In the process of updating PHIprivacy.net to reflect breaches newly disclosed by the U.S. Dept. of Health and Human Services (HHS), I found reference to a breach for which I was able to find a companion statement. The University of Oklahoma-Tulsa, Neurology Clinic recently notified HHS of an incident affecting 19,264 patients. According to HHS’s…
Author: Dissent
Nine more breaches newly revealed on HHS's web site
Thanks to Adam Shostack, I realized that although HHS provides two formats for their breach report database, the two databases do not necessarily contain the same number of breach reports on any given day. While he was analyzing data based on the .xml version containing 181 breach reports, I had been using the .csv version,…
Oracle database admins acknowledge security gaps
From the this-does-not-inspire-confidence dept.: Ellen Messmer reports: Database security is rife with pitfalls, according to 430 Oracle database administrators surveyed by the Independent Oracle Users Group. According to the results of the survey released last month, fewer than 30% encrypt personally identifiable information in all their databases, while about 75% acknowledge their organizations do not…
HIPAA Follies, Monday Edition: Tweeting that your sloppy security resulted in data theft
I’ve reported a number of instances where employees have been disciplined or terminated for imprudent postings on Facebook or MySpace, but a series of tweets I saw on Twitter yesterday demonstrate how to simultaneously diminish the public’s confidence in HIPAA while risking your own future, 140 characters at a time. It started with a twitterer…
Pointer: Lessons from HHS Breach Data
Over on The New School of Information Security, Adam Shostack responded to my recent blog entry about what can we learn from the HHS breach reports. Looking at “insider” incidents, Adam writes, in part: There were 10 incidents, (6% of all incidents involving 500 or more people). They impacted 50,491 people (1% of all…
FTC: No Major PHR Breaches So Far
Howard Anderson reports: … A personal health record is an “electronic record of identifiable health information on an individual that can be drawn from multiple sources and that is managed, shared and controlled by or primarily for the individual,” according to the FTC. Last year, the FTC issued a PHR breach notification rule, as called for under…