6 ms·

Millions of Americans’ Medical Images and Data Are Available on the Internet

86 points by jph00 7y ago

zaroth 7y ago
It sounds like the underlying cause in this particular case is a piece of software is running an open port that a lot of people don't even realize is there, and for some reason is exposed outside the firewall. Take the case of "Offsite Image" as an example; > The company referred ProPublica to its tech consultant, who at first defended Offsite Image’s security practices and insisted that a password was needed to access patient records. The consultant, Matthew Nelms, then called a ProPublica reporter a day later and acknowledged Offsite Image’s servers had been accessible but were now fixed. > “We were just never even aware that there was a possibility that could even happen,” Nelms said. That sounds like to me that they build a custom front-end to serve the images which was doing password authentication and billing, but failed to notice the underlying image server software was exposed and responding to queries with no authentication. I'm guessing somewhere there's a configuration file which has a default IP binding of 0.0.0.0 and a blank password field.
- dsr_ 7y ago
  There's an entire industry of consultants who will help your business pass a PCI audit, and everyone who handles payments requires a PCI audit annually. There should be equivalent standards and audits and consultants for private information of all sorts, including healthcare info.
  - auspex 7y ago
    There is HIPPA
    - deleted 7y ago
      [deleted]
    - dragonwriter 7y ago
      No, there's HIPAA, but it is actually weaker than lots of people think (in part because of required regs that the executive branch simply has not bothered to develop, in part because the regs that do exist have big gaping escape-from-liability holes in them.)
  - tialaramex 7y ago
    Audit is a paperwork exercise. There are no Wizard-like beings who can spot the misconfiguration of a Java servlet or have an informed opinion about your RSA key sizes. When someone who isn't sure of the difference between GitHub and Jira picks "Yes" we do have appropriate controls in place for network security it is Nobody's job to open a developer console and copy-paste raw image URLs to prove they aren't actually insecure.
    - partialrecall 7y ago
      It's entirely possible to create systems of auditing that do actually involve in depth investigation and verification.
      - walrus01 7y ago
        The question is how many businesses really want to pay the money for somebody to audit their entire network security through the OSI stack at layers 1-7, versus doing an audit to pay lip service to PCI compliance and check some boxes in a form.
        partialrecall 7y ago
        It shouldn't be a matter of choice for them. Obviously, if left to their own devices, they will fail to protect people.
        dragonwriter 7y ago
        > The question is how many businesses really want to pay the money for somebody to audit their entire network security through the OSI stack at layers 1-7 If there was a mandatory requirement (e.g., had it been incorporated in the HIPAA certification requirements that the ACA required the Department of Health and Human Services to have in place and in effect for some HIPAA transactions by the end of 2013, and for all HIPAA data by the end of 2015), the question would be equivalent to “how many businesses want to be legally permitted to conduct business involving HIPAA-covered transactions and data”. Or course, not only was that not in the regs, the regs were late, and withdrawn without going into effect, so there are no (not even lip service audit) certification requirements for entities in health care.
  - bilbo0s 7y ago
    >There should be equivalent standards and audits and consultants for private information of all sorts, including healthcare info. There is. In fact, that standard and the regulations attending it were tailor made for healthcare information. These guys are in deep doo doo, and based on the way they talk, it's not clear to me that they understand that fact. Number one, they took the job. The job of holding that data in the first place brings with it certain iron clad legal obligations. It's not something that some startup or random company should just launch off into willy nilly. Number two, having taken the job, they didn't properly secure the data. Which is actually a federal crime. Which brings me to number three. The fact that they publicly communicate these facts in as laissez faire a fashion as they do really does betray not only a level of technological ineffectiveness, but also a level of legal naiveté that borders on imbecilia.
    - azinman2 7y ago
      Yup — these are HIPAA violations that can carry jail time if malicious, an certainly large fines if not.
      - dragonwriter 7y ago
        No, if they aren't due to “willful neglect” and are corrected within a reasonable time (for which the minimum allowed is 30 days after the offendig party either knew or reasonably should have known of the violation, but more can be allowed based on circumstances), no monetary penalties can be imposed for HIPAA violations. See 45 CFR 160.410(c).
        zaroth 7y ago
