14 ms·
2.5M Medical Records Leaked by AI Company
- tmpz22 6y agoHIPPA authorities are going to fine them into oblivion right? Right?
- leetrout 6y agoJail is on the table for HIPAA violations. I am always afraid to mess with medical data.
- hn_throwaway_99 6y agoJail is on the table if you purposefully steal the data. I was interested so searched for examples of actual HIPAA jail time, and in all the cases I could find the conduct was egregious and with clear intent (e.g. https://mazarsusa.com/ledger/jail-time-for-a-hipaa-violation/ https://mazarsusa.com/ledger/jail-time-for-a-hipaa-violation... ). Misconfiguring your S3 buckets isn't going to hit that level, though that could still result in a hefty fine. This of course all assumes that the AI company got access to the data legally to begin with.
- dmix 6y ago2.5M is just a statistic
- peteretep 6y agoIs there any personal liability for the directors Or investors below jail? Going to be a shame if the company is able to just bankrupt out of this
- paulmendoza 6y agoIt seems pretty hard these days to misconfigure and S3 bucket. The default settings are not public.
- drtillberg 6y agoThe article is about auto accident claims data, which is a great clue that HIPAA actually doesn't apply. From a different part of the Internet[1]: "There are certain gaps [in HIPAA coverage], like if a person meets with an accident on a car; the health insurer as well as the auto insurer shall receive the medical bills of that person. The health insurer is responsible for protecting the health data of this person under HIPAA; the auto insurer on the other hand does not hold that duty." [1] https://www.andrealopezv.com/new-age-security-solutions-to-protect-healthcare-data/ https://www.andrealopezv.com/new-age-security-solutions-to-p...
- leetrout 6y agoFascinating.
- dekhn 6y agoThe company is almost certainly not a covered entity, and therefore HIPAA doesn't apply. The amount of bullshit stated around HIPAA is ridiculous
- leetrout 6y agoCould you elaborate with some links or something? What is a covered entity?
- dekhn 6y agohttps://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Covered%20entities%20are%20defined%20in,which%20HHS%20has%20adopted%20standards https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Cov....
- leetrout 6y agoIn the context of this and ignoring the insurance loophole mentioned (which probably applies here as another poster pointed out) I don’t see how this company wouldn’t be covered as a business associate where HIPAA would extend to them even though, as you point out, they aren’t a coveted entity.
- Chris2048 6y agoThen how are they allowed to handle this data?
- dekhn 6y agoHIPAA has a ton of limitations. It doesn't just apply to everybody handling medical data. For example I worked for a biotech and we processed clinical records, HIPAA didn't apply to us but we complied with the regulations anyway.
- deleted 6y ago[deleted]
- croes 6y agoAnd then? They file for insolvency but the data is still out there.
- ycombonator 6y agoSure if they can catch them. Cense is based in India.
- tmp_ta 6y agoThe "AI company" is literally just two guys in India. One is the app developer and the other has a background in business and project management.
- noahmbarr 6y agoIt’s my understanding that you can go to jail for HIPAA related breaches.
- ferros 6y agoI wonder what it will take for data security to ever be taken seriously.
- NegativeLatency 6y agoEnforcement of monetary penalties.
- innagadadavida 6y agoIn this instance the company can declare bankruptcy and the founders and investors can move on to their next gig - perhaps even throw a hapless developer to the authorities. Unless hippa somehow has special provisions. They need to go after the personal wealth of founders and investors to make this a serious crime.
- WrtCdEvrydy 6y agoThat's the thing. If HIPAA could pierce the corporate veil, this could no longer occur. Wanna dick around and not do your job as a founder / investor? Your personal assets are on the line.
