Why Healthcare Security Matters

guest · Aug 15, 2020

Ashley County Medical Center investigates former employee accused of violating federal privacy laws
August 7, 2020
https://www.myarklamiss.com/news/ar...ee-accused-of-violating-federal-privacy-laws/

Ashley County Medical Center is investigating a former employee they claim inappropriately viewed medical records of 772 patients.

Based on investigations conducted by ACMC, it appears that the limited patient information was only accessed and viewed out of curiosity and not distributed or shared with anyone outside of ACMC. ACMC is continuing to audit the limited patient information that was viewed by the former employee.
The former employee was terminated by ACMC as a result of their actions.

“Our policies and procedures revealed the actions of this former employee and we acted swiftly in terminating their employment and reporting them to the appropriate authorities,” said Tiffany Holland, Compliance Officer, ACMC.
Click to expand...

“Patient privacy is an extremely serious matter and any failure to protect patient information will subject employees to disciplinary actions,” said Phillip Gilmore, Chief Executive Officer, ACMC.
Click to expand...

guest · Aug 19, 2020

Judge Dismisses Heritage Valley Malware Lawsuit Against Nuance
August 18, 2020
https://healthitsecurity.com/news/judge-dismisses-heritage-valley-malware-lawsuit-against-nuance

A federal judge for the US District Court of the Western District of Pennsylvania has filed a motion to dismiss the lawsuit against Nuance Communications, filed by Heritage Valley Health System after the 2017 NotPetya malware cyberattack damaged its computer systems.

Heritage Valley was one of the Nuance clients affected by the vendor’s NotPetya infection, which crippled the health system’s servers and workstations and rendered the operating systems unbootable and files on the infected drives inaccessible.
The health system filed a lawsuit against Nuance in 2019, claiming the vendor was responsible for spreading NotPetya to its system, allegedly caused by negligence and poor “security practices and governance oversight.”
Click to expand...

While the judge accepted Heritage Valley’s allegations as factual and viewed “them in light a most favorable,” Nuance and Dictaphone were explicitly exempted from product liability as it involved external sources: the 2003 contract was held between Heritage Valley and Dictaphone, not Nuance.
Click to expand...

guest · Aug 19, 2020

9 GitHub Repositories Found Leaking Health Data from Over 150K Patients
August 19, 2020
https://healthitsecurity.com/news/9...d-leaking-health-data-from-over-150k-patients

Improper access controls have left the data of more than 150,000 to 200,000 patients, and likely more, exposed online in at least nine GitHub repositories, shining a light on the need for improved vendor management and security processes, according to a new collaborative report from Jelle Ursem and DataBreaches.net.

Ursem, a security researcher from the Netherlands, has examined online databases for over a year and a half, which has led to the discovery of more than 400 data leaks from a host of companies, including private sector entities, Fortune 500 companies, and government agencies, among others.
The new report, No Need to Hack When It’s Leaking, sheds light on this trend as it pertains to medical data.
Click to expand...

What’s more, many of these errors went undetected by the entities for months or even years, due to the companies failing to audit the compliance and security policies of their developers, a lack of monitored accounts for researchers to report security concerns, or failing to respond to responsible disclosure attempts.
Click to expand...

Report: ‘No need to hack when it’s leaking – GitHub Healthcare Leaks – Protected Health Information on the Public Web.’
(PDF - 1.87 MB): https://www.databreaches.net/wp-content/uploads/No-need-to-hack-when-its-leaking.pdf

guest · Aug 19, 2020

AI firm exposes 2.5 million sensitive medical records online
August 18, 2020
https://www.hackread.com/ai-firm-exposes-sensitive-medical-data-online/

2.5 million medical records containing sensitive and confidential data have been exposed by a New York-based artificial intelligence company called Cense. Jeremiah Fowler a researcher and co-founder of Security Discovery on 7th July discovered the exposed data potentially risking millions of lives and identities openly.
Further investigation by Fowler brought light to what caused the misconfiguration and data vulnerability.

Moreover, a whopping 2,594,261 medical records were exposed which included Personally identifiable information (PII) and other sensitive information such as patient names, insurance records, medical diagnosis, and payment information.
What is rather unnerving is the fact that once the medical records were accessible, a further probe led Fowler to patients who were in car accidents. Even their referrals to chiropractors for neuromuscular disorders such as spinal or neck injuries were readily exposed and available.
Click to expand...

