded it to a woman he was considering for a short-term job.<br /><br />The position was with Mr. Corcino’s one-man shop, Corcino & Associates, Mr. Reyna wrote in the e-mail, which was authenticated by his lawyer, Ellyn L. Sternfield. The job applicant apparently was challenged to convert the spreadsheet — which included names, admission dates, diagnosis codes and billing charges — into a bar graph and charts, Stanford Hospital officials said.<br /><br />Not knowing that she had been given real patient data, the applicant posted it as an attachment to a request for help on <a href="http://studentoffortune.com/">studentoffortune.com</a><span style="color: rgb(255, 0, 0);"> </span><span style="font-weight: bold; font-style: italic;"><span style="color: rgb(255, 0, 0);">[I wrote about that earlier</span> <a href="http://hcrenewal.blogspot.com/2011/09/new-way-to-get-kids-interested-in.html">here</a> <span style="color: rgb(255, 0, 0);">- ed.]</span></span>, which allows students to solicit paid assistance with their work. First posted on Sept. 9, 2010, the spreadsheet remained on the site until a patient discovered it on Aug. 22 and notified Stanford. </blockquote><br />My, how electronic data can travel when mishandled. Try that trick with 20,000 paper charts ...<br /><blockquote><br />The hospital, located on the campus of Stanford University in Palo Alto, demanded that the spreadsheet be removed, and the Web site quickly complied. Pressed for time, the job prospect wound up completing the assignment herself and, in the end, did not get hired, Ms. Sternfield said. </blockquote><br />Ironically, this was all for naught.<br /><br /><blockquote>Mr. Corcino, in his first public statement, attributed the breach to “a chain of mistakes which are<span style="font-weight: bold;"> far too easy to make when handling electronic data</span>.” </blockquote><br />Far too easy to make - especially by the dyscompetent.<br /><br /><blockquote>... Breaches of private medical data have become distressingly commonplace, <span style="font-weight: bold;">with two substantial ones disclosed in the last week alone.<span style="font-style: italic; color: rgb(255, 0, 0);"> [We don't know the details of those yet; that's for next week - ed.]</span><br /></span></blockquote><span style="font-weight: bold;"><br />Case 2: Pandemonium</span> (from same NYT article)<br /><br /><blockquote>In Orlando, officials with Florida Hospital reported that three employees had improperly combed through emergency department records of 2,252 patients, apparently to forward information about accident victims to lawyers. The employees were fired, and law enforcement officials are investigating.<br /></blockquote><br />Trolling for Torts - is this a new EMR TV game contestant show? Perhaps it could be followed by "<a href="http://hcrenewal.blogspot.com/2011/02/what-was-this-medical-resident-looking.html">Trolling for Tarts?</a>"<br /><br /><br /><span style="font-weight: bold;">Case 3: Bedlam </span> (from the same NYT article)<br /><br /><blockquote>Meanwhile, Science Applications International Corporation disclosed that computer backup tapes containing medical data for <span style="font-weight: bold;">4.9 million military patients</span> <span style="font-weight: bold; font-style: italic; color: rgb(255, 0, 0);">[that number also amounts to almost 2% of the total U.S. population - ed.]</span> had been stolen from an employee’s car in San Antonio. The data included Social Security numbers, clinical notes, laboratory test results and prescriptions.<span style="font-weight: bold;"> The company said the risk of harm was low because retrieving data from the tapes would require specialized knowledge, software and hardware. <span style="font-style: italic; color: rgb(255, 0, 0);">[Who's to say the theft was not by someone with that specialization, or someone paid by same to steal the tapes? - ed.]</span></span><br /><br />The Texas breach is by far the largest since September 2009, when a new federal law began requiring disclosures of medical privacy violations involving at least 500 people. Some 330 such episodes have been tallied, <span style="font-weight: bold;">including four others that affected more than one million people each. </span></blockquote><br />We'd all be buried in stray clinical paper by now if it weren't for computers. Thank god for them!<br /><br /><blockquote>Officials at the Department of Health and Human Services said the new reporting requirements had exposed deep vulnerabilities and encouraged renewed vigilance. </blockquote><br />Exposed to whom? The blind, deaf and dumb?<br /><br /><blockquote><span style="font-weight: bold;">“We’re moving in the right direction in terms of a culture of compliance,”</span> said Leon Rodriguez, director of the department’s Office for Civil Rights, which investigates medical privacy cases. “Are there still a lot of problems out there? Yeah, my sense is there are still a lot of problems.” </blockquote><br />The Titanic was moving in the right direction - towards New York Harbor, in fact, when it met a little unexpected obstacle. Perhaps a culture of brains would be better than a culture of compliance...