- gravypod 6y agoI don't think this is the case. Last I read up you are personally liable for HIPAA violations. If you do something, knew it wasn't something you should do, and refused to fix it, stuff gets really bad. To stay safe with medical data, however, you basically just need to hit whatever standard you think is reasonable. There's no established standards other than: 1. "PII" encrypted during storage/transfer. 2. Customers can request a download of their data. 3. Customers can request you delete ALL their data. 4. Fast track sec fixes above all other company goals.
- unishark 6y agoSomeone with a medical license and the legal ability to collect and secure data gave it to these clowns who clearly had no idea what they were doing.
- est31 6y agoThe issue with such highly sensitive data is that it's just data. Probably a few GB. Many AAA game downloads nowadays are much bigger than that. Even if they protected their database (article says they didn't), it's easy to break into a place that has all the data collected compared to collecting it yourself from doctors all over the country. There's an easy solution to this: don't concentrate highly sensitive data. With nuclear material, the IAEA has set up a sophisticated surveillance regime to make sure that countries use nuclear technology for peaceful purposes. Everything that contains nuclear material is video surveilled. They collect probes and check composition to prevent someone taking, say 1%, replacing it with filler material, and then mixing it again. If we concentrate data, we should employ such surveillance regimes for highly enriched sensitive data as well.
- sebmellen 6y agoDecentralization and self-sovereign identity are the only way to solve this, IMO. I'll sing the praises of Estonia on this one: their X-Road system for storing sensitive data is brilliant. I'm working on a team writing an in-depth whitepaper on this topic right now, I'd love to link it. Perhaps when it's published.
- reustle 6y ago> This database was set to open and visible in any browser (publicly accessible) and anyone could edit, download, or even delete data without administrative credentials. > there were multiple references to an artificial intelligence company called Cense. The records were labeled as staging data and we can only speculate that this was a storage repository intended to hold the data temporarily while it is loaded into the AI Bot or Cense’s management system.
- exabrial 6y agoMove fast and break things.
- eggsmediumrare 6y agoThis happens because execs are cheap, farm out everything to dev shops, and the beleaguered, underqualified devs power out nonsense code to keep up with the arbitrary point quota for the sprint. No one knows how the whole system works, reqs change constantly so poorly-planned updates degrade the whole thing, and all the while actual patient data gets mixed into the big soupy pot of bullshit. Anyone who raises concerns about the situation gets to be the "compliance officer," thus passing responsibility from the people benefitting from the situation to the people who just want to keep their job. I wonder what would happen if devs could say to their boss "no, this won't be released until we're confident in it" with legally enforced immunity to consequences.
- adrianpike 6y agoIn this case, according to their about page, it looks like the execs are the beleaguered, underqualified devs.
- mars4rp 6y agoIt is about the culture, doesn't matter who sits at the seat.
- derivagral 6y agoSomeone has to drive that culture though, and that's classically the execs job, right?
- iecheruo 6y agoWhat you're describing is a professional licensed engineer who has to among other things take out insurance because they are ultimately responsible for their decisions.
- pnathan 6y agoSoftware development is long overdue for a legally professional software engineer license and certification process. I imagine it's going to happen down the road after something important gets burnt.
- maybelsyrup 6y agoI'm a medical researcher, and I've worked with exactly this sort of data. The number of hoops I had to jump through to even be allowed on the project was insane. Background checks, legal forms of all kinds, trainings on how to keep the data secure. Fingerprint locked rooms. Access control. And most importantly: the data themselves were air-gapped. If I fucked up on this scale, jail would be the least of my worries. I'd never work again. I'd be professionally shunned forever, with no hope of redemption once my name is attached to the incident in some Google search. No more grants, no more collaborations, no nothing. I'd be ruined. Frankly I'd be begging to be let into prison; where else am I gonna be able to eat? Nothing will happen to these people.
- mvn9 6y agoSomebody has to work for those who collect all the leaked data and use it for whatever is possible. You wouldn't earn fame but money for being a data pirate. Or you create a company and start with a fresh name. On the internet, nobody knows that you are a dog.