However, Fowler informed Cense about the exposed data shorty after which the access to the database was restricted.

Only last month, another security researcher and consultant named Volodymyr ‘Bob’ Diachenko discovered 3.1 million patients data exposed by a medical software company called Adit, a Houston, TX-based company. The misconfigured Elasticsearch cluster included confidential information and yet again had no authentication or passwords ensuing exposed permeability.
Click to expand...

Security Discovery: AI Company Exposed 2.5 Million Records Including Medical Data of Auto Accident Victims Online

My full discovery was published at Secure Thoughts, a website dedicated to privacy, security, and data protection. Here is a brief summary of what was found and how it potentially risked the identities of a large number of accident victims.
Click to expand...

guest · Aug 21, 2020

Man finds sensitive patient data outside Caithness General
August 20, 2020
https://www.northern-times.co.uk/ne...atient-data-outside-caithness-general-209705/

A MAN who was passing by Caithness General Hospital in Wick claims to have found a document containing "highly sensitive medical information" about patients.

The member of the public, who wishes to remain anonymous, said he found the folded A4-size piece of paper lying on the road near the gate lodge house at the entrance to the hospital around 8pm last Friday.

"It was a list of vulnerable patients in Caithness General that outlined their ages and health conditions," the man said.
The list of 19 names allegedly had information regarding the meals they ate, their marital status, whether they lived alone and any mental health condition they may be suffering.
Click to expand...

NHS Highland's chief executive has since "unreservedly apologised" to the patients affected by the data breach.
The man who found the document said: "It seems to be a list a doctor would use as he went around the wards. It's highly sensitive information and the potential was there for people to be harmed by this.
Click to expand...

guest · Aug 21, 2020

mood said: ↑

NHS radiographer, 32, faces jail after illegally accessing more than 200 female patients' personal records before hounding them for dates
December 6, 2019
https://www.dailymail.co.uk/news/ar...legally-accessing-records-hounding-dates.html
Click to expand...

Hairmyres Hospital creep avoids jail over repeated data breach
The married dad-of-one accessed personal records of 200 female patients and pestered them for dates
August 19, 2020
https://www.dailyrecord.co.uk/news/local-news/hairmyres-hospital-creep-avoids-jail-22546694

A Hairmyres Hospital worker who chatted up patients after getting contact details from their medical records has avoided prison.

Andrew Stewart often used a false name and would tell unsuspecting women that their number had somehow turned up in his phone.
Stewart, of Fenwick, admitted breaching the Data Protection Act and charges of threatening or abusive behaviour involving 16 women whose details he got illegally.
Click to expand...

The 33-year-old was sentenced at Hamilton Sheriff Court today (Wednesday) after pleading guilty last December. Sentencing had been delayed due to the COVID-19 pandemic.

“A significant amount of data is kept by hospitals and it’s expected that this information is confidential.
“You abused the trust placed in you and extracted information for your own use.
But the sheriff acknowledged Stewart had no previous convictions and appeared to be “sincerely sorry” for what he had done.
Click to expand...

guest · Aug 23, 2020

Dozens of boxes of medical records found at Odessa Recycling Center
August 20, 2020
https://www.cbs7.com/2020/08/20/dozens-of-boxes-of-medical-records-found-at-odessa-recycling-center/

Dozens of boxes of medical records found at Odessa Recycling Center

It is unclear how the boxes got there or who is responsible.
Over two dozen boxes of old medical records containing personal patient information were found at the Odessa Recycling Center over the weekend.
WTO is a part of Midland Health. In a prepared statement, MH said:

“We have a team on-site at Odessa Recycling Center. They have looked through all records and determined that they do not belong to us. The name West Texas Orthopedics has been used by other entities in the past, but these records predate our ownership.”
Click to expand...

In Texas, licensed physicians are required to maintain adequate medical records of a patient for a minimum of seven years from the last treatment by the physician – one year more than HIPAA requires.
CBS7 was told these documents are older, which makes them eligible for destruction…
Click to expand...

guest · Aug 23, 2020

July 2020 Healthcare Data Breach Report
August 19,2020
https://www.hipaajournal.com/july-2020-healthcare-data-breach-report/

July saw a major fall in the number of reported data breaches of 500 or more healthcare records, dropping below the 12-month average of 39.83 breaches per month. There was a 30.8% month-over-month fall in reported data breaches, dropping from 52 incidents in June to 36 in July; however, the number of breached records increased 26.3%, indicating the severity of some of the month’s data breaches.

