Press release from the FTC, followed by my comments:
A company that provides medical transcription services has agreed to settle Federal Trade Commission charges that its inadequate data security measures unfairly exposed the personal information of thousands of consumers on the open Internet, in some instances including consumers’ medical histories and examination notes.
In its complaint against California-based GMR Transcription Services, Inc. and the company’s two principal owners, the FTC alleges that GMR hired contractors to transcribe audio files received from the company’s customers. The contractors downloaded the files from the company’s network, transcribed them, and then uploaded transcripts back to the network. GMR then made the transcripts available to customers either directly or by e-mail.
Because of inadequate security, the complaint alleges, medical transcript files prepared between March 2011 and October 2011 by Fedtrans, GMR’s service provider, were indexed by a major internet search engine and were publicly available to anyone using the search engine. Some of the files contained notes from medical examinations of children and other highly sensitive medical information, such as information about psychiatric disorders, alcohol use, drug abuse, and pregnancy loss.
The FTC’s consent order with GMR marks the 50th data security case the Commission has settled since undertaking its data security program 12 years ago. The Commission issued a statement today reaffirming the basic principles behind the FTC’s data security enforcement program.
“What started in 2002 with a single case applying established FTC Act precedent to the area of data security has grown into a vital enforcement program that has helped to increase protections for consumers and has encouraged companies to make safeguarding consumer data a priority,” the Commission statement says.
In the case of GMR, the files handled by the company included sensitive information about consumers, including their driver’s license numbers, tax information, medical histories, notes from children’s medical examinations, medications and psychiatric notes, according to the FTC’s complaint.
According to the complaint, GMR’s privacy statements and policies promised that “materials going through our system are highly secure and are never divulged to anyone.” However, the company never required the individual typists it hired as contractors to implement security measures, such as installing anti-virus software. In addition, an independent service provider GMR hired to transcribe medical files stored and transmitted the files in clear and readable text on a server that was configured so that they could be accessed online by anyone without authentication.
Under the terms of GMR’s settlement with the FTC, GMR and its owners are prohibited from misrepresenting the extent to which they maintain the privacy and security of consumers’ personal information. They also must establish a comprehensive information security program that will protect consumers’ sensitive personal information, including information the company provided to independent service providers. In addition, the company must have the program evaluated both initially and every two years by a certified third party. The settlement will be in force for the next 20 years.
The Commission vote to accept the consent agreement package containing the proposed consent order for public comment was 4-0. The Commission vote to issue the statement also was 4-0. The FTC will publish a description of the consent agreement package in the Federal Register shortly. The agreement will be subject to public comment for 30 days, beginning today and continuing through March 3, 2014, after which the Commission will decide whether to make the proposed consent order final. Interested parties can submit written comments electronically or in paper form by following the instructions in the “Invitation To Comment” part of the “Supplementary Information” section. Comments in electronic form should be submitted online and following the instructions on the web-based form. Comments in paper form should be mailed or delivered to: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex D), 600 Pennsylvania Avenue, N.W., Washington, DC 20580. The FTC requests that any comment filed in paper form near the end of the public comment period be sent by courier or overnight service, if possible, because U.S. postal mail in the Washington area and at the Commission is subject to delay due to heightened security precautions.
NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $16,000.
GMR Transcription has not issued any statement about the settlement as of the time of this posting, and I have emailed them to request one.
My Comments:
Why didn’t I/we know about this breach before now? I went back via a Google search and find no mention of this breach anywhere. Nor is it clear how it even came to the FTC’s attention. I’ve covered a number of breaches involving transcription services, but GMR and FedTrans’ names did not come up in any of them.
This breach is not on HHS’s public breach tool. Was this breach ever reported to HHS? And if so, what, if anything, did they do? While FedTrans is located in India, any covered entity using California-headquartered GMR should have had a business associates agreement in place and would be responsible for notifying affected patients. Did GMR notify covered entities of this breach and did they, in turn, notify the affected patients? I’ll have to send yet another inquiry to HHS, it seems.
The timing of this settlement is interesting, as it seems to be another reminder to those who challenge the FTC’s authority to enforce data security that yes, the FTC does and will continue to protect consumers and patients if entities fail to use commercially reasonable and appropriate security controls and/or misrepresent their privacy and security practices.
Related Files from the FTC: