Blue Lance InfoSec Blog

Florida couple indicted for theft of patient data

The FBI and the U.S. Attorney for the Southern District of Florida announced the indictment of Ruben Rodriguez and Maria Victoria Suarez, a Coral Gables couple, for the theft of personal data from patients to be sold to personal injury lawyers and clinics.  The information would then be used to solicit those patients for lawsuits.

According to the indictment, defendant Rodriguez solicited the assistance of a co-conspirator, who at the time was employed by AMR, an ambulance service provider that offered emergency and non-emergency medical transport services in Miami-Dade County. Defendant Rodriguez reached an agreement with the co-conspirator that required the co-conspirator to illegally gain access to certain personal information of individuals transported by AMR and to turn over that information to Rodriguez, in exchange for payments from Rodriguez.

The indictment further alleges that defendant Rodriguez would, in turn, sell the personal identification information he received from the co-conspirator to either of the following: (1) personal injury attorneys, who would use the personal identification information to improperly solicit individuals transported by AMR with hopes of representing them in future legal proceedings; and/or (2) personal injury clinics, who would use the personal identification information to improperly solicit individuals transported by AMR to offer medical services. The payments defendant Rodriguez received from the attorneys and clinics were determined, in part, by any resulting lawsuits, settlements, payments, and/or reimbursements.

The indictment additionally alleges that in the midst of this conspiracy, defendant Rodriguez introduced the co-conspirator to defendant Suarez, his wife, who thereafter, along with defendant Rodriguez, purchased the illegally obtained information from the co-conspirator for subsequent resale to others, as described above.

According to CBS4 in South Florida, this is not the first time the pair has bagged for this type of activity:

The couple was charged with conspiracy to steal patient records from Jackson Memorial Hospital last year. Rodriguez and Suarez allegedly used the same technique to get the information and get rich off of it. 

According to investigators Rodriguez paid JMH ultrasound technician Rebecca Garcia $1000 a month for patient records between December 2006 and February 2009. 

An unnamed personal-injury lawyer reportedly wrote checks worth more than $85,000 to a shell company between 2006 and 2009. The false account allegedly provided Rodriguez and Suarez kickback money.

That case has not yet gone to trial.  Let's hope the courts have the good sense to hold them without bail this time.

VA launches criminal investigation into employee for downloading patient data

Nextgov reports that the inspector general at the Veterans Affairs Department has launched an investigation into a physician assistant, who allegedly downloaded patient data.

The assistant allegedly recorded two sets of patient data on to a personal laptop for research purposes. One set included three years' worth of patient data and another held 18 years of medical information, according to a source familiar with the incident and who asked not to identified.

There are conflicting reports on how the data was obtained:

Roger Baker, VA's chief information officer, commented on an item about the incident that was posted Monday evening on a Nextgov blog that the physician assistant's laptop was never connected to the VA network and any data she recorded on her laptop was "hand entered."

But the source told Nextgov the VA inspector general is investigating whether the assistant used two thumb drives to transfer the data to the laptop.

No word on how many patients were involved or whether or not they would be contacted.  Hopefully, the VA's IT department has an detailed user audit trail to work with to shed some light on this incident. 

Sources: Nextgov, Open Security Foundation (OSF)

HSBC employee data theft said to affect 15,000 account holders

HSBC says in a statement that information stolen by a former IT employee affects 15,000 existing Swiss client accounts.   According to the statement:

It is now clear that the theft, which was perpetrated by a former IT employee about three years ago, involves approximately 15,000 existing clients who had accounts with the bank in Switzerland before October 2006. The stolen client information is limited to accounts in Switzerland, excluding ex-HSBC Guyerzeller accounts. There is no data compromised for any branches of the bank outside Switzerland, which operate on separate systems and security, or other entities within the HSBC Group,

Alexandre Zeller, CEO of HSBC Private Bank SA said "We deeply regret this situation and unreservedly apologise to our clients for this threat to their privacy. We are determined to protect our clients’ interests and are taking every necessary measure to do so, actively contacting all our clients with Swiss-based accounts."

The bank said that it has spent more than $93 million in system upgrades and security improvements.

The bank is cooperating with the Swiss authorities and continues its own investigations, and a criminal investigation led by the Swiss Federal Prosecutor is underway. The Swiss authorities confirmed to us that they will not support the use of the stolen data to answer requests from foreign authorities. The French authorities have informed the Swiss authorities that the data they hold will not be used inappropriately.

West Memphis Police Officer Terminated, Under Investigation for Accessing Employee Personal Info

WMC-TV in West Memphis reports that an FBI investigation is underway of a West Memphis police officer suspected of accessing the personal information of other officers.  The suspect, an unnamed detective in the police department, has been terminated.

From the report:

According to Paudert, files containing the names and social security numbers of police department employees were stored on the computer network, making the employees vulnerable to identity theft.

"It's very disturbing to us that someone, first of all, would do that, and secondly, what it would do to the employees that work here," Paudert said.

To date, it is unclear how the detective was able to access the files via a hack or a lapse in network security, and whether or not any other files were affected.  West Memphis Police Department employees have been notified and asked to monitor their credit reports for irregularities.

Connecticut AG Sues Healthcare Provider in First Case of State Enforcement Under HITECH

Connecticut Attorney General Richard Blumenthal sued Health Net of Connecticut, Inc. for HIPAA violations stemming from the loss of a portable hard drive containing the health and financial information of approximately 446,000 Connecticut enrollees in May of 2009, and the failure to notify authorities and consumers for at least 6 months.

