Blue Lance InfoSec Blog

ICO hands down first monetary penalties for data breaches

In the UK, the Information Commissioner's Office (ICO) handed down its first monetary penalties in two data breach cases for violations in the Data Protection Act.  

The first penalty, of £100,000, was issued to Hertfordshire County Council for two serious incidents where council employees faxed highly sensitive personal information to the wrong recipients. The first case, involving child sexual abuse, was before the courts, and the second involved details of care proceedings.

The second monetary penalty, of £60,000, was issued to employment services company A4e for the loss of an unencrypted laptop which contained personal information relating to 24,000 people who had used community legal advice centres in Hull and Leicester.

Read the full press release

Indiana AG sues WellPoint for delay in data breach notification

From the Indiana Attorney General's Office Press Release:

The Indiana Attorney General's office today filed a lawsuit against Indianapolis-based WellPoint, Inc. claiming the health insurance provider did not notify their customers or the Attorney General's office in a timely manner following a data breach earlier this year affecting more than 32,000 Hoosiers. Indiana law requires businesses to notify both the individuals potentially affected by a data breach, as well as the Attorney General's office without unreasonable delay. This notification requirement was supported by Attorney General Greg Zoeller and included in House Enrolled Act 1121, which took effect in July 2009.

Applications for insurance policies submitted to WellPoint containing social security numbers, financial information and health records were potentially available to the general public through an unsecured Internet web-site for a period of at least 137 days between October 2009 and March 2010. According to the state's complaint, WellPoint was notified on February 22, 2010 and again on March 8, 2010 that application records containing personal information were accessible through its public website.
WellPoint did not begin notifying customers of the security breach until June 18, 2010. Following news reports of the breach, the Attorney General's office submitted an inquiry to WellPoint and received a response on July 30, 2010. The delays in notice both to customers and to the Attorney General's office are considered unreasonable. The state is seeking $300,000 in civil penalties.

While most inadvertent security breaches do not result in fraud, notifying those affected in a timely manner significantly reduces the risk of identity theft. Situations involving the theft of personal information for the purposes of identity theft most often result in some form of fraud occurring within seven to 10 days. The Attorney General's office has not received any consumer complaints relating to identity theft as a result of the WellPoint data breach.

The Attorney General's Identity Theft Unit continues to investigate the WellPoint data breach and encourages those who may have been affected to perform a credit check and a security freeze to guard against identity theft. By law, security freezes are available for free to residents of Indiana. More information and instructions are available on the Attorney General's website here: http://www.in.gov/attorneygeneral/2411.htm 

Employee snooping costs 5 California hospitals $675K in fines

The California Department of Public Health (CDPH) announced the assessment of fines and penalties of $675,000 to five California hospitals for failing to prevent unauthorized access to confidential patient information.

The following hospitals received penalties:

1. Community Hospital of San Bernardino, San Bernardino, San Bernardino County: The hospital was assessed a $250,000 fine after the facility failed to prevent unauthorized access of 204 patients’ medical information by one employee.
2. Community Hospital of San Bernardino, San Bernardino, San Bernardino County: The hospital was assessed a $75,000 fine after the facility failed to prevent unauthorized access of three patients’ medical information by one employee.
3. Enloe Medical Center, Chico, Butte County: The hospital was assessed a $130,000 fine after the facility failed to prevent unauthorized access of one patient’s medical information by seven employees.
4. Rideout Memorial Hospital, Marysville, Yuba County: The hospital was assessed a $100,000 fine after the facility failed to prevent unauthorized access of 33 patients’ medical information by 17 employees.
5. Ronald Reagan UCLA Medical Center, Los Angeles, Los Angeles County: The hospital was assessed a $95,000 fine after the facility failed to prevent unauthorized access of one patient’s medical information by four employees.
6. San Joaquin Community Hospital, Bakersfield, Kern County: The hospital was assessed a $25,000 fine after the facility failed to prevent unauthorized access of three patients’ medical information by two employees.

Each of the hospitals are required to submit a plan of correction within 10 working days.

Read the press release.

VA launches criminal investigation into employee for downloading patient data

Nextgov reports that the inspector general at the Veterans Affairs Department has launched an investigation into a physician assistant, who allegedly downloaded patient data.

The assistant allegedly recorded two sets of patient data on to a personal laptop for research purposes. One set included three years' worth of patient data and another held 18 years of medical information, according to a source familiar with the incident and who asked not to identified.

There are conflicting reports on how the data was obtained:

Roger Baker, VA's chief information officer, commented on an item about the incident that was posted Monday evening on a Nextgov blog that the physician assistant's laptop was never connected to the VA network and any data she recorded on her laptop was "hand entered."

But the source told Nextgov the VA inspector general is investigating whether the assistant used two thumb drives to transfer the data to the laptop.

No word on how many patients were involved or whether or not they would be contacted.  Hopefully, the VA's IT department has an detailed user audit trail to work with to shed some light on this incident. 

Sources: Nextgov, Open Security Foundation (OSF)

Connecticut AG Sues Healthcare Provider in First Case of State Enforcement Under HITECH

Connecticut Attorney General Richard Blumenthal sued Health Net of Connecticut, Inc. for HIPAA violations stemming from the loss of a portable hard drive containing the health and financial information of approximately 446,000 Connecticut enrollees in May of 2009, and the failure to notify authorities and consumers for at least 6 months.

Additionally, the AG seeks a court order preventing Health Net from continued HIPAA violations by requiring that protected health information stored on portable drives be encrypted.

