Six Missing HDDs Contain Health Information of Nearly a Million Patients (corporate-ir.net) 87
Lucas123 writes: Health insurer Centene Corp. revealed that it is looking for six HDDs with information on 950,000 customers that went missing during a data project that was using laboratory results to improve the health outcomes of patients. The drives not only contain sensitive personal identification information, such as addresses, dates of birth and social security numbers, but they also contain health information. "While we don't believe this information has been used inappropriately," said Michael Neidorff, CEO of Centene.
Editing (Score:5, Funny)
"While I usually praise the high standard of editing," said readers of Slashdot everywhere.
Re: (Score:2, Insightful)
Re: This is why we need givernment-controlled.,, (Score:2)
I just think it's hilarious you can take away everything that makes a free market insurance plan really insurance and expect Americans not to notice. I disagree a lot with what Bernie believes in, but he's the only Democratic candidate that actually says stuff that doesn't sound like complete lunacy when it comes to healthcare. Obama Care is a means to an end which is a single payer system. I'm not saying I agree with that, but the Obama Care system will collapse into a single payer or back into a free mark
Re: (Score:1)
Re: (Score:1)
They view it as a large "click" in the ever-leftward ratchet.
"Reducing costs" involves treating the current medical treatments as a static tree to be plucked, hunter-gatherer style, rather than being a transient state in ever-increasing number of treatments and cures which, by definition, costs more.
Unlike a car or TV, medicine is a suite of different things, and you want corporations adding options hand-over-fist. There is simply more to buy year after year, and it naturally costs more.
How much more are n
Re: (Score:1)
America's healthcare costs are the highest because it's literally the only place that any money is available for R&D. All those countries that have single-payer? We're subsidizing them. And people say Americans don't support communism, we do it every time we go to the doctor or buy medicine. Only we're subsidizing the R&D that the entire world benefits from. Shove your single-payer up your red commie ass.
Re: (Score:2)
You really believe that? Take a look at the medical research coming out of those countries before you proudly tell everyone just how little you know.
Re: (Score:2)
A single-payer medical system can be just as advanced as a private medical system. We see this every single day with new procedures being developed, tested, and made available to the general public in the many countries with single-payer systems. Quite a few of those systems have better outcomes than the US system for a whole range of diseases.
You've been lied to, and now you are arguing against your own future. Good jerrrrb!
Re: Researchers! (Score:2)
Researchers don't need SSN for patient. Just assign each patient a number and refer to them that way.
The CS professional should have sanitized the data before releasing it.
Re: Researchers! (Score:5, Interesting)
Researchers don't need SSN for patient. Just assign each patient a number and refer to them that way.
The CS professional should have sanitized the data before releasing it.
In this case, the intent was to use the lab results to ensure improved patient outcomes. This means that the data had to be trackable back to the patients that provided it, and then the lab results were to be fed back into the treatment of said patients.
So this was technically not "human trials research", it was a bioinformatics business process to manage outcomes. As such, it's HIPAA protected, certainly -- but also, 100% personally identifiable.
For the people I know who have bought private insurance, or participated in one of the exchanges, but not yet provided their social security number, there tends to be a lot of letters sent (on the order of one a month) from the insurer, asking for the social, nominally to inform the IRS of your insurance, with the implied threat that if you don't provide the social, the IRS is going to eat your babies.
In other words: health care providers really, really like your social. Typically, according to people in the billing industry whom I also happen to know, it so that when they screw up on their billing -- which they inevitably do -- they can send the bills to a collections agency easier, in order to damage your credit over their screwup, until you pay them for their inability to code a procedure "correctly" so the health insurance accepts the coding.
So they had the socials, probably for not very good reasons, and they used them as an identifier for notionally very good reasons of unique correlation, and then they lost the data because they were idiots who don't routinely protect HIPAA data to the level required to allow them use of it in the first place.
Re: (Score:2)
Re: (Score:2)
And yet on the IRS tax forms it's just a single question "Have you had health insurance", last year at least they didn't request any information to collaborate it...no policy numbers, corp, etc.
I didn't say they were telling the truth, and I (I hope) implied the opposite: They just want you to voluntarily disclose your social. I'm well aware that it's a check box.
Re: (Score:2)
Re: Researchers! (Score:4, Insightful)
Researchers don't need SSN for patient. Just assign each patient a number and refer to them that way.
A better solution would be to get rid of the idiotic notion that SSNs can be both widely known and secret. Their use for authentication (rather than identification) should be banned. They should be considered public information.
Re: (Score:3)
Trade offs (Score:1)
If you compile information into huge databases, this is what you can expect. Personally, I want all my medical records on paper charts stored in my doctor's office. Unless you agree to have your information published on the internet, don't accept electronic records. I assume that in this specific case the ssd's were lost. Even if they end up on eBay, the new owners will most likely clear the old data.
Killing People (Score:5, Insightful)
If you compile information into huge databases, this is what you can expect. Personally, I want all my medical records on paper charts stored in my doctor's office. Unless you agree to have your information published on the internet, don't accept electronic records. I assume that in this specific case the ssd's were lost. Even if they end up on eBay, the new owners will most likely clear the old data.
That policy choice would kill a lot of people because it would prevent data mining to learn how to generate better health outcomes.
