Pointer: Lessons from HHS Breach Data

Over on The New School of Information Security, Adam Shostack responded to my recent blog entry about what can we learn from the HHS breach reports.   Looking at “insider” incidents,  Adam writes, in part:

There were 10 incidents, (6% of all incidents involving 500 or more people). They impacted 50,491 people (1% of all people.) We sometimes hear that incidents involving insiders are the most damaging or impactful. The unauthorized access incidents (which is a separate category from hacking) had a lower mean number impacted than hacking, improper disposal, loss, theft, business associates, laptops, desktop computers, portable electronic devices or network servers. In fact, the only categories which impacted fewer people were “theft, unauthorized access” and “paper records.” Now, it’s true that unauthorized access is not the same word as insiders. In fact, unauthorized access likely includes both insiders and access control failures (the “spreadsheet on a website” pattern). It’s also true that there were quite damaging incidents that involved fewer than 500 people (the “peeking” pattern).

Adam’s commentary highlights some of the difficulties I’ve had integrating the HHS breach reports with other databases such as those compiled by the Privacy Rights Clearinghouse, the Identity Theft Resource Center, and DataLossDB.org. The way the HHS breach incidents are reported on their log, it’s really difficult to tell what may or may not be an insider event. As the recent Verizon study noted, “insiders” could be innocently involved — such as human error leading to misconfiguration resulting in web exposure — or they could be more malignantly involved such as those who download and sell or misuse PII for identity theft or fraudulent purposes. Given the way the HHS breach reports are logged, we really get no clear sense of “this was an insider snooping matter” vs. “the employee sold the patients’ information to co-conspirators who used it for ID theft or Medicare fraud.” As such, we all lose out on evaluating what and where the greatest risks are. That said, I appreciate Adam’s point that the breach reports suggest that insider breaches may be much less of a problem in terms of numbers than in other sectors. But there’s one big piece we’re all missing, I think on that:

There is a huge amount of Medicare fraud in which patient information is being misused. The fraudsters are getting the patients’ Medicare numbers somewhere somehow, but most press releases from U.S. Attorney’s offices reporting indictments or convictions never tell us that piece of it — how the fraudsters got the patients’ information. In some cases, we are told that fraudsters bribed patients into providing their data in exchange for gifts or cash, but for the most part, there are probably thousands of stolen or misused patient identity data incidents each year that will not show up in an HHS breach report because law enforcement is investigating or prosecuting a case and it’s all kept under wraps. Could most of these cases involve insiders? I really don’t know although a few media reports suggest that we shouldn’t rule out that possibility.

By the way, it seems that the .csv and .xml versions of the database do not match up. The .csv version shows 166 breaches, while the .xml shows 181.   The .xml version also omits the entities’ names, even though they are entered in the .csv version.  I’ll need to dig into the discrepancies a bit more this week to figure out what reports may have been omitted from the .csv version that I’ve been relying on in my coverage and analyses.  Had Adam not mentioned “181 breaches,” I probably never would have noticed that they’re discrepant, so thanks for that, too, Adam!