<br /><br /><blockquote>The Stanford breach was notable for the duration of public exposure, and for spotlighting the vulnerability created by a medical provider’s business relationships with outside parties.<br /><br />Last week, <span style="font-weight: bold;">lawyers filed suit in state court in Los Angeles, seeking certification as a class action and $20 million in damages from Stanford Hospital & Clinics and Multi-Specialty Collection Services</span>, which is known as MSCS. </blockquote><br />$20 million might hurt a bit, and might help motivate the organization to hire better and/or more appropriate clinical information management expertise - <span style="font-weight: bold;">in house where it belongs (see below)</span>.<br /><br /><blockquote>The threat of liability set off a predictable round of finger-pointing.<br /><br />In written responses to questions, Lisa Lapin, Stanford University’s assistant vice president for university communications, said, “MSCS bears the complete and sole responsibility for the breach.” </blockquote><br />It's their fault, not ours.<br /><br /><blockquote>Ms. Lapin said the hospital had sent the data in encrypted form to Mr. Corcino, <span style="font-weight: bold;">who requested it on behalf of MSCS to analyze a strategy for improving billing collections. </span>She said Mr. Corcino had regularly represented himself as MSCS’s executive vice president and had been Stanford’s “primary contact” during a seven-year relationship. <span style="font-weight: bold;">MSCS, a five-person firm that audits hospital accounts to maximize reimbursement</span>, possessed the passwords to unencrypt the data, she said.<br /></blockquote><br />It was all about money and outsourcing.<br /><br /><blockquote>“This mishandling of private patient information was in complete contravention of the law and of the requirements of MSCS’s contract and is shockingly irresponsible,” the hospital said in a statement. </blockquote><br />It is foolish to believe that someone else can run critical aspects of your business, and it is even more foolish to believe that it is OK for someone else to run critical aspects of your business.<br /><br /><blockquote>Ms. Sternfield, Mr. Reyna’s lawyer, said Mr. Corcino had never been an MSCS employee, but rather was paid a monthly fee to drum up business, typically in face-to-face meetings with health care executives. Mr. Reyna, she said, had no knowledge that the Stanford data had been sent to Mr. Corcino, or that he had passed it on.<br /><br />Mr. Corcino was not authorized to use an MSCS title, Ms. Sternfield said, but she declined to say whether Mr. Reyna was aware of the practice. She acknowledged that Mr. Corcino sometimes used an MSCS e-mail account.<br /><br />In his e-mail to the breach victim, who shared it with The Times, Mr. Reyna wrote that Stanford had sent the file to Mr. Corcino “for a potential MSCS project that would audit paid accounts to verify that the reimbursement was correct.”<br /><br />For his part, Mr. Corcino said in a statement that he was an independent contractor but was “the marketing face of the company,” and that MSCS “allowed me to use the title of executive vice president.” He wrote: “Stanford sent the file to me at MSCS, and I imported the data into a spreadsheet that was forwarded to the job applicant as part of a skills test. I did not intend to provide any personal health information in the file. This was a marketing project.”<br /><br />Without explaining how or why he sent the data to the applicant, Mr. Corcino said MSCS had not trained him properly and faulted Stanford for sending him private information that he did not need. That, he said, was the “first link in a chain of mistakes.”<br /><br />“I regret that Stanford released a file containing unnecessary information,” Mr. Corcino said, “that MSCS did not have an appropriate training and audit system for the handling of electronic data and that I was not more careful with the file. While Stanford and MSCS left the information in the file I received, it was my mistake to not catch its inclusion and remove the data.” ... The hospital has terminated its relationship with MSCS, and Mr. Reyna has done the same with Mr. Corcino. </blockquote><br />Even I can't follow all that. This will be one convoluted court case...<br /><br /><blockquote>Stanford Hospital has reassured affected patients that the posted spreadsheet did not contain Social Security numbers, birthdates or credit card numbers, and has offered free identity theft protection services. <span style="font-weight: bold;">The hospital said it had not uncovered any misuse of the exposed data. </span></blockquote><br />Yet, that is. (Is it no wonder that sedatives are among the most highly-prescribed medications?)