Blue Lance InfoSec Blog

Connecticut AG Sues Healthcare Provider in First Case of State Enforcement Under HITECH

Connecticut Attorney General Richard Blumenthal sued Health Net of Connecticut, Inc. for HIPAA violations stemming from the loss of a portable hard drive containing the health and financial information of approximately 446,000 Connecticut enrollees in May of 2009, and the failure to notify authorities and consumers for at least 6 months.

Additionally, the AG seeks a court order preventing Health Net from continued HIPAA violations by requiring that protected health information stored on portable drives be encrypted.

A subsequent investigation found that the data, which included health records, social security numbers and bank account numbers in over 27 million scanned pages, was not encrypted or otherwise protected from unauthorized access and was viewable on commonly available software.

The case is the first action taken by a state under the HITECH Act, which enables states to enforce HIPAA violations.

Source:  Connecticut Attorney General's Office

Ex-UCLA Healthcare Employee Pleads Guilty to HIPAA Violations

Apparently, the management at the UCLA Healthcare System could not foresee a security risk with giving notice to employees of their intent to terminate them. 

From the Los Angeles office of the FBI:

 LOS ANGELES—A former UCLA Healthcare System employee pleaded guilty today to four counts of illegally reading private and confidential medical records, mostly from celebrities and other high-profile patients.

Huping Zhou, 48, of Los Angeles, pleaded guilty prior to a trial scheduled to begin next week to four misdemeanor counts of violating the federal privacy provisions of the Health Insurance Portability and Accountability Act (HIPAA). Appearing before United States Magistrate Judge Andrew J. Wistrich, Zhou specifically admitted to knowingly obtaining individually identifiable health information without a valid reason, medical or otherwise. Zhou becomes one of the first people in the nation to be convicted of violating the privacy provisions of HIPAA.

Zhou, who is a licensed cardiothoracic surgeon in China, was employed in 2003 at UCLA Healthcare System as a researcher with the UCLA School of Medicine. On October 29, 2003, Zhou received a notice of intent to dismiss him from UCLA Healthcare for job performance reasons unrelated to his illegal access of medical records. That night, Zhou, without any legal or medical reason, accessed and read his immediate supervisor’s medical records and those of other co-workers. For the next three weeks, Zhou’s continued his illegal accessing of patient records and expanded his illegal conduct to include confidential health records belonging to various celebrities. According to court documents, Zhou accessed the UCLA patient records system 323 times during the three-week period, with most of the accesses involving well recognized celebrities.

In a plea agreement filed today, Zhou admitted that he obtained and read private patient health and medical information on four specific occasions after he was formally terminated from the UCLA Healthcare System. Zhou acknowledged that at the time he viewed these patients’ medical information, he had no legitimate reason, medical or otherwise, for obtaining the personal information.

“There is a persistent problem with improper and illegal viewing of medical records by individuals who abuse the access they have as a result of their employment,” Acting United States Attorney George S. Cardona said. “HIPAA’s criminal privacy provisions protect not only celebrities, but all of us from curious neighbors, disgruntled co-workers, and other snoopers.”

Zhou is scheduled to appear in federal court on March 22 to be sentenced by Judge Wistrich. At sentencing, Zhou faces a maximum statutory penalty of four years in federal prison.

“The FBI is committed to investigating violations of HIPAA laws, the compromise of which can cause major financial or emotional distress,” said Steven M. Martinez, Assistant Director in Charge of the FBI in Los Angeles. “These laws exist to protect the privacy that must be afforded to all patients, despite how intriguing that information might be to some with unworthy intentions.”

The UCLA Healthcare System, the UCLA School of Medicine and the UCLA Medical Group fully cooperated in the investigation, which was conducted by the Federal Bureau of Investigation.

Former Executive at Japanese Matchmaking Firm Accused of Stealing Client Data

A former board member of Web, a Japanese matchmaking service, allegedly stole the personal information of about 16,000 members and attempted to sell the data to competing matchmaking firms.  

The executive stole the information in August 2006, just prior to his resignation from the firm.  After a failed attempt to sell the data back to Web, he began offering the data to Web's competitors in a series of emails.

Although the police have been contacted, an arrest has not been made.  However, Web has said it plans to lodge a criminal complaint for the theft.

Source:  AsiaOne News

Contract Worker at the Center of TSA Employee Identity Thefts

As if the Transportation Security Administration (TSA) needed more headlines containing the phrase "security breach", details are coming to light in the investigation of the theft of employee information at Boston's Logan International Airport. 