Trade offs.
Re: (Score:3)
Re: (Score:3)
You know that this would not have been a problem, had they had to store all the data on 5 1/4" floppy disks, right? The backup alarm on the semi truck would have been a dead giveaway...
Re: (Score:2)
Naaah, paper tape is more secure.
Two words (Score:3)
Re: (Score:2)
Re: (Score:1)
The sad thing is that every PC certified for Windows post 8 has a TPM and facilities for hardware encryption onboard. Enable BitLocker, and the OS platter is protected. From there, it is simple to BitLocker encrypt volumes, either externals, or others. Macs have FileVault2.
Even if the drives were on a NAS, my el cheapo Synology DS116j (single drive model, whose purpose in life is to be a rsync target for my other NAS for backups), offers eCryptFS encryption.)
External HDDs in general can be well protecte
Doesn't hurt (Score:1)
Have you checked Hillary's server?
Re: (Score:2)
on 950,000 customers that went missing
Not to Worry! (Score:1)
There are practically no real-world consequences for HIPAA violations like this. [propublica.org]
Everybody will be fine. Except the patients. And who the fuck cares about those jerk-offs anyway?
driving without a seatbelt (Score:2)
I think shipping any sensitive data unencrypted should be a punishable offence even when the data is not stolen. Similar to driving around without your seatbelt. Its irresponsible behaviour that is easily prevented and comes from being lazy
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
To go from working cabinet to fireproof safe?
I have several disk arrays that are hot swappable which technically have removable drives. But I cannot seem to find the reference stating they were on removable drives. For all I know they could have been removed from a failed server and was waiting for a new one to arrive.
Re: (Score:1)
At least they used encrypted HDDs.. (Score:1)
Are the encrypted? (Score:1)
If they are encrypted no worries. If they are not encrypted the board should each be given jail time 5 year minimum
My guess (Score:3)
Not a problem. (Score:2)
what the (Score:2)
Re: (Score:2)
Probably. They probably also determined that the cost of the fine is less than the cost of compliance.
Raise your hand if this surprises you... (Score:5, Insightful)
Yep, absolutely nobody is surprised by this in the least. Turns out hookers and blow don't manage this stuff very well on their own.
Re: (Score:2)
yeah I know. I'm aware of several policies that data on external drives must be encrypted. And data sent via common carrier must also be encrypted. And signed for - life cycle management - including erasure and limited access documentation.
Our data center guys (not even handling PHI - just IP) have to use these USB drives that contain push-button PIN passwords right on the device itself. Data can't even leave the room without this level of security.
It is easy these days. You just need to do it.
Re: (Score:2)
It is easy these days. You just need to do it.
Yeah, but it takes time. And time costs money. And the insurance companies are insured against this kind of stupidity by other insurance companies, so they just let the chips fall where they may ... and let the party keep rolling. It's not like there will be any consequences for the insurance company, as they now have a guaranteed customer base for the rest of their lives.
Re: (Score:2)
oh right - I forgot about that angle. What is the exposure to fines vs cost of doing it right? Gosh wasn't that a /. topic a few weeks ago - can't sue if there aren't any actual damages from identity theft. Just pay for monitoring and all is right with the world.
The ol' bean counter clause.
hmm... remember those companies that were experimenting with publishing all salaries of employees for full (internal) view? What if all of our personal details were just out in the open? It would reduce the value of
Re: (Score:2)
What if all of our personal details were just out in the open? It would reduce the value of it.
Even further back there was a story here about someone who was intentionally putting all his most trivial information into very public websites. I don't recall all the details now, but it may have been something he was doing do counter the fact that he was being targeted for surveillance for no particularly good reason so he figured he could do exactly that - reduce the value of the data.
Being as the slashdot "search" function continues to be the least useful search function anywhere, I have no good w
Sensitive Private Information?? (Score:2)
Why is a person's SSN and date of birth 'sensitive information.'
Now, I know that the Credit Industry wants to be able to use this information to obligate us to assume responsibility for any debt they might choose to inflict on us.
But how is it in our benefit for this to be Secret Information? The Social Security Administration was not intended to issue 'secret numbers' to people.
The Government should publish all SSNs and in effect disallow the Credit Agencies from using this information against us. It wou
Get rid of them (Score:3)
Re: (Score:3)
Re: (Score:2)
Out of Compliance with HIPAA and HITECH Acts (Score:2)
The HIPAA and HITECH Acts' Security Rule require hard drives containing personal health information (PHI) to be encrypted at rest.
Why weren't they?
Losing an encrypted drive is not a reportable incident. Losing one with 950,000 records in cleartext results in you getting your name up on the Wall of Shame at HHS' Office of Civil Rights (OCR) along with penalties of $100 to $50,000 _per_record_ up to a maximum of $1.5 million.
In this case, since Centene Corp. is guilty of "Willful Neglect", the penalty sho
Somebody call the Dollhouse (Score:2)
Lamest defense...evarr! (Score:2)
"While we don't believe this information has been used inappropriately," said Michael Neidorff, CEO of Centene.
That is the absolute lamest "don't worry" defense I've heard in a decade, hands-down.
So, what, you know an employee took it and wants hush money? No? Then how can you even claim data safety? OMFG.