Hacking the US Prescription System 78
An anonymous reader writes: It appears that most pharmacies in the US are interconnected, and a breach in one leads to access to the other ones. A security advisory released [Friday] shows how a vulnerability in an online pharmacy granted access to prescription history for any US person with just their name and date of birth.
From the description linked above: During the signup process, PillPack.com prompts users for their
identifying information. In the end of the signup rocess, the user is
shown a list of their existing prescriptions in all other pharmacies
in order to make the process of transferring them to PillPack.com easier.
... To replicate this issue, an attacker would be directed to the
PillPack.com website and choose the signup option. As long as the full
name and the date of birth entered during signup match the target, the
attacker will gain access to the target's full prescription history.
Sharing Is Caring! (Score:1)
Sharing Is Caring!
Not exactly a hack (Score:1)
So you enter someone's name and date of birth on this website, and it gives you all the details? How exactly is this a hack? If I asked the president of the US for the nuclear launch codes, just for laughs, and to my great surprise he would simply give them to me, would I have "hacked" the US nuclear missile system? Would I be thrown in jail for hacking?
This is just plain irresponsible behaviour by PillPack, nothing to do with hacking.
Re: (Score:2)
I just went to check it out, and actually the site also requires the last 4 digits of your social security number as well as name and date of birth.
Re:Not exactly a hack (Score:5, Informative)
This is just plain irresponsible behaviour by PillPack, nothing to do with hacking.
No, this is just plain irresponsible behavior by those who share infomation to PillPack and others.
Recently, I noticed that when I picked up a prescription for a (for me new) medication that's mostly used for one purpose, I suddenly got dozens of spam e-mails wanting to "help" me with a particular diagnosis I don't have. And that's the few that went through the double layer spam filter. It was way too pervasive to be a coincidence.
It's clear that the US prescription system leaks like a sieve, and that even spammers have access to people's prescription history.
Can we go back to paper prescriptions that don't enter a database, please?
Re: (Score:3, Funny)
Dude, I get spam for Viagra every day.
Re: (Score:3)
I've been taking moderately special purpose meds off and on for years (the sorts of things you take when you have a bone marrow transplant).
I have NEVER gotten any spam emails
Re: (Score:2)
They know about your medication (see above).
What they may lack is the matching email address to your name?
Re:Not exactly a hack (Score:5, Interesting)
They know about my meds because I pretty much have to tell someone to get the prescription filled.
They know my email address since the same people I go to to get the prescription filled have my email address so they can send me reminders that my refills are due.
So, the pharmacy has my prescription history going way back (what, you think I change pharmacies every time I get a new prescription) and my email address. And I still have never gotten any spam advertising drugs.
Note that drug advertising to me wouldn't actually do any good, since I'm not an MD, and am incapable of prescribing drugs to myself (or anyone else). That sort of thing is best aimed at doctors and hypochondriacs (the kind who will nag their doctors about the new drugs they see on TV that sound like they'd be PERFECT for their problems)....
Re: (Score:2)
The 'they' in my post referred to the spammers, not your pharmacy.
I doubt those are the same people.
As mentioned in other comments already, do not assume that the spammers get their information directly from that database, or that the email you entered is even saved together with you medical information (why would it?).
Most likely the pharmacy saves your contact info in their own customer database, which they hopefuly dont share.
Re: (Score:2)
Most likely the pharmacy saves your contact info in their own customer database, which they hopefuly dont share.
Until a partner pays them enough for it, or a rogue employee finds a buyer....
Re: (Score:2)
I've been taking moderately special purpose meds off and on for years (the sorts of things you take when you have a bone marrow transplant).
I have NEVER gotten any spam emails as a result (unless you count that "you really need to refill your prescription since you're about to run out of pills, you dolt!" sort that I get as a reminder from the drugstore)....
I don't know if it's the cause here, but if you Google for something, obviously Google's entire value model is to sell that info to advertisers. Likewise if you send or receive gmail about something. Then there's also looking it up on WebMD or another site to find the side effects. I would be a lot more suspicious of online activity "leaking" to spammers than a pharmacy selling it.
