Who Breached: National Institutes of Health
Number Affected: 2500
Information breached: clinical trial information
How: laptop stolen
A laptop containing medical information for 2500 people enrolled in a National Institutes of Health (NIH) clinical trial has been stolen, putting these patients at risk for medical identity fraud. The laptop was stolen from the trunk of a car on February 23rd.
The laptop contained clinical trial data going back 7 years, including names, medical diagnoses, and heart scans. The data was not encrypted, despite government policies that require this precaution. According to the NIH, the first attempt to encrypt the laptop failed, and the laboratory chief named Andrew Arai, who used the laptop, did not follow-up with IT.
You can spot here several errors in procedure: that IT released the laptop despite a failed encryption procedure, that IT records did not trigger a new encryption attempt (this should not be the responsibility of any outside employee to remind the IT personnel to do), and that the security policy failed to train the laboratory chief about proper data handling procedures, such as taking data offsite, and storing it responsibly.
This is particularly surprising in this example, given the added security and privacy precautions put in place to protect the patients who participate in clinical trials:
“The shocking part here is we now have personally identifiable information — name and age — linked to clinical data,” said Leslie Harris, executive director of the Center for Democracy & Technology. “If somebody does not want to share the fact that they’re in a clinical trial or the fact they’ve got a heart disease, this is very, very serious. The risk of identity theft and of revealing highly personal information about your health are closely linked here.”
Patients were notified of the breach last Thursday, almost a month after the laptop went missing (reportedly to minimize ‘undue alarm’).
Here again, a flaw in the security policy becomes apparent. The reporting chain for the incident was incredibly inefficient. After the laptop was reported as stolen (within 3 days), officials in charge of information security at the NIH did not relay the breach to the NHLBI Institutional Review Board (who oversee the well-being of patients in research) until 6 days after the theft. The next step was to review the matter at a board meeting, which was several days later. After voting at said board meeting to send a letter to patients, the matter was not approved until the next board meeting 2 weeks later.
Unfortunately, it has taken a data breach for the NIH to state they will encrypt all computers, require staff security training and no longer store personal information on portable data devices. All of which are existing security policies that the NIH was not compliant with, so their forward-looking statements are not quite as comforting.
Via washington post Tags: nih, national institutes of health, nih data breach, data breach, clininical trial, medical identity theft, medical identity fraud, id theft, fraud, compliance, government security, health security
Today’s oddball piece of security news: house identity theft! What is ‘house identity theft’? The FBI say it’s the result of combining identity theft with mortgage fraud - the result of which is house stealing. How the criminals do it:
Recent Comments
08/28/2008 12:58 am
1 Comment
08/27/2008 09:35 am
1 Comment
08/27/2008 01:52 pm
2 Comments
08/22/2008 01:58 pm
1 Comment
08/18/2008 01:13 pm
1 Comment