Jon Alexander reports:
The medical records of more than 2,300 Glens Falls Hospital patients were stored for more than four months on an unprotected computer server, and the hospital’s investigation into whether the sensitive information was illicitly accessed is ongoing.
The hospital announced Thursday that a forensic audit determined that an outside records contractor, Portal Healthcare Solutions LLC, stored thousands of notes from doctors on an unprotected server between early November and mid-March, according to Glens Falls Hospital spokeswoman Darlene Raynsford.
Read more on PostStar.com. I do not see any notice on the hospital’s web site at the time of this posting.
Part of the hospital’s statement, as reported by the Post-Star, is disputed by the CEO of PORTAL | ASCEND GROUP.
In a statement to PHIprivacy.net, the firm’s CEO, A. K. Jay Jaiswal, acknowledged that through human error, a secure server’s firewall settings left it open to unrestricted access. That problem only existed from March 5 – March 14, however, he says. As soon as Portal was notified of the problem, the problem was corrected, and access logs were provided to the hospital for their forensic experts to examine. Both the hospital and Portal agree that the examination has revealed no access to the files and no downloads. “Not a single document was showing a third party access,” Jaiswal stated in his e-mailed statement to PHIprivacy.net.
The server was a dedicated server and A. K. Jay Jaiswal informs PHIprivacy.net that no other clients experienced similar problems:
“We conducted security and penetration testing of all our data centers on March 14 and 15, 2013 ensuring all information was secured along with all of our systems,” he tells PHIprivacy.net, adding that this is the first incident of its kind Portal has experienced in 17 years.
We regret the incident and loss of client.
Contacted about the discrepancy between the hospital’s statement and Portal’s statement as to the exposure window, a hospital spokesperson stated that because there was an ongoing investigation, they would not be issuing any further statement or comment in response to Portal’s claims about time frame.
So… did Glens Falls really need to disclose this incident and notify patients? Under the old HITECH regulations, given the risk of harm threshold, they could have just kept quiet. And under the new regulations, which had not gone into effect as the time the vulnerability was detected, even though there’s a presumption that a breach is reportable, if their forensic examination showed no access or download, could they have decided to not notify? Is the hospital possibly alarming patients without cause, or are they engaging in admirable transparency and an abundance of caution?