        And how could they “reasonably” not have known they were broadcasting these records to the world? To take the one thing you are storing and put it on the internet for anyone to access? Maybe this underlying software which has a port open does so without informing anyone that it’s doing it? I can’t quite believe that. So that leaves me thinking that at some point, someone did not RTFM. The analogy would be something like running a Bitcoin wallet service and leaving your bitcoind RPC bound to 0.0.0.0 with no password.
  - dragonwriter 7y ago
    > There should be equivalent standards and audits and consultants for private information of all sorts, including healthcare info. Healthcare doesn't have mandatory certification/audits (there is a legislative requirement to adopt regulations for it by a date that has long past, but it is one of many required rules under HIPAA that the executive branch has simply elected not to come up with regs for on the legally-required timeline.) OTOH, at a minimum this triggers the breach notification requirements under HIPAA, and will also trigger scrutiny on the degree to which the breach results willful neglect of security.
- nkrisc 7y ago
  > We were just never even aware that there was a possibility that could even happen I would love know exactly what they meant by that, because the way it's worded makes it sound like this is their first experience with computers.
lostmsu 7y ago
Finally I could see my raw records without going through the beuracratical shenanigans.
rainyMammoth 7y ago
Nothing scares me more than my medical records on internet. I have close to zero confidence into any of the hospitals or medical companies to implement their IT securely.
- Real_S 7y ago
  The only thing worse might be if you found your DNA available openly on the internet [0]. [0] https://www.bloomberg.com/news/articles/2019-07-09/dna-testing-service-exposed-thousands-of-customer-records-online https://www.bloomberg.com/news/articles/2019-07-09/dna-testi...
  - dekhn 7y ago
    you can find a copy of my genome right here: https://my.pgp-hms.org/profile/hu80855C https://my.pgp-hms.org/profile/hu80855C (but I put it there)
- earthboundkid 7y ago
  I've met people whose job is to put honeypots on hospital networks to detect ransomware installation attempts. They supposedly have a very short response time SLA, like "if there's bad network activity, we will call your administrator within 5 minutes." It's interesting that job exists, since the ransomware mostly uses old exploits that shoulda been patched anyway.
  - aperrien 7y ago
    One of the problems is that many of the medical devices on hospital networks have badly outdated software, that runs proprietary applications. There should be a better job done by vendors to clean that up, but no-one seems interested in supporting this once the sale is made. Sometimes the IT staff simply have their hands tied, and network isolation is the best they can do, at least for medical devices. Billing and file sharing vendors should on the other hand have active maintenance contracts to prevent exactly this.
    - 7y ago
catacombs 7y ago
I'm shocked Jeff Larson is back at ProPublica after the debacle he and Sue Gardner caused by removing Julia Angwin as editor in chief at The Markup earlier this year. I'm guessing he might be freelancing or contracting, but he does have a ProPublica staff page. I'd love for anyone with knowledge about this to chime in.
LinuxBender 7y ago
If my images are on the internet, then I expect crowd-sourcing of doctors and scientists to tell me everything that is breaking / broken in my body. ;-)
roywiggins 7y ago
It sounds like these are DICOM servers being exposed to the internet. DICOM is the standard file format for medical images, and there's also a DICOM server standard. Medical equipment sends images to DICOM servers so your ultrasound (or whatever) can be archived and stored in your medical records. The generic term is a PACS ("Picture Archiving and Communication System") but since equipment speak DICOM, they're always(?) DICOM servers. DICOM servers are often not very secured, so if you allow the internet to talk to them, you're in for a bad time.
- taborj 7y ago
  Most of the DICOM providers I've worked with assume that the clinic will be handling security, as the images are stored on a local DICOM server, though lately there's been much more emphasis on setting up a VPN between the clinic and the PACS/DICOM provider's cloud-based system.
  - roywiggins 7y ago
    It makes sense. You can't exactly update dicom clients easily so really there's no universe where the data should be passing over the internet without wrapping it all in a VPN. There's not much point in trying to secure it since that might just encourage people to expose it to the internet...
jkao-propublica 7y ago
Hey folks -- Jeff Kao at ProPublica here. What was most frustrating to me while reporting this story, was that a researcher had written about this exact problem (after scanning ipv4 for the port) back in 2016. HIPAA is one of the only federal data privacy laws w/ teeth, and this type of obvious insecurity is pretty inexcusable. Thanks for reading. If you think there's something we should look into, we'd love to hear about it. :-) P.S. As a fast.ai student -- thanks Jeremy for posting!
olliej 7y ago
Sooo HIPPA lawsuits any body?

