Healthcare // Security & Privacy
News
2/5/2014
02:00 PM
Connect Directly
LinkedIn
Google+
Twitter
RSS
E-Mail
50%
50%

Texas Hospital Discloses Huge Breach

St. Joseph Health System reports that as many as 405,000 records may have been compromised, but actual damage remains speculative.

Hackers Outsmart Pacemakers, Fitbits: Worried Yet?
Hackers Outsmart Pacemakers, Fitbits: Worried Yet?
(Click image for larger view.)

St. Joseph Health System has confirmed a security breach affecting the records of up to 405,000 past and current patients, as well as employees and employees' beneficiaries.

St. Joseph says it believed the attack occurred between Dec. 16 and 18, when one of its computer servers was hacked, and that the exposure ended on the 18th when the attack was discovered and the server was shut down. The health system hired national security and computer forensic experts to investigate. The ongoing investigation suggests the attackers may have gained access to records including names, Social Security numbers, dates of birth, and possibly addresses, as well as the medical information of patients and bank account data for employees.

If substantiated, this would be one of the largest healthcare data breaches ever reported, and the largest by an individual health system. The largest, according to US Department of Health and Human Services data, involved 780,000 records in a 2012 incident at the Utah Department of Health and 475,000 records in a 2008 report from the Puerto Rico Department of Health. Since both of these are government agencies, the St. Joseph breach could potentially have the biggest loss of patient data reported by an individual hospital.

[Don't let it happen to you. Read HIPAA, SOX & PCI: The Coming Compliance Crisis In IT Security.]

So far, the damage done is a matter of speculation.

"While it is possible that some information was accessed or taken, the forensics investigation has been unable to confirm this," wrote Denise Goffney, corporate compliance officer and privacy officer, in a message posted on the hospital website:

It is important to note that SJHS has received no reports that any of the personal information involved has been misused. We take this matter, and the security of our patients', employees', and employee beneficiaries' personal information, very seriously. As a precaution, SJHS wants to assist individuals affected by this incident in protecting their identity, even though we are not aware of any misuse of the information, and we have been unable to determine whether any data was in fact taken.

As is common in these incidents, St. Joseph is offering affected individuals free credit and identity protection services.

Medical data breaches seem to show up on the 6 o'clock news almost every week. If you think it wouldn't happen to you -- or the financial impact will be minor -- think again. Download the Healthcare Data Breaches Cost More Than You Think report today. (Free registration required.)

David F. Carr oversees InformationWeek's coverage of government and healthcare IT. He previously led coverage of social business and education technologies and continues to contribute in those areas. He is the editor of Social Collaboration for Dummies (Wiley, Oct. 2013) and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
David F. Carr
50%
50%
David F. Carr,
User Rank: Author
2/7/2014 | 10:15:04 AM
Re: Largest breach?
According to the story from our archives on the 2011 VA Tricare breach, it was reported under FCC rather than HIPAA rules. That was another government health agency breach, related to theft of computer backup tapes, but point taken that was much larger. This Texas one still seems significant as the breach of a private health system.
David F. Carr
50%
50%
David F. Carr,
User Rank: Author
2/7/2014 | 9:55:27 AM
Re: Largest breach?
any idea why that wouldn't be on the HHS listing?
Brian Bartlett
50%
50%
Brian Bartlett,
User Rank: Apprentice
2/6/2014 | 8:54:01 PM
Largest breach?
As I recall, the largest breach occured to the VA Tricare system potentially affecting over 4.9 million records (no one is quite sure about the top-end count). That was in 2011.
David F. Carr
50%
50%
David F. Carr,
User Rank: Author
2/6/2014 | 9:43:55 AM
Re: same sad responce
My colleague Mathew Schwartz suggests the fact that they can't tell what was taken, if anything, may indicate a lack of investment in incident management and response technology to trace the breach. He has a column coming today that will discuss some of these issues in a broader context.

It may be that the other shoe will drop in the coming weeks, as customers and patients of the hospital discover specific problems traced to this incident.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Author
2/6/2014 | 8:24:22 AM
Re: same sad responce
"No proof" does not mean there is no such kind of problem. It just indicates that nobody has a proper estimation about the scope of damage!


It also means that no one (i.e. the company/hospital/retailer) wants to be held liable for paying for the damage. 
Li Tan
50%
50%
Li Tan,
User Rank: Ninja
2/5/2014 | 9:57:05 PM
Re: same sad responce
Somehow I got use to read such kind of news/headlines. The confidential information breach is such a bad thing. The statement from official agency is always irresponsible: "We have no proof that such kind of breach has resulted in any concrete problem". This is really a void statement - "no proof" does not mean there is no such kind of problem. It just indicates that nobody has a proper estimation about the scope of damage!
PaulS681
50%
50%
PaulS681,
User Rank: Ninja
2/5/2014 | 7:55:28 PM
same sad responce
 

Most of these breaches have the same sad response. Something like "We have no proof any of this info has been used misused". Are they going to monitor this for years? This stolen data could be used now or 2 years from now. I am so tired of hearing that type of response.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Author
2/5/2014 | 4:40:06 PM
Re: Same Shoddy Security, Different Day
I'm not at all surprised that the healthcare is the target of a data security breach! It's only been in the past decade the industry has widely adopted electronic health records and other digital technologies. Credit bureau and consumer data tracking service company Experian reported last month: 

The sheer size of the industry makes it vulnerable when you consider that as Americans, we will spend more than $9,210 per capita on healthcare in 2013. Add to that the Healthcare Insurance Exchanges (HIEs), which are slated to add seven million people into the healthcare system, and it becomes clear that the industry, from local physicians to large hospital networks, provide an expanded attack surface for breaches." 

More at: http://www.informationweek.com/healthcare/policy-and-regulation/healthcare-data-breaches-to-surge-in-2014/d/d-id/1113259?

 

asksqn
50%
50%
asksqn,
User Rank: Ninja
2/5/2014 | 3:28:31 PM
Same Shoddy Security, Different Day
I shake my head every time a breach occurs because such activity underscores just how sloppy/negligent most entities are when it comes to protecting consumer data -- No/Misapplied patches, use of Microsoft products, zero to very little training of personnel having access to confidential data... Where does it end?  And while credit/ID theft monitoring is nice, it is far too little and far too late.  The concept of security should occur **before** a breach, not following it. How many times does it have to happen before there is a mass uprising?

The Privacy Rights Clearinghouse (PRC) in San Diego has a much more comprehensive (and honest) data breach listing found here >> http://www.privacyrights.org/data-breach  
David F. Carr
50%
50%
David F. Carr,
User Rank: Author
2/5/2014 | 2:43:18 PM
Standard bureaucratic language?
Is that just standard bureaucratic language to say our system was breached and the hackers had full access to all this data ... but we're just not sure they actually took any of it.

Is there some example of where hackers gained that kind of access and didn't take advantage of it? Like the Grinch seeing the light and putting all the presents back neatly in their place?
Healthcare Data Breaches Cost More Than You Think
Healthcare Data Breaches Cost More Than You Think
Healthcare providers just don't get it. They refuse to see the need to fully secure their protected health information from unauthorized users -- and from authorized users who abuse their access privileges. As a result, they don't allocate enough budgetary resources for securing medical data.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest September 24, 2014
Start improving branch office support by tapping public and private cloud resources to boost performance, increase worker productivity, and cut costs.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.