5 ms·

It's the norm in healthcare (HIPAA), disclosure is required for breaches that affect 500+ persons, and even <500 person breaches have to be reported annually to

It's the norm in healthcare (HIPAA), disclosure is required for breaches that affect 500+ persons, and even <500 person breaches have to be reported annually to HHS and to the individual at the time of discovery. https://www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-MLN/MLNProducts/Downloads/HIPAAPrivacyandSecurityTextOnly.pdf https://www.cms.gov/Outreach-and-Education/Medicare-Learning... edit: less-than sign wrong way

charleselegans 8y ago
IANAL but it doesn't seem that the way they define a breach (https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html https://www.hhs.gov/hipaa/for-professionals/breach-notificat...) includes issues that provably haven't been exploited.
dv_dt 8y ago
That's a requirement in general for CA. https://www.oag.ca.gov/privacy/databreach/reporting https://www.oag.ca.gov/privacy/databreach/reporting If there is a reasonable belief that data was exposed, all of the exposed CA residents need to be notified, and if > 500, the Atty General of CA needs to additionally be notified.
- russell_h 8y ago
  Is there a required timeframe for doing so?
- tptacek 8y ago
  Again, that's breaches, not vulnerabilities. Literally every company has vulnerabilities.
  - dv_dt 8y ago
    Agreed! Apologies, as I think my use of the term "exposed" left that ambiguous. I should have used the original term "acquired". The first line from the link says the following: > California law requires a business or state agency to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person. With links to more specifics in the CA Civil code.
reificator 8y ago
> It's the norm in healthcare (HIPAA), disclosure is required for breaches that affect 500+ persons, and even <500 person breaches have to be reported annually to HHS and to the individual at the time of discovery. > https://www.cms.gov/Outreach-and-Education/Medicare-Learning...* https://www.cms.gov/Outreach-and-Education/Medicare-Learning... > edit: less-than sign wrong way* Breaches, not vulnerabilities. The discussion is not whether or not breaches should be disclosed[0], but whether newly discovered and believed-to-be-unexploited vulnerabilities should be disclosed. [0]: They should of course, after a reasonable period in which to patch the vulnerability used.
- chii 8y ago
  > believed-to-be-unexploited vulnerabilities you cannot prove the negative (realistically). If you have a vulnerability, you must treat it as though it has been exploited.
  - craigds 8y ago
    Sometimes you can, if you have comprehensive logs that cover it. edit: Within reason, anyway. Obviously if your vulnerability includes write access to logs or something then you're poked.
    - yebyen 8y ago
      I think in this particular case, their policy statement in the sister article from Google blog indicates they couldn't really say that in this case. > We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks. That means we cannot confirm which users were impacted by this bug. However, we ran a detailed analysis over the two weeks prior to patching the bug, and from that analysis, the Profiles of up to 500,000 Google+ accounts were potentially affected. Our analysis showed that up to 438 applications may have used this API. ^ the above statement, but couched with this: > We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any Profile data was misused.
  - tptacek 8y ago
chimeracoder 8y ago
> It's the norm in healthcare (HIPAA), disclosure is required for breaches that affect 500+ persons, and even <500 person breaches have to be reported annually to HHS and to the individual at the time of discovery. It is required by law to report breaches of data, though I can assure you that in practice, this does not happen nearly as often as you'd expect or hope. There is, however, no requirement to disclose vulnerabilities for which there is no evidence of exploitation or data breach, or to disclose vulnerabilities that were provably never exploited.
DoreenMichele 8y ago
I used to write those letters when I worked in insurance. They had to be reviewed by legal, needed to make it clear what level of threat was involved without divulging certain kinds of info and only occurred when an actual breach of some sort had happened. In my case, it was usually not a computer issue. It was usually a case of "We sent a check or letter to the wrong address" and it was weirdly common for the reason to be "Because your dad, brother or cousin with a similar name and address also has a policy with us and you people are nigh impossible to tell apart." And we couldn't say anything like that. Point being that divulging the issue comes with risks of making the problem worse. So it's not as simple and straight forward as it seems.

charleselegans 8y ago

IANAL but it doesn't seem that the way they define a breach (https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html https://www.hhs.gov/hipaa/for-professionals/breach-notificat...) includes issues that provably haven't been exploited.

dv_dt 8y ago

That's a requirement in general for CA. https://www.oag.ca.gov/privacy/databreach/reporting https://www.oag.ca.gov/privacy/databreach/reporting If there is a reasonable belief that data was exposed, all of the exposed CA residents need to be notified, and if > 500, the Atty General of CA needs to additionally be notified.

russell_h 8y ago
Is there a required timeframe for doing so?
tptacek 8y ago
Again, that's breaches, not vulnerabilities. Literally every company has vulnerabilities.
- dv_dt 8y ago
  Agreed! Apologies, as I think my use of the term "exposed" left that ambiguous. I should have used the original term "acquired". The first line from the link says the following: > California law requires a business or state agency to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person. With links to more specifics in the CA Civil code.

reificator 8y ago

> It's the norm in healthcare (HIPAA), disclosure is required for breaches that affect 500+ persons, and even <500 person breaches have to be reported annually to HHS and to the individual at the time of discovery. > https://www.cms.gov/Outreach-and-Education/Medicare-Learning...* https://www.cms.gov/Outreach-and-Education/Medicare-Learning... > edit: less-than sign wrong way* Breaches, not vulnerabilities. The discussion is not whether or not breaches should be disclosed[0], but whether newly discovered and believed-to-be-unexploited vulnerabilities should be disclosed. [0]: They should of course, after a reasonable period in which to patch the vulnerability used.

chii 8y ago
> believed-to-be-unexploited vulnerabilities you cannot prove the negative (realistically). If you have a vulnerability, you must treat it as though it has been exploited.
- craigds 8y ago
  Sometimes you can, if you have comprehensive logs that cover it. edit: Within reason, anyway. Obviously if your vulnerability includes write access to logs or something then you're poked.
  - yebyen 8y ago
    I think in this particular case, their policy statement in the sister article from Google blog indicates they couldn't really say that in this case. > We made Google+ with privacy in mind and therefore keep this API’s log data for only two weeks. That means we cannot confirm which users were impacted by this bug. However, we ran a detailed analysis over the two weeks prior to patching the bug, and from that analysis, the Profiles of up to 500,000 Google+ accounts were potentially affected. Our analysis showed that up to 438 applications may have used this API. ^ the above statement, but couched with this: > We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any Profile data was misused.
- tptacek 8y ago

chimeracoder 8y ago

> It's the norm in healthcare (HIPAA), disclosure is required for breaches that affect 500+ persons, and even <500 person breaches have to be reported annually to HHS and to the individual at the time of discovery. It is required by law to report breaches of data, though I can assure you that in practice, this does not happen nearly as often as you'd expect or hope. There is, however, no requirement to disclose vulnerabilities for which there is no evidence of exploitation or data breach, or to disclose vulnerabilities that were provably never exploited.

DoreenMichele 8y ago

I used to write those letters when I worked in insurance. They had to be reviewed by legal, needed to make it clear what level of threat was involved without divulging certain kinds of info and only occurred when an actual breach of some sort had happened. In my case, it was usually not a computer issue. It was usually a case of "We sent a check or letter to the wrong address" and it was weirdly common for the reason to be "Because your dad, brother or cousin with a similar name and address also has a policy with us and you people are nigh impossible to tell apart." And we couldn't say anything like that. Point being that divulging the issue comes with risks of making the problem worse. So it's not as simple and straight forward as it seems.