A subsequent investigation found that the data, which included health records, social security numbers and bank account numbers in over 27 million scanned pages, was not encrypted or otherwise protected from unauthorized access and was viewable on commonly available software.

The case is the first action taken by a state under the HITECH Act, which enables states to enforce HIPAA violations.

Source:  Connecticut Attorney General's Office

Supreme Court Case to Determine Future of Sarbanes-Oxley

On December 7, the U.S. Supreme Court will hear arguments in a case which challenges the constitutionality of the Public Company Accounting Oversight Board (PCAOB); the organization responsible for determining policy, and enforcement of the Sarbanes-Oxley Act.

The plaintiffs in the case (Free Enterprise Fund v.Public Company Oversight Board) assert that the PCAOB, while characterized as a private corporation, exercises broad governmental powers including policy creation and compliance enforcement; in effect, making it a government agency subject to Presidential oversight and control.

While the case is not likely to be the downfall of Sarbanes-Oxley, but some form of change seem to be on the horizon for the legislation.  An amendment currently in the House Financial Services Committee would permanently exempt small publicly traded companies from the attestation requirement of Section 404 of the Sarbanes-Oxley Act.

One Step Closer to Federal Data Breach Notification Requirements

Yesterday, the U.S. Senate Judiciary Commitee passed two bills which set guidelines for data breach notifications at the federal level.

S.139, known as the Data Breach Notification Act, establishes guidelines for data breach notifications for government agencies and business entities as well as enforcement actions.

S.1490 is known as the Personal Data Privacy and Security Act of 2009 and establishes standards for developing and implementing safeguards to protect the security of sensitive personal information.  It also imposes civil penalties for violations of such standards.

The next stop for both bills is a full Senate vote.

The Rising Risk of Insider Threat, Two Ways

Rick Caccia writes for Computerworld on how to address two types of insider threats:

“‘I read about fraud all the time -- hackers, online gangs, angry employees, etc. It seems like it's on the rise. Why is this so hard to detect and how can we prevent fraud in our organization?’
It is true that fraud is increasing, and it does seem that we read about incidents on an almost daily basis. This is a factor of the rise in the amount of sensitive information that is now online, an increased number of online applications that access this information, and the growing number of users who use online services for financial services. The result is more opportunity for fraud, with less effort, so it's no surprise criminals have moved their activities online and that insider-led fraud is on the rise.”

Read the full article here.

Two Violate HIPAA Disclosure Laws During Illegal Drug Scheme

The United States Attorney for the Northern District of Alabama announced on August 28th that Isaac Earl Smith, 38, and Annetra Poole-Moore, 37, have agreed to plead guilty to federal crimes involving healthcare fraud, disclosures prohibited by the Health Insurance Portability and Accountability Act (HIPAA), and aggravated identify theft.
 
Between September 2008 and April 2009, Smith, of Pleasant Grove, and Moore, of Midfield, engaged in a criminal conspiracy to commit health care fraud, according to separate plea agreements filed today in U.S. District Court. During that time, Moore was employed by UnitedHealthcare Inc. (“UHC”) as a claims representative associate.  There, Moore had access to the personal information, including the means of identification, of certain persons enrolled in flexible spending accounts administered by UHC.  Without authorization or approval from UHC, Smith and Moore gained access to the company’s electronic database and obtained names and dates of birth of certain persons who had flexible spending accounts and were also covered by a prescription drug plan sponsored by the Federal Employees Health Benefit Plan (“FEHBP”).
 
The defendants and others used this information to create counterfeit prescriptions.  These prescriptions were then presented to pharmacies for the purpose of illegally obtaining controlled substances, which were then illegally sold to third parties.  By using the stolen identities on the prescriptions, the defendants caused FEHBP’s prescription drug plan to pay for the controlled substances, costing the FEHBP almost $73,000.
 
Smith intends to plead guilty to one count of conspiracy to commit health care fraud, one count of criminally violating the HIPAA disclosure laws, and five counts of aggravated identity theft. 
 
Moore intends to plead guilty to one count of conspiracy to commit health care fraud, one count of criminally violating the HIPAA disclosure laws, and two counts of aggravated identity theft. 
 
Smith and Moore have also agreed to pay $72,746 in restitution to FEHBP and to criminally forfeit the same amount.
 
In addition to the forfeiture, the defendants each face maximum sentences of 10 years in prison and fines of up to $250,000.  The aggravated identity theft charges carry two-year minimum prison sentences.
 

Health Organizations Must Notify Patients of Security Breaches, Even if not Bound by HIPAA

Yesterday, the FTC ruled that web based businesses will be required to notify consumers in the case of a security breach involving electronic health information.  The ruling applies to businesses that offer third-party applications for personal health records and vendors of personal health records.

The new rule is part of the American Recovery and Reinvestment Act of 2009, and was put into place by Congress.  The businesses that will be affected by this rule offer services that are not already subject to HIPAA privacy and security requirements.  A study will be conducted by the Department of Health and Human Services on potential security, privacy, and breach notification requirements for entities not governed by HIPAA regulations, with a report forthcoming by February 2010.  Meanwhile, the FTC ruled that these businesses notify consumers of any breach of the security of their health information.  In addition, any service providers of these businesses that encounter a data breach must notify their client, who will then in turn notify the consumers.

The ruling details content of the breach notification, method of notification, and time constraints.  Should a breach occur involving 500 or more records, it is required that the media be notified as well as the FTC.