Re: (Score:3)
For that matter can we please go back to paper medical records too? How long will it be before all our medical histories become public knowledge?
While in theory, EMR's can do a lot of good by providing any doctor instant critical info but in the current big-data low security environment, no.
Re: (Score:2)
While in theory, EMR's can do a lot of good by providing any doctor instant critical info
That's not just a theory, it's a fact. EMRs aren't perfect but they're getting better, and the security issue will be addressed.
That said, my wife and I both have gotten prescriptions for things that would be obvious if that information was leaked to a spammer, but it hasn't happened.
Re: (Score:2)
EMRs aren't perfect but they're getting better, and the security issue will be addressed.
And the check is in the mail.
Re: (Score:2)
How long will it be before all our medical histories become public knowledge?
Well, I think there are two important things to note here: first, IANAL but sharing this data between pharmacies without any patient input would appear to be a blatant violation of HIPAA regulations. Second, my state's prescription database is very definitely NOT supposed to be connected to any Federal database. That would be a violation of State law.
Re: (Score:2)
It's all pretty ridiculous, anyway. Doctors ask like they give you 30 pills instead of 100 (which might cost the same under a particular pharmacy generic program) they are protecting you, like they don't trust you, the patient. But they do trust
Re: (Score:2)
I heard where pharmacies are sharing prescription data with each other and with doctors to stop people from going from doctor to doctor to get more meds. More prescriptions than any one doctor would let one patient have. It might be required by law in my state.
We have a state pharmacy database which does that. However, the data is not supposed to be commercially available, AND it most definitely is not supposed to be hooked up to any kind of Federal system.
Re:Not exactly a hack (Score:4, Interesting)
Your pharmacist has sold your prescription data [medicalnewsinc.com] to some shady third party for advertising purposes. Somehow they managed to loophole that out of HIPAA - it's a 'service' for your own good - or something along those hallucinatory lines.
Supposedly you can opt out but you first have to know if you got opted in.
I'm actually surprised that this hasn't generated much flack, but there are so many things to get angsted at I think that most people are just overwhelmed. Personally, I ran out of extra angst a long time ago.
Re: (Score:1)
According to your prescription history, you haven't filled your proangst-xl in over a year. No wonder your are feeling low on angst.
Re: (Score:1, Informative)
Can we go back to paper prescriptions that don't enter a database, please?
Convince your rep, senators, and Obama to get rid of the ACA (Obamacare) because the ACA mandates all electronic records.
Assumptions (Score:5, Informative)
From TFA, regarding a persons prescription history, it says
It is assumed that this information comes from the various backend systems that interlink the pharmacies as described above.
I doubt it. I think it is far more likely that the pharmacy sells this information to insurance, pharmaceutical, and marketing companies. Big data is big business these days. So long patient confidentiality.
That being said, it is unconscionable how lax PillPack.com security procedures were.
Re:Assumptions (Score:5, Interesting)
> I think it is far more likely that the pharmacy sells this information to insurance, pharmaceutical, and marketing companies.
This. Pretty much every prescription the doctor writes effectively goes straight to the drug reps. If you stop prescribing, they'll know, and come in and bribe^H^H^H^Hinquire as to why you stopped prescribing their drug.
Re:Assumptions (Score:5, Informative)
Very pleased we have a different system in the UK. Drug reps aren't even supposed to give us pens anymore. That said I've had plenty of free lunches from drug reps along with a presentation about their latest drug, but I'm not talking about fancy dinners just a light picnic type spread from the nearest supermarket. There isn't much point them doing it anyway, as a general rule we are only supposed to prescribe things that are approved by NICE (after proper cost/benefit analysis) and/or in our local formulary. If you are prescribing outside that they'll be coming to you for an explanation, not the drug companies. Drug companies are also not allowed to advertise prescription only drugs direct to the public, which I think is probably the most important difference.
Re: (Score:2)
That, plus we have data protection laws that prevent patients from being identified by the companies that make the prescription drugs. For sure there are reports that state how many use drug X, but that's aggregated data.