1,322,211 healthcare records were exposed, stolen, or impermissibly disclosed in July’s reported breaches. The average breach size was 36,728 records and the median breach size was 6,537 records.
Largest Healthcare Data Breaches Reported in July 2020
14 healthcare data breaches of 10,000 or more records were reported in July, with two of those breaches involving the records of more than 100,000 individuals, the largest of which was the ransomware attack on Florida Orthopaedic Institute which resulted in the exposure and potential theft of the records of 640,000 individuals.
Click to expand...

guest · Aug 25, 2020

Search Engines May Expose Patient Health Information, ACR warns
August 24, 2020
https://healthitsecurity.com/news/search-engines-may-expose-patient-health-information-acr-warns

New search engine capabilities may inadvertently expose patient identifiers and other protected health information, according to a warning from the American College of Radiology (ACR), Radiological Society of North America (RSNA), and Society for Imaging Informatics in Medicine (SIIM) to radiologists and other medical professionals.

“The ability to use Optical Character Recognition (OCR) at scale allows programs to quickly re-generate explicit PHI that was originally burned into the image pixels,” researchers explained. “Search engines can then associate (‘index’) the image with that explicit PHI thereby making it discoverable.”
Healthcare providers commonly create presentations that may contain medical imaging for educational purposes [...] However, search engines may now index patient identifiers in those slide presentations, even if the provider believes the data has been de-identified.
Click to expand...

To protect this data, providers must only use images without PHI in presentations. To ensure no patient data is included, those providers should leverage screen capture software to capture the image pixels only for the region of interest.
ACR established a resource page to include best practices, as well as recommended software functions to help radiologists permanently remove any sensitive content and other best practices for safely creating presentations.
Click to expand...

guest · Aug 27, 2020

North Okanagan pediatric clinic hacked
Historical patient billing information may have been accessed
August 25, 2020
https://www.keremeosreview.com/news/north-okanagan-pediatric-clinic-hacked/

Patients of a North Okanagan facility are being alerted of a privacy breach.

The North Okanagan Pediatric Clinic was subject to a remote hacking attempt in late May 2020.

“While patient medical charts and records, which are maintained in paper form only, were unaffected, historical patient profile information could theoretically have been accessed by the attacker during the period they had access to the local system,” Dr. Michael Cooke said.
Cooke said there is no evidence patient information was accessed, rather it appears the attacker was focused on encrypting system files for ransom.
Click to expand...

guest · Aug 29, 2020

Ex-Nursing Home Employee Used Patient's ID To Pay Bills: Police
August 27, 2020
https://patch.com/illinois/palos/ex-nursing-home-employee-used-patients-id-pay-bills-police

A Franklin Park woman is accused of stealing the identities of dozens of mostly elderly people. Anna Zur, 39, was arrested on Wednesday after a year-long investigation, where she was charged with felony counts of wire fraud and continuing a financial crimes enterprise, police said.

Working with the care facility's corporate office, police learned that a former employee, later identified as Zur, had access to the patient's financial information and documents, according to a news release.
Zur allegedly sent copies of the elderly patient's financial information and documents to her personal email, which she used to make purchases and pay off debts.
Click to expand...

guest · Aug 29, 2020

'Human error' exposed health information of 9,000 children: Manitoba government
August 28, 2020
https://winnipeg.ctvnews.ca/human-e...-9-000-children-manitoba-government-1.5083156

The Manitoba government says 'human error' resulted in personal information about Children's Disability Services (CDS) clients being unintentionally shared this week.

On Friday, the province said in a news release that the privacy breach occurred on Aug. 26, when staff from CDS "accidentally sent an email intended for the Manitoba Advocate for Children and Youth (MACY) to about 100 agencies and advocacy groups."
The province said the spreadsheet was password-protected, but the password for the spreadsheet was also provided.

In a statement, MACY said it is working with the province to determine the nature and scope of the breach.
Click to expand...

guest · Aug 31, 2020

mood said: ↑

South Africa's Life Healthcare hit by cyber attack
June 9, 2020
https://in.reuters.com/article/us-l...-healthcare-hit-by-cyber-attack-idINKBN23G0MY
Click to expand...

Life Healthcare reveals damage caused by data breach
August 31, 2020
https://www.itweb.co.za/content/rW1xLv59YPGvRk6m/pXnWJadMba7bjO1e

Life Healthcare Group, the second largest private hospital operator in SA, says it has “substantially” restored its IT systems following the cyber attack that crippled its operations in June and July.