In December, Tina White and Michael Washington were arrested and charged with identity theft and larceny after a search revealed the pair in possession of a list with TSA employee names.  The information was provided by Washington's niece, a TSA contract employee working in human resources.

The employee identities were sold for $40 each and used to obtain wireless and other utility services.

Full Story

Supreme Court Case to Determine Future of Sarbanes-Oxley

On December 7, the U.S. Supreme Court will hear arguments in a case which challenges the constitutionality of the Public Company Accounting Oversight Board (PCAOB); the organization responsible for determining policy, and enforcement of the Sarbanes-Oxley Act.

The plaintiffs in the case (Free Enterprise Fund v.Public Company Oversight Board) assert that the PCAOB, while characterized as a private corporation, exercises broad governmental powers including policy creation and compliance enforcement; in effect, making it a government agency subject to Presidential oversight and control.

While the case is not likely to be the downfall of Sarbanes-Oxley, but some form of change seem to be on the horizon for the legislation.  An amendment currently in the House Financial Services Committee would permanently exempt small publicly traded companies from the attestation requirement of Section 404 of the Sarbanes-Oxley Act.

16 Employees Fired for Alleged HIPAA Violations

An article by ABC13 in Houston reports that the Harris County Hospital District terminated 16 employees for HIPAA violations after they accessed the medical records of a fellow employee, Dr. Stephanie Wuest, who had been shot during an attempted robbery.

Read the entire story

T-Mobile Employee Sells Account Details of Thousands of Subscribers

The Information Commissioner's Office (ICO) announced details of an incident involving a mobile telephone company where one or more employees allegedly sold customer details including expiration dates of their contracts to competitors.  Although the ICO did not mention the company by name, the Guardian identified the provider as T-Mobile:

An employee of the phone operator T-Mobile sold the personal records of customers, which included details of when their mobile phone contracts expired. The millions of items of information were then sold on for "substantial sums", the Information Commissioner's Office (ICO) said. Rival networks and mobile phone retailers were then able to use it to try to lure away T-Mobile customers by "cold calling" them.

In the course of it's investigation, the ICO "obtained several search warrants attended a number of premises, and is now preparing a prosecution file".

Sources:

The Information Commissioner's Office

The Guardian

Personal Data of 16,000 Exposed on Stolen USB Drive

InternetNews.com reports that a USB drive left overnight in an unlocked car was stolen, exposing the personal data of 16,000 Roane State Community College students and employees.

The college has sent letters to anyone who may be affected by this theft and has notified major the major credit-monitor and reporting agencies.

"While we have no reason to believe that the data was stolen for identity-theft purposes, we urge those affected to closely monitor their financial accounts for irregularities," Danny Gibbs, Roane State's vice president of business and finance said in a statement. "Roane State deeply regrets the exposure of this data.

Read the entire article here.

New Study Finds Significant Insider Threat from Former Employees

Ernst & Young has published its 12th annual Ernst & Young Global Information Security Survey which includes responses from nearly 1900 senior IT executives in more than 60 countries.

The results indicate that 75% of respondents are concerned about possible reprisals from former employees.  

According to Paul van Kessel, Global Leader of Ernst & Young’s Information Technology Risk and Assurance Services practice, “With the economy still in recession, employees that are made redundant may feel resentful towards their previous employer in a number of ways that may affect the smooth operation of an organization. Increasingly, the employer’s IT system has become a common target and data theft is also prevalent. It is paramount that companies undertake a specific risk assessment exercise to identify their potential exposure and put in place appropriate risk-based responses.”

Other areas of the survey address the difficulty in securing adequate budgets to keep pace with the ever-changing threat environments, complying with regulatory requirements and more. 

Source:

Ernst & Young

One Step Closer to Federal Data Breach Notification Requirements

Yesterday, the U.S. Senate Judiciary Commitee passed two bills which set guidelines for data breach notifications at the federal level.

S.139, known as the Data Breach Notification Act, establishes guidelines for data breach notifications for government agencies and business entities as well as enforcement actions.

S.1490 is known as the Personal Data Privacy and Security Act of 2009 and establishes standards for developing and implementing safeguards to protect the security of sensitive personal information.  It also imposes civil penalties for violations of such standards.

The next stop for both bills is a full Senate vote.