Healthcare Breaches Spin Out Of Control

If the past week is any indication (and I'm afraid it is), health care companies are doing an abysmal job at protecting personal health care data.This evening the Colorado Department of Health Care Policy and Financing announced that state officials discovered an unauthorized removal of a computer hard drive from the state's Office of Information Technology Department: "

The information did NOT include addresses, dates of birth, social security numbers or any other financial information that could be used for identity theft. It included name, state ID number and the name of the client's program.

Approximately 111,000 clients, or one-fifth of those receiving public health insurance, will receive notification by first-class mail, as required by HIPAA.

"

So there it is, roughly 20 percent of the state's clients' data is at risk. Thankfully Social Security numbers were not exposed. Still: why is stored sensitive data not encrypted?

Perhaps because it's easier not to encrypt the data and then have to deal with all of the extra hassle. Just as it's easier to dump medical records than it is to have them properly destroyed.

Consider the shock when a Florida couple went to their local recycling center to discover "thousands" of medical records just tossed in the trash.

From Tampa Bay Online:

"When they looked at the paper bin it was not only full to the point of pushing up the lid, it was practically bursting at its seams. Inside were what looked to be thousands of pastel and manila file folders, all with neat tabs attached.

Curious, they pulled out a couple and were stunned to see that they appeared to be medical records, Karen Keith said.

The information inside the files included some that couldn't be more personal - or dangerous: Social Security numbers, copies of drivers' license numbers and even credit cards numbers, she said.

"

Nice. Fortunately the couple called authorities, and the paperwork wasn't found by a crook, or someone willing to sell the data to a bunch of crooks. Unfortunately, we probably don't hear about it when that actually happens, we just witness the resulting spike in identity and medical identity theft.

Also last week, a professional data management firm lost data on 800,000 patients. From South Shore Hospital's notice:

"Based upon South Shore Hospital's investigation so far, the back-up computer files could contain personally identifiable information for approximately 800,000 individuals. Included among those individuals are patients who received medical services at South Shore Hospital - as well as employees, physicians, volunteers, donors, vendors and other business partners associated with South Shore Hospital - between January 1, 1996 and January 6, 2010. The information on the back-up computer files may include individuals' full names, addresses, phone numbers, dates of birth, Social Security numbers, driver's license numbers, medical record numbers, patient numbers, health plan information, dates of service, protected health information including diagnoses and treatments relating to certain hospital and home health care visits, and other personal information. Bank account information and credit card numbers for a very small subset of individuals also may have been on the back-up computer files.

South Shore Hospital's back-up computer files were shipped for offsite destruction on February 26, 2010. When certificates of destruction were not provided to the hospital in a timely manner, the hospital pressed the data management company for an explanation. South Shore Hospital was finally informed on June 17, 2010 that only a portion of the shipped back-up computer files had been received and destroyed.

"

Unfortunately, this past week isn't much unlike any other week. Patient records are lost and stolen constantly.

So how does the health care industry bring some level of control over these breaches? Personally, I think they're adopting electronic medical records way too quickly: so slowing that down a bit would be a start. At least slowing down the implementation enough to conduct a security assessment of the health care provider, and make sure such records are adequately protected.

Another would be more aggressive enforcement. A recent example of a successful action would be the successful action of the Connecticut Attorney General's Office against the regional health plan, Health Net, for a lost portable drive that included health information, Social Security and bank account numbers on about 446,000 patients. In that incident, Health Net agreed to pay a $250,000 fine and implement a Corrective Action Plan to improve their security program. For a good overview, read Richard Santalesa's analysis of the settlement here, published yesterday.