File-sharing networks used to uncover thousands of medical records

[The Straight Story]

File-sharing networks used to uncover thousands of medical records

By Bob Brewin 02/27/2009

Just days after President Obama signed a law giving billions of dollars to develop electronic health records, a university technology professor submitted a paper showing that he was able to uncover tens of thousands of medical files containing names, addresses and Social Security numbers for patients seeking treatment for conditions ranging from AIDS to mental health problems.

Using peer-to-peer applications, which computer users download to share files, most commonly music and movies, M. Eric Johnson, director of the Center for Digital Strategies at Dartmouth College in Hanover, N.H., was able to access electronic medical records on computers that had the peer-to-peer programs stored on their hard drives. The medical files contained detailed personal data on physical and mental diagnoses, which a hacker could use to not only embarrass a patient but also to commit medical fraud.

One of the largest stashes of medical data Johnson discovered during two weeks of research he conducted in January was a database containing two spreadsheets from a hospital he declined to identify. The files contained records on 20,000 patients, which included names, Social Security numbers, insurance carriers and codes for diagnoses. The codes identified by name four patients infected with AIDS, the mental illnesses that 201 others were diagnosed as having and cancer findings for 326 patients. Data also included links to four major hospitals and 355 insurance carriers that provided health coverage to 4,029 employers and 266 doctors.

"Each of these constituents was exposed in this disclosure," Johnson wrote in a paper on the subject he presented at a conference on Feb. 23. "The exposure of sensitive patient health information may be most alarming to citizens."

http://www.nextgov.com/nextgov/ng_20090227_9147.php

[leftyladyfrommo]

1. We simply have no privacy anymore.

One of the bad things about this computer age.

One shouldn't think that their communications are private, either. Its all out there. All your financial stuff. All your medical stuff. Everything.

[Gormy Cuss]

2. The purpose of the experiment was to demonstrate the need for better IT security for health data.

What we really need are broad range privacy laws but business lobbyists will make sure that doesn't happen.

[geckosfeet]

3. If you install peer to peer on a machine that you store priviate information on

it's your own damn fault.

[druidity33]

5. bullshit

Any person who wants to spend a freaking second or two to designate a secure Sharing folder will not be "attacked". When you leave your entire system open, and your P2P program always running, then of course you're vulnerable.

I would bet this happened because people tend to download at work if they can... anyone stopping Hospital clerks from bringing in jump drives for downloading the newest Hannah Montana album?

This is not about P2P technology. This is about being smart with computers...

[geckosfeet]

7. That's my point. Thanks for jumping up my ass about it.

People left to their own devices will install software and use computers in an insecure manner.

And I must disagree to a point - it IS about security flaws in the software. If it is vulnerable unless people are "smart", then it is not safe - because -> people left to their own devices will install software and use computers in an insecure manner.

So bullshit on you.

[druidity33]

8. I work in a photo lab

I am an "associate", so do not have access to the Administrative passwords on our Internet based systems. It is pretty easy to set up a computer so that there are different user accounts. My account cannot install a program, visit the internet (other than camera manufacturer websites), access logs, etc.

I am saying that if we have better Internet Security in a photo lab, maybe the hospitals should work on hiring better internal IT people?


It seemed to me that your first comment was inappropriately "dissing" P2P technology. I take umbrage with that if you were. If you weren't, i apologize. Otherwise we're pretty much in agreement, i think.


:)

[geckosfeet]

9. To a point. Software needs to be smarter and safer since people prove

time and time again that they will disable or fail to enable safety features.

Not dissing p2p in general - just that it is a security breach when used improperly. People simply are not aware of the security issues when they open they machines up. The software needs to do a better job of securing its hoist.

[druidity33]

12. well, honestly

having an internet connection can be a security breach for some people.

Do we really have to dumb absolutely everything down so that Americans can figure things out?

I had a woman call today and tell me she hadn't used her camera for a year because the last time she turned it on (on her first day of a 7-day trip to Ireland) the screen flashed "corrupted data" and wouldn't let her take a picture. She was looking to buy a new camera. If she had asked someone or looked in her manual under "troubleshooting" she would've known it was a memory card issue and Formatting the card would in a few seconds solve the problem. A year. She basically put the camera down and didn't get back to it because the camera wasn't foolproof. She actually would've had to read something to figure it out.

No software is going to be "foolproof". I think securing a computer can take very little effort. Even with P2P systems installed and running.

Sorry.

:shrug:

[geckosfeet]

13. I agree with that. But sadly yes, as dumbed down as possible. And it still won't be enough.

[moriah]

15. As a tech support person, I can emphatically answer "Yes...".

... but it's not limited to Americans that we have to dumb down things for.

Users are users, no matter what their nationality. (Or, as my scary.devil.monastery friends would say, lusers are lusers.)

[haydukelives]

19. nothing is foolproof

Because fools are so ingenious.

[midnight]

4. So is this professor saying the technology is already there, and

it is not safe?

[dbonds]

6. A badly implemented version of the technology is there.

It is possible to have the records safe. Someone just did a poor job of implementing an electronic system.

[Deja Q]

10. Isn't an electronic system already in place?

I had put in a prescription for a medication, forgotten I had done so, found a bottle of the same medication from another pharmacy, ordered it. When I went there (pharmacy 2), they said it was already placed at (pharmacy 1).

Did I mention pharmacy 1 and pharmacy 2 are totally unrelated corporations/entities?

[Still Sensible]

11. Sounds like republican propaganda to battle the

President's initiative. Electronic medical records can be made and kept as secure as any other electronic records. Do we stop keeping electronic financial records because criminals occasionally hack into a database somewhere? Do we stop keeping academic records because criminals occasionally hack into a database somewhere? Of course not.

[crikkett]

20. No, we instead require medical facilities to implement security measures.

And we force them to hire qualified IT people to do it.

[bemildred]

14. Data which is meant to be secure should not be on systems that are connected to the internet.

What is so hard to understand about that?

[druidity33]

21. not at all

Honestly, there are simple and free ways to keep a Secure system. Period. One does not need to be offline. One does not need to abandon P2P technology. You don't need to dig a hole and encase it in aluminum. You are more likely to have your identity stolen when people hack into your Bank's mainframe, or your insurance agents office, than if you were to leave your computer running accidently.


Fill out a user profile and Log off when you're done computing. Make sure you're the only one that knows the Admin password. Turn off ports not used. Turn off the Remote Login for your computer, etc, etc.

It's not rocket science folks. Having access to the internets doesn't mean you are automatically leaving yourself wide open to hacks.

:shrug:

[eridani]

16. This is about hospitals and their security, not anything that patients do

Electronic records are a disaster waiting to happen if private insurance continues to exist.

[bluesmail]

17. I'm hoping the true reason

is they're snooping into Dick and Georges, and Donald and Condi's.:evilgrin:

[Yavin4]

18. These Records Aren't Stored Here On US Servers

These files are on servers in places like India which have lax data security.