Additionally, the AG seeks a court order preventing Health Net from continued HIPAA violations by requiring that protected health information stored on portable drives be encrypted.

A subsequent investigation found that the data, which included health records, social security numbers and bank account numbers in over 27 million scanned pages, was not encrypted or otherwise protected from unauthorized access and was viewable on commonly available software.

The case is the first action taken by a state under the HITECH Act, which enables states to enforce HIPAA violations.

Source:  Connecticut Attorney General's Office

Ex-UCLA Healthcare Employee Pleads Guilty to HIPAA Violations

Apparently, the management at the UCLA Healthcare System could not foresee a security risk with giving notice to employees of their intent to terminate them. 

From the Los Angeles office of the FBI:

 LOS ANGELES—A former UCLA Healthcare System employee pleaded guilty today to four counts of illegally reading private and confidential medical records, mostly from celebrities and other high-profile patients.

Huping Zhou, 48, of Los Angeles, pleaded guilty prior to a trial scheduled to begin next week to four misdemeanor counts of violating the federal privacy provisions of the Health Insurance Portability and Accountability Act (HIPAA). Appearing before United States Magistrate Judge Andrew J. Wistrich, Zhou specifically admitted to knowingly obtaining individually identifiable health information without a valid reason, medical or otherwise. Zhou becomes one of the first people in the nation to be convicted of violating the privacy provisions of HIPAA.

Zhou, who is a licensed cardiothoracic surgeon in China, was employed in 2003 at UCLA Healthcare System as a researcher with the UCLA School of Medicine. On October 29, 2003, Zhou received a notice of intent to dismiss him from UCLA Healthcare for job performance reasons unrelated to his illegal access of medical records. That night, Zhou, without any legal or medical reason, accessed and read his immediate supervisor’s medical records and those of other co-workers. For the next three weeks, Zhou’s continued his illegal accessing of patient records and expanded his illegal conduct to include confidential health records belonging to various celebrities. According to court documents, Zhou accessed the UCLA patient records system 323 times during the three-week period, with most of the accesses involving well recognized celebrities.

In a plea agreement filed today, Zhou admitted that he obtained and read private patient health and medical information on four specific occasions after he was formally terminated from the UCLA Healthcare System. Zhou acknowledged that at the time he viewed these patients’ medical information, he had no legitimate reason, medical or otherwise, for obtaining the personal information.

“There is a persistent problem with improper and illegal viewing of medical records by individuals who abuse the access they have as a result of their employment,” Acting United States Attorney George S. Cardona said. “HIPAA’s criminal privacy provisions protect not only celebrities, but all of us from curious neighbors, disgruntled co-workers, and other snoopers.”

Zhou is scheduled to appear in federal court on March 22 to be sentenced by Judge Wistrich. At sentencing, Zhou faces a maximum statutory penalty of four years in federal prison.

“The FBI is committed to investigating violations of HIPAA laws, the compromise of which can cause major financial or emotional distress,” said Steven M. Martinez, Assistant Director in Charge of the FBI in Los Angeles. “These laws exist to protect the privacy that must be afforded to all patients, despite how intriguing that information might be to some with unworthy intentions.”

The UCLA Healthcare System, the UCLA School of Medicine and the UCLA Medical Group fully cooperated in the investigation, which was conducted by the Federal Bureau of Investigation.

Former Executive at Japanese Matchmaking Firm Accused of Stealing Client Data

A former board member of Web, a Japanese matchmaking service, allegedly stole the personal information of about 16,000 members and attempted to sell the data to competing matchmaking firms.  

The executive stole the information in August 2006, just prior to his resignation from the firm.  After a failed attempt to sell the data back to Web, he began offering the data to Web's competitors in a series of emails.

Although the police have been contacted, an arrest has not been made.  However, Web has said it plans to lodge a criminal complaint for the theft.

Source:  AsiaOne News

Contract Worker at the Center of TSA Employee Identity Thefts

As if the Transportation Security Administration (TSA) needed more headlines containing the phrase "security breach", details are coming to light in the investigation of the theft of employee information at Boston's Logan International Airport. 

In December, Tina White and Michael Washington were arrested and charged with identity theft and larceny after a search revealed the pair in possession of a list with TSA employee names.  The information was provided by Washington's niece, a TSA contract employee working in human resources.

The employee identities were sold for $40 each and used to obtain wireless and other utility services.

Full Story

16 Employees Fired for Alleged HIPAA Violations

An article by ABC13 in Houston reports that the Harris County Hospital District terminated 16 employees for HIPAA violations after they accessed the medical records of a fellow employee, Dr. Stephanie Wuest, who had been shot during an attempted robbery.

Read the entire story

T-Mobile Employee Sells Account Details of Thousands of Subscribers

The Information Commissioner's Office (ICO) announced details of an incident involving a mobile telephone company where one or more employees allegedly sold customer details including expiration dates of their contracts to competitors.  Although the ICO did not mention the company by name, the Guardian identified the provider as T-Mobile:

An employee of the phone operator T-Mobile sold the personal records of customers, which included details of when their mobile phone contracts expired. The millions of items of information were then sold on for "substantial sums", the Information Commissioner's Office (ICO) said. Rival networks and mobile phone retailers were then able to use it to try to lure away T-Mobile customers by "cold calling" them.

In the course of it's investigation, the ICO "obtained several search warrants attended a number of premises, and is now preparing a prosecution file".

Sources:

The Information Commissioner's Office

The Guardian