86 points by jph00 7y ago

It sounds like the underlying cause in this particular case is a piece of software is running an open port that a lot of people don't even realize is there, and for some reason is exposed outside the firewall. Take the case of "Offsite Image" as an example; > The company referred ProPublica to its tech consultant, who at first defended Offsite Image’s security practices and insisted that a password was needed to access patient records. The consultant, Matthew Nelms, then called a ProPublica reporter a day later and acknowledged Offsite Image’s servers had been accessible but were now fixed. > “We were just never even aware that there was a possibility that could even happen,” Nelms said. That sounds like to me that they build a custom front-end to serve the images which was doing password authentication and billing, but failed to notice the underlying image server software was exposed and responding to queries with no authentication. I'm guessing somewhere there's a configuration file which has a default IP binding of 0.0.0.0 and a blank password field.

dsr_ 7y ago
There's an entire industry of consultants who will help your business pass a PCI audit, and everyone who handles payments requires a PCI audit annually. There should be equivalent standards and audits and consultants for private information of all sorts, including healthcare info.
- auspex 7y ago
  There is HIPPA
  - deleted 7y ago
    [deleted]
  - dragonwriter 7y ago
    No, there's HIPAA, but it is actually weaker than lots of people think (in part because of required regs that the executive branch simply has not bothered to develop, in part because the regs that do exist have big gaping escape-from-liability holes in them.)
- tialaramex 7y ago
  Audit is a paperwork exercise. There are no Wizard-like beings who can spot the misconfiguration of a Java servlet or have an informed opinion about your RSA key sizes. When someone who isn't sure of the difference between GitHub and Jira picks "Yes" we do have appropriate controls in place for network security it is Nobody's job to open a developer console and copy-paste raw image URLs to prove they aren't actually insecure.
  - partialrecall 7y ago
    It's entirely possible to create systems of auditing that do actually involve in depth investigation and verification.
    - walrus01 7y ago
      The question is how many businesses really want to pay the money for somebody to audit their entire network security through the OSI stack at layers 1-7, versus doing an audit to pay lip service to PCI compliance and check some boxes in a form.
      - partialrecall 7y ago
        It shouldn't be a matter of choice for them. Obviously, if left to their own devices, they will fail to protect people.
      - dragonwriter 7y ago
        > The question is how many businesses really want to pay the money for somebody to audit their entire network security through the OSI stack at layers 1-7 If there was a mandatory requirement (e.g., had it been incorporated in the HIPAA certification requirements that the ACA required the Department of Health and Human Services to have in place and in effect for some HIPAA transactions by the end of 2013, and for all HIPAA data by the end of 2015), the question would be equivalent to “how many businesses want to be legally permitted to conduct business involving HIPAA-covered transactions and data”. Or course, not only was that not in the regs, the regs were late, and withdrawn without going into effect, so there are no (not even lip service audit) certification requirements for entities in health care.
- bilbo0s 7y ago
  >There should be equivalent standards and audits and consultants for private information of all sorts, including healthcare info. There is. In fact, that standard and the regulations attending it were tailor made for healthcare information. These guys are in deep doo doo, and based on the way they talk, it's not clear to me that they understand that fact. Number one, they took the job. The job of holding that data in the first place brings with it certain iron clad legal obligations. It's not something that some startup or random company should just launch off into willy nilly. Number two, having taken the job, they didn't properly secure the data. Which is actually a federal crime. Which brings me to number three. The fact that they publicly communicate these facts in as laissez faire a fashion as they do really does betray not only a level of technological ineffectiveness, but also a level of legal naiveté that borders on imbecilia.
  - azinman2 7y ago
    Yup — these are HIPAA violations that can carry jail time if malicious, an certainly large fines if not.
    - dragonwriter 7y ago
      No, if they aren't due to “willful neglect” and are corrected within a reasonable time (for which the minimum allowed is 30 days after the offendig party either knew or reasonably should have known of the violation, but more can be allowed based on circumstances), no monetary penalties can be imposed for HIPAA violations. See 45 CFR 160.410(c).
      - zaroth 7y ago
        And how could they “reasonably” not have known they were broadcasting these records to the world? To take the one thing you are storing and put it on the internet for anyone to access? Maybe this underlying software which has a port open does so without informing anyone that it’s doing it? I can’t quite believe that. So that leaves me thinking that at some point, someone did not RTFM. The analogy would be something like running a Bitcoin wallet service and leaving your bitcoind RPC bound to 0.0.0.0 with no password.
- dragonwriter 7y ago
  > There should be equivalent standards and audits and consultants for private information of all sorts, including healthcare info. Healthcare doesn't have mandatory certification/audits (there is a legislative requirement to adopt regulations for it by a date that has long past, but it is one of many required rules under HIPAA that the executive branch has simply elected not to come up with regs for on the legally-required timeline.) OTOH, at a minimum this triggers the breach notification requirements under HIPAA, and will also trigger scrutiny on the degree to which the breach results willful neglect of security.
nkrisc 7y ago
> We were just never even aware that there was a possibility that could even happen I would love know exactly what they meant by that, because the way it's worded makes it sound like this is their first experience with computers.

