Dan Solove argues that if the FTC would just conclude that the use of Social Security numbers as a password or authenticator is unreasonable data security, a lot of identity theft could be prevented. I think he’s right, but there has always been and would be tremendous pushback against the proposal. I’m not confident that Congress would…
bcc failure: St. Francis notifies patients whose e-mail addresses were exposed in an e-mail
WTOC reports that St. Francis Hospital sent out the following news release on Monday, June 9: Protecting the personal information of our patients is one of our most important responsibilities. Regrettably, this notice is regarding an unintentional incident involving a limited number of patient email addresses. On Friday, May 30, 2014, St. Francis became aware that an…
UK: Worcestershire Health and Care NHS Trust signs undertaking
From the Information Commissioner’s Office: An undertaking to comply with the seventh data protection principle has been signed by Worcestershire Health and Care NHS Trust. This follows an investigation whereby the local press were handed a patient handover sheet containing details of 18 patients. The sensitive personal data was found on a table in a…
So how’s 2014 going, you ask? Not well, not well…..
Risk Based Security and Open Security Foundation have released a report for Q1 of 2014. The first bullet gives a good indication of what kind of year 2014 is turning out to be: There were 669 incidents reported during the first three months of 2014 exposing 176 million records. Of especial interest to me were…
Former IRS Employee Sentenced in Identity Theft and Tax Fraud Scheme
Michael Cohn reports: A former Internal Revenue Service employee has been sentenced to four years and nine months in prison in connection a tax fraud and identity theft scheme. Missy A. Sledge, 47, was employed for 12 years by the IRS. According to prosecutors, she worked with other criminals who would file fraudulent tax returns…
Hospital fires employee who provided patient's syphilis records to ex-boyfriend
Over the weekend, more details emerged about the breach at U. of Cincinnati Medical Center that resulted in a patient’s syphilis diagnosis being posted to Facebook. The new details do not totally agree with claims in the woman’s lawsuit. Robert Scalese reports: According to the hospital, it was a financial services employee who accessed the…