In a trading update today, the hospital group says the attack has now been contained and for the first time revealed how the attack impacted on its operations.

“As previously communicated, the group’s southern African business was a victim of a malicious cyber attack by criminals. The manual backup processes, brought into effect as a result of the attack, impacted the ability of the southern African operations during the month of June and part of July 2020 to complete patient billing, submit claims to medical aids, process supplier invoices and produce financial results,” says Life Healthcare.
“The group was able to substantially restore its IT systems at the beginning of July 2020 and has since then been able to materially operate as normal.”
Click to expand...

guest · Sep 1, 2020

Breach exposes data of more than 100K patients at Utah Pathology Services
August 29, 2020
https://kutv.com/news/local/breach-...-of-more-than-100k-at-utah-pathology-services

Approximately 112,000 patients had their personal information exposed by a data breach at Utah Pathology Services.

The breach was discovered when the organization discovered "an unknown party attempted to redirect funds from within Utah Pathology," according to a press release from the company. The attempted fraud led to the discovered of that patient information was accessible and included one or more of the following: [...]

"There is no evidence that any patient information has been misused, but out of an abundance of caution, the company has notified all potentially affected patients. Letters have been mailed to those patients whose information was contained in the email account," the group said in a release but also stated the investigation is ongoing.
Click to expand...

guest · Sep 5, 2020

6,000 Roper St. Francis patients' info possibly breached in compromised email incident
September 3, 2020
https://abcnews4.com/newsletter-dai...ancis-employees-email-affecting-6000-patients

Roper St. Francis Hospital officials said on Thursday that 6,000 patients were affected by an incident where a employee's email was accessed by someone without authorization and they gained access to personal medical records and information.
The incident occurred between June 13 and June 17, but Roper St. Francis officials didn't learn about it until July 8.

Hospital officials said information including names, birth dates and detailed medical records were accessed, and in a "limited number of instances," health insurance information and/or Social Security numbers were included.
Click to expand...

To help prevent this from happening again, RSFH is enhancing its email security and providing continued education to staff on email protection.
Click to expand...

guest · Sep 7, 2020

Assured Imaging Ransomware Attack Affects Almost 245,000 Patients
September 4, 2020
https://www.hipaajournal.com/assured-imaging-ransomware-attack-affects-almost-245000-patients/

Tucson, AZ-based Assured Imaging, a subsidiary of Rezolut Medical Imaging and provider of Health Screening and Diagnostic Services, has announced it has suffered a ransomware attack that resulted in the encryption of its medical record system.
Assured Imaging discovered the attack on May 19, 2020 and worked quickly to stop any further unauthorized access and restore the encrypted data. Assisted by a third-party computer forensics firm, Assured Imaging investigated the ransomware attack to determine the scope of the breach. The investigation revealed an unauthorized individual gained access to its systems between May 15, 2020 and May 17, 2020 and exfiltrated “limited data” prior to the deployment of ransomware.

The incident has been reported to law enforcement and the Department of Health and Human Services’ Office for Civil Rights. The OCR breach portal indicates up to 244,813 individuals were affected by the attack.
Click to expand...

Email Breach Affects 6,000 Roper St. Francis Healthcare Patients
Charleston, SC-based Roper St. Francis Healthcare has data breach involving a single email account. The breach was detected on July 8, 2020, with the investigation revealing the email account was compromised between June 13, 2020 and June 17, 2020.
The health insurance information and/or Social Security numbers of a limited number of individuals were also stored in the email account. Approximately 6,000 patients have been affected by the breach.
Click to expand...

Hamilton Health Center Reports Impermissible Disclosure of 10,000 Patients’ PHI
Harrisburg, PA-based Hamilton Health Center, Inc. has announced the protected health information of 10,393 individuals was impermissibly disclosed as a result of a recent phishing attack.
Hamilton Health Center learned on June 19, 2020 that a spreadsheet containing patient information had been sent to an unauthorized individual in response to a phishing email.
Click to expand...

guest · Sep 9, 2020

Patient Data Privacy Lawsuit Against Google, UChicago Dismissed
September 8, 2020
https://healthitsecurity.com/news/patient-data-privacy-lawsuit-against-google-uchicago-dismissed

The patient data privacy lawsuit brought against Google and the University of Chicago Medical Center was dismissed by a federal judge in Illinois on September 4, ruling that patient who filed the suit against the entities failed to adequately demonstrate the damages suffered as a result of the partnership.