Re:Assumptions (Score:4, Informative)
The US has protection that prevents patients from being identified by the companies that make the drugs. There is no federal law preventing DOCTORS from being identified as prescribing a drug. Maine, New Hampshire, and Vermont have laws to further limit this practice.
Re: (Score:2)
Meanwhile, our own data protection laws protect pharma companies from the threat of competition, even by individual patients shopping around for better prices.
My insurance company requires buying meds through their contracted online pharmacy. So while any hacker might be able to access my prescription history with just a birthdate, I have to go on vacation with half my prescribed supply of pills because the system makes me wait "until it's time" before I can order a refill.
Re: (Score:1, Insightful)
So HIPAA is basically bullshit then.
Re: (Score:1)
Re: (Score:2)
Bullshit. I'm the IT guy for a chain of independent pharmacies and know this is a categorically false statement. Like many others it is part of the mythology surrounding the healthcare "crisis".
You. I have friends who are drug reps and the days of "spend whatever it take stop keep the docs happy" and getting called on the carpet for "not spending enough" are long gone. The reps are probably healthier though, because it means no more late nights at strip clubs or eating lavish meals every night.
Re: (Score:2)
Re: (Score:2)
I have never signed anything when filling a prescription.
Re: (Score:2)
milliman.com
I was entitled to a report of their data.
I got it, with a FCRA Summary.pdf document, since this falls under the fair credit reporting act.
They got it from my previous health insurance company. You know, they have that 17 page fine print clickthrough agreement that no one can read.
I applied for health insurance, and a nurse from the company I applied to called me and discussed everything ad nauseum, u
Re: (Score:2)
This. Pretty much every prescription the doctor writes effectively goes straight to the drug reps. If you stop prescribing, they'll know, and come in and bribe^H^H^H^Hinquire as to why you stopped prescribing their drug.
Exactly this. I've been present while a drug rep was discussing with the pharmacist how much of each of his company's drugs local doctors have been prescribing.
Re: (Score:2, Informative)
They don't sell this information. Instead, the states have set up prescription monitoring programs (PMP) to prevent drug abuse through doctor shopping. Pharmacies are required submit information about the filled prescription for Schedule II, III, or IV drugs. Some states also allow the pharmacist to consult the PMP for recent prescription history to prevent filling duplicate orders. Hospitals and doctors that directly administer these controlled drugs are normally exempt from reporting to the PMP. The data
Re: (Score:3)
So, the pharmacies are selling information on your prescription drugs to...your insurance company?
You remember your insurance company - they're the ones who are paying for your prescription drugs. If the pharmacies are selling your drug information to your insurance companies, the pharmacies have one of the greatest rackets in history - they're managing to sell information that is REQUIRED FOR BILLING to the people paying t
Re: (Score:1)
I work in the pharmacy industry. It isn't the pharmacy selling the data it is the PBM and insurance companies selling the data. Your personal health information is ALWAYS for sale by insurance companies. The PBM (Pharmacy Benefit Manager) is supposedly a neutral 3rd party link between the pharmacy and the insurance company but they have enormous power and profits (from selling your data, among other things).
It sucks and it will only get worse.
Re: (Score:2)
When they get it fixed, they will be Ex-Lax®.
Re: (Score:3)
Re: (Score:3)
I doubt it. I think it is far more likely that the pharmacy sells this information to insurance, pharmaceutical, and marketing companies. Big data is big business these days. So long patient confidentiality.
Definitely not. Pharmacies and PBMs are prohibited from selling patient health information. PBMs sell aggregated information to pharma companies, so they can understand the drug trends in an area. They sell doctor-identified data as well. This is a pretty good summary of the data that PBMs and pharmacies can and cannot sell [privacyrights.org]
I suspect that this was information retrieved by the ePrescribe network. The NCPDP SCRIPT standard defines a transaction to retrieve a prescription history. The standard is not public
Re:Assumptions (Score:4, Interesting)
I'll allow that I may be wrong. I don't know; it's never happened before so I don't know what it feels like :P
I note in the excellent link you provided under the section of data mining it says
Data miners buy prescription information from pharmacies and PBMs.
