P2P networks a treasure trove of leaked health care data, study finds
Eight months after passage of HITECH Act, data leaks still a problem in health care industry
Computerworld - Nearly eight months after new rules were enacted requiring stronger protection of health care information, organizations are still leaking such data on file-sharing networks, a study by Dartmouth College's Tuck School of Business has found.
In a research paper to be presented at an IEEE security symposium Tuesday, a Dartmouth College professor Eric Johnson will describe how university researchers discovered thousands of documents containing sensitive patient information on popular peer-to-peer (P2P) networks.
One of the more than 3,000 files discovered by the researchers was a spreadsheet containing insurance details, personally identifying information, physician names and diagnosis codes on more than 28,000 individuals. Another document contained similar data on more than 7,000 individuals. Many of the documents contained sensitive patient communications, treatment data, medical diagnoses and psychiatric evaluations. At least five files contained enough information to be classified as a major breach under current health-care breach notification rules.
While some of the documents appear to have been leaked before the Obama administration's Health Information Technology for Economic and Clinical Health (HITECH) Act was enacted, many appear to be fairly recent. A previous study by Dartmouth in 2008 also unearthed files containing health-care data floating on P2P networks, such as Limewire, eDonkey and BearShare. Among the documents found in that study was one containing 350MB of patient data for a group of anesthesiologists and another on patients at an AIDS clinic in Chicago.
The fact that many organizations are still leaking such information on file-sharing networks is surprising, said Johnson, professor of operations management at Dartmouth and one of the paper's authors.
The HITECH Act, which went into effect last September, requires any organization handling health-care data to implement stronger controls for protecting it. The law also requires such organizations to publicly disclose data breaches involving patient health information within 60 days of the discovery of a breach. The law also significantly expands the number and kinds of organizations that are required to comply with the federal law on patient privacy known as HIPAA (the Health Insurance Portability and Accountability Act). The law also provides for stiff penalties for noncompliance with these requirements.
The fact that sensitive patient health information is freely available on P2P networks suggests that many organizations are still not paying enough attention to security, Johnson said.
How the data gets leaked
Data leaks on P2P networks typically occur when file-sharing software from P2P sites such as Limeware and eMonkey is improperly installed on a computer that contains sensitive data. Usually, the file-sharing software is installed on a computer to share music and video files. In many cases, however, users configure the software improperly, and all the data on the computer becomes visible and available to all other users on the P2P network.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Simplify and Consolidate Data Protection for Better Business Results Learn about IBM® Tivoli® Storage Manager Operations Center, which provides advanced visualization, built-in analytics and integrated workflow automation features that leapfrog traditional backup...
- HP HAVEn: See the big picture in Big Data HP HAVEn is the industry's first comprehensive, scalable, open, and secure platform for Big Data. Enterprises are drowning in a sea of data...
- Data Protection and Disaster Recovery with iSCSI and VMware Get this on demand webcast now
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Privacy White Papers | Webcasts