- g_p 6y agoIn contrast here, this data likely came from an insurance company, which got access to the data from their claims. They don't inherently care about these people, because they're all seen as "costs" to the balance sheet profits for the year. Sending their data out for "AI" to try and learn how to predict which claims can be rejected is a rational thing to do, in their eyes, whatever the cost (to those concerned and their data), since it might help improve their bottom line by rejecting claims faster. At least there's a cynical take on this. They have no inherent interest in protecting this data, absent external pressures or legislation that imposes penalties. It strikes me the real issue is the lack of negative inventive for people and businesses who screw up with data. If you build something physical that falls down and hurts people, your investor money ends up paying compensation. In tech though, the goal seems to be to make the revenues without ever touching the responsibility. The story over the weekend of Amazon trying to avoid being deemed liable as a seller for goods they ship, (often) deliver, warehouse, market, dispatch and receive seems to sum this up. A race to the bottom when it comes to protections - Amazon effectively is a shop selling goods from others, as it all happens on their terms. We see similar in physical retail where the manufacturer or reseller has a retention of title over goods in the store, and that doesn't affect the store being responsible. It seems like the "being responsible for what you build" is very much lacking in tech companies, due to lack of external regulation to achieve it. Same here in this case.
- abhisuri97 6y agoIt's insane that medical data has become so highly valued on the black market (I guess because of the amount of information stored with a single patient such as SSNs, maybe billing info, addresses, etc). Yet, it seems that the healthcare industry is not well prepared to deal with a huge amount of sensitive data (and doesn't seem to be obfuscating it when sharing with vendors). Ironically, I feel that the most secure way of doing patient record keeping is keeping everything physical.
- vmception 6y agoThe only market signal here is that bug bounties are undervalued A small chance of a unilaterally set arbitrarily priced reward is being continually curb stomped by a two sided marketplace.
- colechristensen 6y agoThe healthcare industry is prepared just fine. Regulations exist for how you can share data with vendors, when you are required to remove identifiable information, and how to share unredacted information with legal agreements, audits, etc. When this doesn’t happen right there are penalties and notifications. If correct, a breach of this magnitude is entirely possibly a death penalty for the businesses involved, and criminal liability. If it isn’t, then it isn’t the business sector being unprepared or the regulations being missing but the legal system failing to follow through.
- fermienrico 6y agoWe need some kind of monetary punishment for not protecting user data. Simultaneously, we need to give tax breaks for companies that have had a streak of many years of taking security seriously without leaks. Increasing bug bounties doesn't happen when the executives do not have a culture of security in their company. That's a loss cost center for them. We need a different incentives that go beyond just rewarding hackers with bug bounties.
- colechristensen 6y agoMandatory data breech insurance with prescribed penalties paid to affected parties by the insurance companies. Insurance is a great aligner is financial incentives.
- hn_throwaway_99 6y agoWow, let's just say from their website I'm impressed they got anyone to give them data at all. That site just screams "Take some programming tasks that require a minimum of data analysis and call it AI." From their product page I'd take they easy bet that they're just wrapping some cloud providers bot SDK and calling it their chatbot. Given the lack of professionalism on this site I am unsurprised about their security issues.
- twodave 6y agoI'm not surprised in the least. I've sat in multiple meetings with execs whose boards have told them, "We need to get into this AI game, it could solve all our scaling problems!" Often both the board and the exec are clueless as to what AI is capable of or can offer their business specifically, they begin talking with vendors. The execs feel they need to show they at least made an effort, and these companies branding themselves AI are easily able to take advantage. They market their products as these complex decision-making/analytical systems, but most of them are either glorified reporting dashboards or just an integration point/pipeline builder for a set of services. The business buying this stuff doesn't need any of it to become more efficient, they are effectively spending the money to be able to generate the hype of saying, "We're in the AI space".