lostmsu 7y ago

Finally I could see my raw records without going through the beuracratical shenanigans.

rainyMammoth 7y ago

Nothing scares me more than my medical records on internet. I have close to zero confidence into any of the hospitals or medical companies to implement their IT securely.

Real_S 7y ago
The only thing worse might be if you found your DNA available openly on the internet [0]. [0] https://www.bloomberg.com/news/articles/2019-07-09/dna-testing-service-exposed-thousands-of-customer-records-online https://www.bloomberg.com/news/articles/2019-07-09/dna-testi...
- dekhn 7y ago
  you can find a copy of my genome right here: https://my.pgp-hms.org/profile/hu80855C https://my.pgp-hms.org/profile/hu80855C (but I put it there)
earthboundkid 7y ago
I've met people whose job is to put honeypots on hospital networks to detect ransomware installation attempts. They supposedly have a very short response time SLA, like "if there's bad network activity, we will call your administrator within 5 minutes." It's interesting that job exists, since the ransomware mostly uses old exploits that shoulda been patched anyway.
- aperrien 7y ago
  One of the problems is that many of the medical devices on hospital networks have badly outdated software, that runs proprietary applications. There should be a better job done by vendors to clean that up, but no-one seems interested in supporting this once the sale is made. Sometimes the IT staff simply have their hands tied, and network isolation is the best they can do, at least for medical devices. Billing and file sharing vendors should on the other hand have active maintenance contracts to prevent exactly this.
  - 7y ago

catacombs 7y ago

I'm shocked Jeff Larson is back at ProPublica after the debacle he and Sue Gardner caused by removing Julia Angwin as editor in chief at The Markup earlier this year. I'm guessing he might be freelancing or contracting, but he does have a ProPublica staff page. I'd love for anyone with knowledge about this to chime in.

LinuxBender 7y ago

If my images are on the internet, then I expect crowd-sourcing of doctors and scientists to tell me everything that is breaking / broken in my body. ;-)

roywiggins 7y ago

It sounds like these are DICOM servers being exposed to the internet. DICOM is the standard file format for medical images, and there's also a DICOM server standard. Medical equipment sends images to DICOM servers so your ultrasound (or whatever) can be archived and stored in your medical records. The generic term is a PACS ("Picture Archiving and Communication System") but since equipment speak DICOM, they're always(?) DICOM servers. DICOM servers are often not very secured, so if you allow the internet to talk to them, you're in for a bad time.

taborj 7y ago
Most of the DICOM providers I've worked with assume that the clinic will be handling security, as the images are stored on a local DICOM server, though lately there's been much more emphasis on setting up a VPN between the clinic and the PACS/DICOM provider's cloud-based system.
- roywiggins 7y ago
  It makes sense. You can't exactly update dicom clients easily so really there's no universe where the data should be passing over the internet without wrapping it all in a VPN. There's not much point in trying to secure it since that might just encourage people to expose it to the internet...

jkao-propublica 7y ago

Hey folks -- Jeff Kao at ProPublica here. What was most frustrating to me while reporting this story, was that a researcher had written about this exact problem (after scanning ipv4 for the port) back in 2016. HIPAA is one of the only federal data privacy laws w/ teeth, and this type of obvious insecurity is pretty inexcusable. Thanks for reading. If you think there's something we should look into, we'd love to hear about it. :-) P.S. As a fast.ai student -- thanks Jeremy for posting!

olliej 7y ago

Sooo HIPPA lawsuits any body?