Slashdot Log In
Medical Data on 365,000 Patients Stolen
Posted by
CowboyNeal
on Thu Jan 26, 2006 10:26 PM
from the bandwidth-and-station-wagons dept.
from the bandwidth-and-station-wagons dept.
Anonymous writes "Backup tapes and disks with data on 365,000 patients were stolen out of the car of a worker at a healthcare company in Portland. According to this Computerworld story, the tapes were in his car because he took them home as part of a disaster recovery plan, to protect the information from fire and other on-site disasters. D'oh!"
This discussion has been archived.
No new comments can be posted.
Medical Data on 365,000 Patients Stolen
|
Log In/Create an Account
| Top
| 226 comments
(Spill at 50!) | Index Only
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
What's the problem (Score:5, Funny)
Well, the question is ... (Score:5, Insightful)
Re:Well, the question is ... (Score:4, Funny)
Hehe (Score:5, Funny)
(http://www.rabbitears.info/)
The further story (Score:5, Informative)
(http://www.celsius1414.com/)
The data on the tapes was encrypted, Walker said. The data on the disks was in a proprietary file format that was not encrypted, but "is stored in a way that would make it difficult, if not impossible, for someone to access it, then make any sense out of it," he said.
So not as bad as the summary seemed to indicate, but still not the greatest thing to have happen.
Especially if that proprietary file format "difficulty" is just the fact that the files are in some old version of Word.
Much worse! Data really on disks! (Score:5, Insightful)
In an announcement yesterday, Providence Home Services, a division of Seattle-based Providence Health Systems, said the records and other data were on several disks and tapes stolen from the car of a Providence employee at his home. The incident was reported by the employee on Dec. 31, according to the health care system.
The data on the tapes was encrypted, Walker said. The data on the disks was in a proprietary file format that was not encrypted, but "is stored in a way that would make it difficult, if not impossible, for someone to access it, then make any sense out of it," he said.
So think about it - Tapes AND Disks were stolen (at first I had thought it was just tapes). The hard to read media (tapes) were encrypted. But it doesn't matter, chuck 'em in the river because the DISKS (fasr easier to read by any fool with a computer) have data that is in a format that is just "hard to read"!!
Give me five minutes with Emacs and/or a Hex editor and/or Strings and I'll bet I could start churning SSN's out of the files right quick! I don't care if they are ISAM or DB2 or Pig-Latin! Security by file format obscurity is zero security, that data has to be treated as widely known at this point.
And that's why... (Score:5, Informative)
(http://altgrendel.exit0.us/)
Oh, and make sure the vault they keep them in is a)real and b) really able to withstand ANY disaster.
Next week... (Score:3, Funny)
hmmm (Score:4, Interesting)
(http://www.rwven.com/ | Last Journal: Monday January 23 2006, @02:52PM)
And storing the tapes in your car? What happens if it's 100 degrees outside?
Where i work, they make the backup copies and have someone drive them to one of the other branches at the company. They make a backup every day and keep seven days worth of backup in rotation so if something went wrong 6 days ago and they backed up the problem every day, they ahve the 7th backup left to work with...
Unfortunatley i don't know what their view on encrypting the data is. With as anal retentive as the IT VP is about security though, i can't imagine they wouldn't be encrypted...
Hard to believe this mistake (Score:3, Informative)
Is it really theft? (Score:5, Interesting)
I can see hard disks being stolen..... but not tapes in the one case. Thieves like to take items with obvious value. Am I missing something here? Isn't it possible the workers simply sold the data?