The ruling is a big win for Google, currently facing backlash over a similar partnership with Ascension. Patients argue the collaboration would give the tech giant troves of sensitive data without patient consent—in direct violation of HIPAA.
Click to expand...

The UChicago and Google partnership was announced in 2017: a machine learning project for its electronic medical records data designed to improve healthcare outcomes. Through the partnership, the provider hoped to reduce unplanned hospital readmissions and potential care complications.
Filed by Matt Dinerstein in June 2019, the class-action lawsuit accused the entities of violating patient privacy by allegedly sharing thousands of patient records without first removing personal identifiers, [...]

“That research partnership was appropriate and legal, and the claims asserted in this case are baseless and a disservice to the Medical Center’s fundamental mission of improving the lives of its patients,” a UChicago Medicine spokesperson said at the time.
Click to expand...

As a result, the patient did not develop or provide enough supporting information to support that the contract signed between Dinerstein and UChicago created a legal interest in his data. Further, the allegations fail to support his argument that the value of his data has been diminished by the Google partnership.
Click to expand...

guest · Sep 9, 2020

More than 230 Million US Health Records Have Been Stolen or Lost in Past Decade
September 9, 2020
https://hotforsecurity.bitdefender....been-stolen-or-lost-in-past-decade-24102.html

The data breach phenomenon has been plaguing the US healthcare sector for more than a decade, with a 2,733% increase between 2009 and 2019, according to a PrivacyAffairs study.

Through analysis of reported healthcare data breaches over the past decade, researchers have revealed some alarming statistics:

• 3,054 data breaches were disclosed between 2009-2019
• 230,954,151 healthcare records have been lost, stolen or exposed
• Healthcare data breaches have impacted 70% of US citizens
Although the causes of healthcare data breaches range from human negligence to geopolitical cyberattacks, more often than not, stolen healthcare records end up for sale on underground marketplaces.
Click to expand...

“Hospital IT teams are often so busy with simply keeping systems and databases working correctly that data security becomes a lower priority,” researchers said. “This means that known vulnerabilities are often left unpatched and systems not updated.”The number of interconnected IoT devices within hospitals also make for a suitable entry point for attackers who wish to gain access to a healthcare providers’ network.
Click to expand...

guest · Sep 12, 2020

Camrose medical clinic employee penalized after sharing health files: privacy commissioner
September 10, 2020
https://edmonton.ctvnews.ca/camrose...g-health-files-privacy-commissioner-1.5100055

A Camrose medical clinic employee has been fined and given 180 hours of community service after improperly accessing health records of friends and others.

According to the office of the privacy commissioner, Olivia Franc accessed the files at the Smith Clinic where she worked.
Her employer reported the privacy breach in June 2018.
According to the OIPC, “Ms. Franc accessed the health records of close acquaintances, friends and others in the community. The accesses were made without a legitimate reason to do so. For one of the accesses, Ms. Franc further disclosed an individual’s health information to a friend.”

It is an offence to access records in contravention of the Health Information Act.
Click to expand...

guest · Sep 14, 2020

Veterans' Social Security numbers leaked in data breach
September 14, 2020
https://www.cnet.com/news/veterans-social-security-numbers-leaked-in-data-breach/

The personal information of around 46,000 veterans was exposed during a hack, the US Department of Veterans Affairs said Monday. One of the online apps for the VA Financial Services Center "was accessed by unauthorized users" who diverted payments that were meant to go to health care providers for veterans' medical treatment. The information includes Social Security numbers.

The app has been taken offline, and won't be available again until the VA completes a security review. For now, the department is contacting those affected, including deceased veterans' next of kin.

"The department is also offering access to credit monitoring services, at no cost, to those whose Social Security numbers may have been compromised," the VA said.
Click to expand...

guest · Sep 15, 2020

Public Health Wales accidentally publishes 18,000 coronavirus patients’ data
September 15, 2020
https://www.itgovernance.co.uk/blog...lly-publishes-18000-coronavirus-patients-data

Public Health Wales has confirmed that it accidentally published the personal data of 18,105 people who tested positive for coronavirus.