- yalogin 6y agoThis could be somewhat prevented if companies acquiring the data are legally barred from sharing it to other entities without getting a written statement from that entity that they have a secure mechanism to store and use it. Right now the company that did the shitty job is going to get a slap on the wrist at best. But the company that shared that data with this one is going free and even got to keep the money they got from this.
- josephpmay 6y agoThat’s not true at all for medical data. There are very strict data sharing agreement requirements in HIPPA, and there will likely be millions of dollars worth of fines for both parties, and it’s not inconceivable that someone could go to jail. HIPPA violations are taken really seriously.
- cabaalis 6y agoWhat you are referring to is a Business Associate Agreement, and is indeed already required by law.
- ycombonator 6y agoCense is an Indian outsourcing outfit.
- Santosh83 6y agoAnd in this scenario of technical and political incompetence, more so in some places than others, the Indian government has recently proposed to compile the medical data of ALL it's 1.3 billion citizens into a single database. It's only a matter of time before the whole thing gets leaked out, not to mention that compiling such data in the first place ought to be none of the govt's business. Such data is simply too powerful to be entrusted into the hands of any single party, political or corporate.
- deleted 6y ago[deleted]
- divbzero 6y ago> Medical data is the most valuable and it is bought and sold daily on the Dark Web. The infosec company Trustwave published a report that valued medical records at $250 per record on the black market, while credit cards sold for $5.40 per record. Why can medical records be sold for so much? What value do they provide to the buyers?
- swiley 6y agoAlso how is it authenticated? Could I make up garbage and sell it for $250/record?
- zentiggr 6y agoYou can, right up until you get kneecapped by a disgruntled customer.
- nitwit005 6y agoYou can bill insurance companies for fake treatments.
- octoberfranklin 6y agoAnd when you get caught, you lose your medical license. Can you really fake bill enough before getting caught to be worth burning an M.D.? I never really understood this angle. Say the insurers use a phone call to verify 1% of treatments with the patient. Say 20% of those calls are answered and produce a coherent reply. That ought to be enough to make the expected payoff negative. Either way, this problem isn't unique to the medical world. Every other industry has to prevent fraudulent invoicing.
- deleted 6y ago[deleted]
- hobofan 6y agoI assume that if you do fake billing, you wouldn't do that with your own identity, so the risk of losing a medical license isn't there.
- noyesno 6y agoQuestion for devs working in the medical industry: what are the regulations and standards that you have to follow when storing and handling patient data in your country/region?
- yoaviram 6y agoIf this sort of incompetence bothers you, I suggest sending a CCPA (if you're in California) or a GDPR (EU) deletion request to this company. This will protect you from the next time it happens (and it will), as well as incur some not-insignificant cost of handling you're request. Here is a simple way to do this: https://yourdigitalrights.org/d/cense.ai https://yourdigitalrights.org/d/cense.ai (disclaimer I'm the co-founder of this free, nonprofit service).
- watermelon0 6y agoMinor nitpick: It does not actually guarantee that the data is deleted, but they could face a very high fine, if it turns out that they didn't respect your request.
- yoaviram 6y agoYou're right, though I still think it's worth the effort.
- deleted 6y ago[deleted]
- mlang23 6y agoIncidents like these are the reason why I opted out of our e-health record effort.
- cwhiz 6y agoSend the executives to prison and shut down the company.
- kamyarg 6y agoDoes anyone know of a "shame wall" for people/companies responsible for PII leaks? I think if there are at least social consequences some managers will start taking these stuff more seriously. Just asking, probably it is not even possible with all the blanket "right to be forgotten" laws.
- stmw 6y agoThe significance of medical records - and the importance of maintaining their privacy - is often overlooked. This is far different than leaked password hashes or addresses or credit numbers - it's information that cannot be changed or effectively de-identified. Any company that accumulates medical records on that scale must be very careful. I'm biased (as a co-founder of a major healthcare secure cloud software compnay), but it is hard work and all-too-often neglected work.