OK (Score:3, Insightful)
Thanks, buddy! (Score:3, Funny)
Partially encrypted (Score:5, Interesting)
For much the same reasons cited here our company backups are taken offsite (daily) -- only difference is that instead of tapes and disks we found that for speed, volume, and cost it was better to go with external hard drives (I figured this out almost ten years ago myself
Even though we are a small organization (under a few hundred employees) the data is encrypted. That was step one and one of the most important IMHO. The average Joe who finds / steals any of our external drives (which has never happened thankfully) would be hard pressed to even figure out the filesystem (Ext3). Not that that would really slow down anybody who knows what they're doing -- nor was it done for security (I just like / trust Linux
Of course I can think of other problem areas where data is flying around unencrypted and sensitive. The Department of Employment Security (which many states all report to for and through payroll to track dead beat dads) takes their data with your social security number in a plain ASCII text file sent through the US mail on a floppy. What happens when you lose a floppy, or what do they do with the processed disks?
Fortunately and unfortunately we need and there will be laws requiring any such sensitive information to be encrypted for "National Security" (Big Brother [tm]) reasons. It's only a matter of time. It is unfortunate that it will take a law and more bureaucratic BS to make this happen, it is fortunate for all our privacy and the fact someone has to program this (more work for me
I Live In Fear of This (Score:5, Interesting)
Let's review here: we have a fake DR strategy which adds an hour to every file restore and exposes us to data theft. Sounds good huh? I have repeatedly told our brass it would be better to do nothing, but their position is "We don't want to tell the newspapers we had no DR strategy when the disaster strikes."
How do we remediate this? Well, we could encrypt the tape but that is a big pain in the ass and has its own disadvantages. Really, the answer is to get off our ass and build a DR data center so the potentially deadly placebo goes away.
In other news... (Score:5, Funny)
(http://www.davidsterry.com/)
My take... (Score:5, Informative)
(http://flux73.blogspot.com/)
First of all, while it may shock many IT people that hospitals would use such rudimentary forms of backup and with little encryption, you have to understand that the state of IT in the medical world is backwards. Very backwards. There are a variety of reasons for this. One is that information systems are designed by IT people with little to no understanding of how the healthcare system works (which is understandable - many people in healthcare have little understanding of how it works). At the same time, you have healthcare professionals who really don't understand the full potential of how IT can be applied to healthcare or what its limitations are, but at the same time will complain about solutions that the IT world comes up with. There's this chasm between the two worlds and what you end up getting is a solution that no one likes and you end up having to go back to the drawing board over and over and over. It is absolutely amazing how much money gets sunk into medical IT and how very little progress it has made.
Another reasons includes the vast amounts of red tape in the medical world that are MEANT to prevent lawsuits and provide the best quality healthcare. But there's so much that it what it really ends up doing is bringing any kind of progress or new idea to a grinding halt. There is no industry I can think of which is so ill adapted to making changes even when they're necessary or make sense. The legal world has the medical world frozen in fear of the next litigation. The result is a paradoxical decrease in healthcare quality and increased costs.
Medical information privacy is one of those issues that seems to always be #1 on the list of concerns of electronic medical records. This has always been rather strange to me. How many people are really all that concerned with someone knowing about their cold, or their broken leg? Most people don't have much they would really care about hiding in their medical records. Of course, there are the people with mental illness, HIV, or sexually transmitted diseases. But even then, what exactly is this thief going to do with that information? IMHO medical information privacy is more of a theoretical concern than a real-life concern.
And then of course, there's the REAL reason people are considered with medical information being digitized identity theft for money reasons. I really blame the credit card industry for this more than anyone else. It's surprising to me that they could simply issue a credit card if someone just writes down a name, social security number and address. In this day and age with inexpensive biometric security systems, one would think they could require a submission of a fingerprint (or two). Hell, nowadays with branch offices literally EVERYWHERE, they could simply request you come in with your driver's license. It seems to me that it would be in a bank's best financial interests to do something like this.
Just my $0.02.
Re:My take... (Score:5, Interesting)
Many people are vulnerable to blackmail about sensitive aspects of their medical records, including--but hardly limited to--sexual and mental health. Similarly, people may avoid seeking medical advice for such conditions if they fear that they cannot speak in confidence. And large networked databases simultaneously increase the value of the data to malicious users (more chance of finding something interesting) and the opportunities for access.
Of course, the major threats are all internal, not external -- malicious insiders.