The information was accessible on a publicly accessible server for 20 hours on 30 August.
In most cases, patients’ initials, dates of birth, geographical area and gender were exposed, which fortunately presents little risk.
“Should never have happened”
Public Health Wales Chief Executive Tracey Cooper told BBC Wales that the failure was one of the “biggest data breaches” she had come across and that it “should never have happened”.
Click to expand...

guest · Sep 17, 2020

OCR Settles with 5 Providers Over HIPAA Right of Access Violations
September 15, 2020
https://healthitsecurity.com/news/ocr-settles-with-5-providers-over-hipaa-right-of-access-violations

The Office for Civil Rights closed investigations and announced settlements with five providers over separate HIPAA right of access violations, which brings the total number of enforcement actions under its 2019 initiative to seven.

According to the announcement, All Inclusive Medical Services, Beth Israel Lahey Health Behavioral Services, King MD, and Wise Psychiatry have all settled with OCR for failing to adhere to the right of access rule.
Announced in early 2019, OCR’s HIPAA right of access initiative strictly enforces the right of patients to obtain access to their medical records in a timely fashion, for a reasonable fee, and in their requested format.
Click to expand...

Timely, as studies revealed that more than half of healthcare entities fail to comply with the HIPAA provision.
“Today's announcement is about empowering patients and holding health care providers accountable for failing to take their HIPAA obligations seriously enough.”
Click to expand...

guest · Sep 17, 2020

Düsseldorf University Hospital Emergency Care Postponed After Alleged Cyber Attack
September 16, 2020
https://hotforsecurity.bitdefender....stponed-after-alleged-cyber-attack-24149.html

Düsseldorf University Hospital (UKD) has suffered a massive network failure that forced the healthcare facility to deregister from emergency care and postpone outpatient treatments, hospital officials disclosed last Thursday.

“There is currently an extensive IT failure at the University Hospital Düsseldorf (UKD),” the announcement reads. “This means, among other things, that the clinic can only be reached to a limited extent – both by telephone and by email. Planned and outpatient treatments will also not take place and will be postponed. Patients are therefore asked not to visit the UKD – even if an appointment has been made.”
According to a press release, the failure of IT systems occurred gradually, and certain hospital operations that required computer access were no longer possible.
Click to expand...

Additional updates were provided on September 14, when UKD announced a minor success in restoring some of its systems. “However, it is not yet possible to predict how much time this will take, because there are serious errors in several parts of the IT structure,” the notice reads.
“Although the extent of the system errors has now been analyzed, external specialist companies and the police are still working on investigating the cause.
Click to expand...

guest · Sep 18, 2020

Patient sues BJC HealthCare over employee email hack: 4 details
September 18, 2020
https://www.beckershospitalreview.c...hcare-over-employee-email-hack-4-details.html

A former patient of St. Louis-based BJC HealthCare filed a class-action lawsuit against the health system over a cybersecurity incident, according to the lawsuit hosted on Bloomberg.

1. BJC HealthCare reported three employees' email accounts were breached on May 5 and may have exposed personal health information. The information included patient names, medical records, clinical information, insurance information and Social Security numbers.
2. The lawsuit claims patients with breached information have to spend time and money protecting themselves from fraud and is seeking reimbursement for losses incurred from the breach. The plaintiffs also state that they paid the health system to secure their information and the breach diminished the value of those services. [...]
Click to expand...

guest · Sep 20, 2020

Regina clinic failed to notify patients of privacy breach, says commissioner
September 19, 2020
https://leaderpost.com/news/local-n...-patients-of-privacy-breach-says-commissioner

An investigation by Saskatchewan’s privacy commissioner found that a Regina medical clinic did not notify patients when a doctor’s dictation machine containing personal health information went missing a year ago.

The investigation also found that the clinic did not notify the patients who were named in the notes stored on the dictaphone. According to the investigation, the clinic “did not want patients to fear that all their medical information had been compromised as it was only the diagnosis of that day that was recorded.”
Kruzeniski did not agree with the clinic’s reasoning for not notifying patients.

“A patient’s name is enough to identify an individual. This puts all the affected individuals at risk of being identified by whoever finds the dictaphone,” wrote Kruzeniski.
Click to expand...

Kruzeniski recommended that Adams, along with the clinics two other partners, Dr. Mark Cameron and Dr. Ashis Paul, develop comprehensive written privacy policies and procedures. The clinic has said it will follow his recommendation, according to Kruzeniski’s report.
He also found that the clinic did not have any technical safeguards in place. The investigation did not find any evidence that the information stored on Adams’ dictaphone was protected by passwords or encryption.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches