P2P networks rife with sensitive health care data, researcher warns
Data leaks could be significant threat to patients, providers, Dartmouth study finds
Computerworld - Eric Johnson didn't have to break into a computer to gain access to a 1,718-page document containing Social Security numbers, dates of birth, insurance information, treatment codes and other health care data belonging to about 9,000 patients at a medical testing laboratory.
Nor did he need to ransack a health care facility to lay his hands on more than 350MB of sensitive patient data for a group of anesthesiologists or to get a spreadsheet with 82 fields of information on more than 20,000 patients belonging to a health system.
In all instances, Johnson was able to find and freely download the sensitive data from a peer-to-peer file-sharing network using some basic search terms.
Johnson, a professor of operations management at the Dartmouth College Tuck School of Business, did the searches last year as part of a study looking at the inadvertent hemorrhaging of sensitive health care data on Internet file-sharing networks.
The results of that study, which are scheduled to be published in the next few days, show that data leaks over P2P networks involving the health care sector pose a significant threat to patients, providers and payers, Johnson said.
"When you start thinking about the nature of these disclosures, it's far more worrisome" than compromises such as those involving payment card data, he said.
"Here you are leaking not just detailed personally identifiable information but also very personal medical information related to patients," Johnson said. Such data can be readily used by hospital employees, the uninsured, organized crime rings, illegal aliens and drug abusers for medical identity theft, and to fraudulently obtain costly medical services and prescription drugs, he said. And while such fraud can cost millions, there is less monitoring for such fraud in the health care industry than there is in the financial sector.
P2P networks allow Internet users to share music, video and data files with others on the network. Normally, popular P2P clients -- such as Kazaa, LimeWire, BearShare, Morpheus and FastTrack -- let users download files and share items from a particular folder. But if proper care isn't taken to control the access that these clients have on a system, it is easy to expose far more data than intended.
For example, Dartmouth conducted a similar study about 18 months ago and found volumes of sensitive financial data on P2P networks as a result of inadvertent data leakage. At a congressional hearing in July 2007, security experts testified that millions of documents, including sensitive military and government documents, were being leaked on P2P networks. Even pharmaceutical giant Pfizer Inc. became a victim when an employee illegally installed a P2P client on a company computer and exposed personal data belonging to 17,000 employees.
- Troubleshooting Common Issues in VoIP Learn more about Voice over Internet Protocol (VoIP), including common VoIP metrics used, best practices in VoIP management and tips and tricks for...
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How...
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!