<br /><br />Moving from the NYT article:<br /><br /><span style="font-weight: bold;">Case 4: Tumult</span> (I'm running out of descriptors)<br /><br /><a href="http://newsandinsight.thomsonreuters.com/California/News/2011/06_-_June/Health_Net%E2%80%99s,_IBM%E2%80%99s_negligence_compromised_medical_data,_suit_says/"></a><blockquote><a href="http://newsandinsight.thomsonreuters.com/California/News/2011/06_-_June/Health_Net%E2%80%99s,_IBM%E2%80%99s_negligence_compromised_medical_data,_suit_says/">A large class action lawsuit again Health Net and IBM</a>:<br /><br />California Legal<br />Westlaw Journal Insurance Coverage<br /><br /><span style="font-weight: bold;">Health Net’s, IBM’s negligence compromised medical data, suit says</span><br /><br />June 7 (Westlaw Journals) - Health Net Inc. and IBM face a class-action lawsuit seeking $5 million in damages over the loss of computer storage devices that held the medical histories, financial data and Social Security numbers of 2 million people.<br /><br />Health Net Policyholder Alana Bournas’ class-action complaint in the U.S. District Court for the Eastern District of California alleges that the insurer and IBM breached their duty of confidentiality and negligently allowed the release of highly personal and confidential information of millions of Health Net employees and policyholders.<br /><br />The complaint alleges violation of California’s Confidentiality of Medical Information Act, Cal. Civ. Code § 56; Cal. Civ. Code § 1798.2, which concerns the unauthorized disclosure of customer records; Cal. Bus. & Prof. Code § 17200, the state’s unfair-competition law; and public disclosure of private facts.<br /></blockquote><br />Companies will either pay the going price for competent employees, or pay for the mistakes of incompetent ones. It would probably be better for society, however, to do the former habitually.<br /><br /><blockquote>The suit says IBM agreed to manage Health Net’s information technology database for five years beginning in 2008.<br /><br />IBM informed Health Net Jan. 21 that it had lost nine disk drives containing the confidential information of 2 million people, including Health Net policyholders and employees.<br /><br />Health Net failed to alert the victims of the breach until March 14, the complaint says.<br /><br /><span style="font-weight: bold;">IBM allegedly also failed to encrypt the data</span>, thereby enabling anyone who possesses the hard drives to easily access the confidential information. This puts the victims at an increased risk of identity theft and “other unauthorized uses of plaintiff and class members’ personal information” the suit says.<br /></blockquote><br />Encryption, a feature now built into mainstream OS's by Microsoft and Apple? (Oh wait...IBM...)<br /><blockquote><br />Health Net’s attempt to compensate the victims by providing two years of free credit monitoring services through TransUnion is an inadequate remedy for the defendant’s conduct, Bournas says. This “remedy”<span style="font-weight: bold;"> fails to address unauthorized disclosures of medical information, and the monitoring services only protect against new account fraud but do not address fraudulent activity with existing accounts</span>, the suit says.</blockquote><br />These executives apparently can't even get the fix straight.<br /><br /><blockquote>Moreover, the complaint says, <span style="font-weight: bold;">Health Net has previously been accused of a similar breach of confidential information. In 2009 it lost the same types of records of nearly 1.5 million people</span> and waited six months before notifying the victims. In settling the state of Connecticut’s lawsuit stemming from that security breach, the company promised “<span style="font-weight: bold;">to enhance security procedures and training,”</span> the suit says.<br /></blockquote><br />What can I say?<br /><br /><blockquote>The current breach could have been avoided had Health Net and IBM taken proper precautions and implemented security policies to maintain consumers’ confidential data, according to Bournas. Therefore, the protections granted under California law require that Health Net be penalized for its negligence, she says.<br /><br />The plaintiff notes that millions of people entrusted Health Net with their private data.<br /><br />“At best, defendants’ actions allowed this private information to go astray. At worst, the private information is being viewed, sold, resold, and used for illegitimate and illegal purposes,” the complaint says.<br /><br />The suit is seeking injunctive relief, compensatory damages, declaratory relief, and attorney fees and costs.<br /><br />Bournas v. Health Net Inc., No. 2_11-CV-01262, complaint filed (E.D. Cal. May 11, 2011).</blockquote><br />I would revise that to say "The current breach could have been avoided had Health Net and IBM hired personnel in adequate numbers with the qualifications and true gravitas (and not laid them off, of course) to maintain consumers’ confidential data."<br /><br /><span style="font-weight: bold;">Case 5: Maelstrom</span> (I am reaching to the bottom of the barrel for such descriptors).<br /><br /><a href="http://www.ama-assn.org/amednews/2011/08/01/bisc0801.htm"></a><blockquote><a href="http://www.ama-assn.org/amednews/2011/08/01/bisc0801.htm">Wellpoint recently settled class-action suit in CA</a>.<br /><br />AMA news<br />By Pamela Lewis Dolan, amednews staff.<br />Posted Aug. 1, 2011.<br /><br />WellPoint reaches tentative accord in data breach suit<br /><br />It is the second settlement to come from lawsuits claiming that the company failed to protect the privacy of individual insurance applicants online.<br /><br />WellPoint has reached a preliminary settlement that will, if approved, bring an end to a class-action lawsuit filed more than a year ago.<br /><br />The lawsuit, filed in the Superior Court of the State of California, involves the potential exposure of data belonging to more than 600,000 individual health insurance applicants on a company-run website that allowed insurance applicants to track their applications.<br /><br />The situation came to light when an applicant to WellPoint-owned Anthem Blue Cross of California sued the company in March 2010. <span style="font-weight: bold;">T</span><span style="font-weight: bold;">he applicant was able to manipulate the web address within the site to gain access to other applicants' information, including names, addresses, dates of birth, Social Security numbers and health and financial information.</span><br /></blockquote><br />In other words, probably changing a simple number in the URL brought up someone else's records. Good going there, Wellpoint. What were the programmers thinking? (Were they thinking?)<br /><br /><blockquote>When the suit was filed, the company said an upgrade to the system caused the information to become exposed.<span style="font-weight: bold;"> The company said a third-party vendor validated that all security measures were in place when, in fact, they were not.</span> Changes were made to the system soon after the situation was discovered.</blockquote><br />Blame someone else, yet again.<br /><br /><blockquote>In addition to the class-action suit, the company was sued by Indiana Attorney General Greg Zoeller in July 2010. The suit, filed in Marion County Civil Superior Court, alleged that the company violated the Indiana Disclosure of Security Breach Act by failing to notify Zoeller, and the 32,051 Indiana residents affected by the incident, in a timely manner. That suit was settled in early July, when WellPoint agreed to pay a $100,000 fine. As part of the settlement, <span style="font-weight: bold;">WellPoint admitted it had a security breach and failed to properly notify the attorney general's office as required by law.</span></blockquote><br /><a href="http://www.urbandictionary.com/define.php?term=oy%20gevalt">Gevalt</a>.<br /><blockquote><br />Under the preliminary settlement in the California class-action matter, WellPoint agreed to offer credit monitoring for two years to all affected individuals. Class members are eligible to receive reimbursement for identity theft losses of up to $50,000 per incident, as well as additional time to file identity theft claims until May 31, 2016. Those making identity theft claims are eligible for an additional five years of credit monitoring. The company also will donate a total of $250,000 to two nonprofit organizations whose efforts are directed at protecting consumers' privacy on the Internet.</blockquote><br />It might have been cheaper and better for goodwill not to outsource a vital function...those third-party vendors can really hurt you. (I'd really like to know - was this "third party vendor" domestic, or overseas?)<br /><br /><blockquote>WellPoint <span style="font-weight: bold;">did not admit wrongdoing in the case, nor was it found guilty. </span>A fairness hearing is scheduled for November, and the courts then will decide whether to approve the settlement.</blockquote><br />Large corporations are immune from such formalities as admitting wrongdoing or being found guilty.<br /><br />-----------------------<br /><br /><span style="font-weight: bold;">But don't worry. <a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy">Your medical data's safe.</a></span><br /><br />Sort of. See also:<br /><br /><ul><li>"<a href="http://hcrenewal.blogspot.com/2010/02/networked-emrs-and-healthcare.html">Networked EMR's and Healthcare Information Security: Practical When Massive IT Security Breaches Continue</a>?",</li></ul><ul><li>"<a href="http://hcrenewal.blogspot.com/2010/02/networked-interoperable-secure-national.html">Networked, Interoperable, Secure National Medical Records a Castle in the Sky?</a>",</li></ul><ul><li>"<a href="http://hcrenewal.blogspot.com/2010/01/it-flaws-and-coverups-of-same-why-i.html">Operation Aurora And a Widespread Reluctance to Discuss IT Flaws: Is Universal Healthcare IT Really a Good Idea in 2010?</a>",</li></ul><ul><li>"<a href="http://hcrenewal.blogspot.com/2010/10/medical-data-breach-of-week-but-your.html">Medical data breach of the week - but your EMR data is secure, trust us, we're IT experts</a>", </li></ul><ul><li>"<a href="http://hcrenewal.blogspot.com/2010/11/insurers-test-data-profiles-to-identify.html">Insurers Test Data Profiles to Identify Risky Clients</a>",</li></ul><ul><li>and <a href="http://hcrenewal.blogspot.com/search/label/medical%20record%20confidentiality">others</a></li></ul><br />-- SS

Still More Electronic Medical Data Chaos, Pandemonium, Bedlam, Tumult and Maelstrom: But Don't Worry, Your Data is Secure

Case 1. TumultOctober 5, 2011New York TimesPatient Data Landed Online After a Series of MisstepsBy KEVIN SACKPrivate medical data for nearly 20,000 emergency room patients at California’s prestigious…

Đọc thêm »