DataBreaches.Net

Menu
  • About
  • Breach Notification Laws
  • Privacy Policy
  • Transparency Report
Menu

Security Breach: More Laws Needed. Let's Add Health Care

Posted on August 27, 2008 by Dissent

Over on InformationWeek, George Hulme is singing our tune:

[…]

But let’s just stick to health care. More than 1.5 million patient records at hospitals have been exposed by data breaches during 2006 and 2007, according to the 2008 HIMSS Analytics Report: Security of Patient Data, commissioned by Kroll Fraud Solutions. That begs the question: is the healthcare industry doing enough to protect the privacy of medical records?

The symptoms point to a diagnosis of no. According to the HIMSS report, those 1.5 million data leak victims don’t include breaches at other healthcare companies, home care providers, physician offices, or pharmaceutical companies. So this report is likely only giving us a peak at a sliver of the problem.

If that doesn’t send your blood pressure up, consider this: the hospitals surveyed are probably only aware of a small percentage of how many patients have been affected by lax hospital security, as only about 44 percent of hospitals that suffered a breach failed to let the patients know their records could be at risk to snoops.

Even more disturbing is what the hospitals didn’t say: all of the hospitals that disclosed being breached mostly cited unauthorized use of information and wrongful access of paper records. None reported having been hacked. The odds are that that’s simply not the reality: “Noticeably absent are breach sources associated with malicious intent, such as stolen laptops/computers, deliberate acts by unscrupulous employees, etc., supporting the lack of industry focus on fraudulent data breaches that masks the frequency and severity of the problem,” the report states.

No doubt. The trouble is, without proper intrusion detection and prevention systems in place, access and database log monitoring, and other controls, most hospitals probably wouldn’t know if they were successfully hacked.

There was plenty of silence when it came to financial breaches, prior to July 2003. That’s not because banks, credit unions, and retailers weren’t being hacked. It’s because they weren’t required to report any breaches until California enacted SB 1386, which required any company, where California residents were involved, to notify each of these victims if the firm suffered a security incident where certain kinds of financial information was, or could have been, exposed. Today, most states have similar laws in force.

Perhaps it’s time the healthcare industry be forced to do the same.

No argument here.  And the laws that have been recently proposed in Congress do not go far enough because of how they define a “security breach” and the standards they set for protection and notification.  When WellPoint had a massive web exposure that went on for over a year, was there any penalty?  When Finjan discovered another huge database online, what were the consequences for the health system that suffered the breach — and were those affected ever even notified?  To date, HHS has only penalized one entity, Providence, while others have escaped unscathed. HIPAA has been a drastic failure when it comes to security and enforcement and many states exclude HIPAA-covered entities from their breach notification laws.  One immediate improvement would be for states to stop excluding these entities.  It won’t improve security enough, but at least more people would find out when their sensitive data have been exposed, lost, or compromised.

It’s time for Congress to raise the standards and lower the boom despite pressure from lobbyists.

Category: Health Data

Post navigation

← Who's reading your medical files today?
UK: Health board admits losing patients’ data →

Now more than ever

"Stand with Ukraine:" above raised hands. The illustration is in blue and yellow, the colors of Ukraine's flag.

Search

Browse by Categories

Recent Posts

  • Nova Scotia Power hit by cyberattack, critical infrastructure targeted, no outages reported
  • Georgia hospital defeats data-tracking lawsuit
  • 60K BTC Wallets Tied to LockBit Ransomware Gang Leaked
  • UK: Legal Aid Agency hit by cyber security incident
  • Public notice for individuals affected by an information security breach in the Social Services, Health Care and Rescue Services Division of Helsinki
  • PowerSchool paid a hacker’s extortion demand, but now school district clients are being extorted anyway (3)
  • Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines
  • Call for Public Input: Essential Cybersecurity Protections for K-12 Schools (2025-26 SY)
  • Cyberattack puts healthcare on hold for hundreds in St. Louis metro
  • Europol: DDoS-for-hire empire brought down: Poland arrests 4 administrators, US seizes 9 domains

No, You Can’t Buy a Post or an Interview

This site does not accept sponsored posts or link-back arrangements. Inquiries about either are ignored.

And despite what some trolls may try to claim: DataBreaches has never accepted even one dime to interview or report on anyone. Nor will DataBreaches ever pay anyone for data or to interview them.

Want to Get Our RSS Feed?

Grab it here:

https://databreaches.net/feed/

RSS Recent Posts on PogoWasRight.org

  • Apple Siri Eavesdropping Payout Deadline Confirmed—How To Make A Claim
  • Privacy matters to Canadians – Privacy Commissioner of Canada marks Privacy Awareness Week with release of latest survey results
  • Missouri Clinic Must Give State AG Minor Trans Care Information
  • Georgia hospital defeats data-tracking lawsuit
  • No Postal Service Data Sharing to Deport Immigrants
  • DOGE aims to pool federal data, putting personal information at risk
  • Privacy concerns swirl around HHS plan to build Medicare, Medicaid database on autism

Have a News Tip?

Email: Tips[at]DataBreaches.net

Signal: +1 516-776-7756

Contact Me

Email: info[at]databreaches.net

Mastodon: Infosec.Exchange/@PogoWasRight

Signal: +1 516-776-7756

DMCA Concern: dmca[at]databreaches.net
© 2009 – 2025 DataBreaches.net and DataBreaches LLC. All rights reserved.