Apparently, data identifying a specific person is removed "sufficient to remove the data from the protection of the CMIA and HIPAA", and the records are assigned a number.
Further,
Prescription data miners have the ability to re-identify individual data based on the number assigned to it, and they operate separately from the entities - health care providers, health plans, health care clearinghouses, and their contractors or business associates - that do have legal obligations.
I don't think it too far-fetched to think this happening, particularly since I started seeing a lot of targeted ads for asthma medications not long after coming down with respiratory difficulties last year. Somebody's doing something shady, I'll bet.
Re: (Score:2)
Is it?
I just signed up. Did the full name, current address, DoB, and (missing from TFS) last four of my SSN.
It found no prescriptions for me at all.
Re: (Score:2)
Exactly.
First off - is a full name and DOB a unique enough identifier? For something as vital as a prescription, it doesn't seem like it. I would presume for patients, there's a real unique identifier involved for electro
secrets (Score:2)
Jolly good.. Now the name + the birthday is the secret needed to unlock any identity fraud? Not even including social security (which wasn't secret either)?
Re: (Score:2)
If the US healthcare system were to embrace capitalism, it would be a big improvement over the fourteenth-century guild feudalism we have now.
What about hacking the system for drugs? (Score:2)
I always thought we'd hear about the prescription system hacked for drugs, not for personal information.
There's a ton of pharmacies out there, how do "they" know where to send shipments? How do "they" verify that a shipment is going to an actual pharmacy and not a shell entity, especially if its CVS store #1887?
What about actual prescriptions? Many are electronically transmitted to the pharmacy. The schedule II ones (at least when I've been given oxycodone) are printed on paper, but how is that data cor
HIPPA (Score:5, Informative)
would seem that this would be a violation of HIPPA security rules, assume pharmacies are covered entities, which I think they are. Specifically, covered entities must maintain adequate:
Administrative Safeguards
Security Management Process. As explained in the previous section, a covered entity must identify and analyze potential risks to e-PHI, and it must implement security measures that reduce risks and vulnerabilities to a reasonable and appropriate level.
Technical Safeguards
Access Control. A covered entity must implement technical policies and procedures that allow only authorized persons to access electronic protected health information (e-PHI).
It would seem simply allowing access via a name and birthdate is a violation of the above requirements.
Source: http://www.hhs.gov/ocr/privacy... [hhs.gov]
Re: (Score:1)
They aren't violating HiPPA - their HiPPA form explains in detail who they can release your information to, and why. They also list in their privacy policy that they can and will use your information to make their product better and can release your information to third parties. So j
Re: (Score:3)
Re: (Score:2)
> They aren't violating HiPPA
HIPAA: Health Insurance Portability and Accountability Act
Re: (Score:2)
HIPAA: Health Insurance Portability and Accountability Act
Whose mascot was the purple 'HIPAA Hippo'.
Copays? How about cash price? (Score:3)
When you try to get a prescription filled in a pharmacy they take your ID and insurance card and send that off to your insurance company. If you have a prescription for something simple and cheap like penicillin that cost say $3 the conversation looks something like this:
Pharmacy (to insurance co): Joe Sucker gave me a $25 co pay card for penicillin.
InsCo: Tell him that it is $30 and you now owe us $22.
Pharmacy to Joe: You owe us $25.
If Joe had asked cash price, the conversation would have been:
Pharmacy (to Joe): That will be $3.
Joe: But I have a $25 co pay
Pharmacy: Do you want to pay $3 or $25?
Re: (Score:2)
What in the actual fuck are you doing on the internet?
You have the worst pharmacy, worst insurance, or worst information. And not changing at least one of those suggests inferior decision making skills. So since you can't determine this yourself, go fix things and then have a probationary try at being online again.
I could paste my prescription history, available for tax reasons, but you would claim I made it up. So just stop.