4 ms·
Health care data breach affects over 600k patients, Illinois agency says
- xbar 10mo agoThe last time this happened, did the AG prosecute the person who discovered the vulnerable data?
- larrymcp 10mo agoAh, I think I recall the story you're referring to: reporter Josh Renaud of the St. Louis Post-Dispatch discovered that a public web site was exposing Social Security numbers of teachers in Missouri. He notified the site's administrators, and later published a story about the leak after it was fixed. The governor of Missouri at the time, Mike Parson, called him a hacker and advocated prosecuting him. Fortunately the prosecutor's office declined to file charges though.
- cosmotic 10mo agoI'm sure they "take security very seriously".
- A4ET8a8uTh0_v2 10mo agoI will admit that a level of fatigue has reached me as well. I am not even sure what would be an appropriate remedy at this point. My information has been all over the place given multiple breaches the past few years ( and, I might add, my kid's info too as we visited a hospital for her once ). Anyway, short of collapsing current data broker system, I am not sure what the answer is. Experian debacle showed us they are too politically entrenched to be touched by regular means. At this point, I am going through life assuming most of my data is up for grabs. That is not a healthy way to live though.
- hmokiguess 10mo agoIf you want to get more stressed about it and consider the impeding dystopian future, I invite you to think about the “harvest now, decrypt later” potential reality that quantum cryptography is going to enable. At some point, everything that we have ever assumed to be confidential and secure will be exposed and up for grabs.
- A4ET8a8uTh0_v2 10mo agoIt is a fascinating future, but wouldn't it imply quantum computing will be even more restricted ( either by law or pricing ) and AI hardware?
- hmokiguess 10mo agoYou would hope so, with regards to law & policy, but then when you consider what is happening in the current times with the AI race it doesn't feel very likely.[1] [1] https://torrentfreak.com/annas-archive-urges-ai-copyright-overhaul-to-protect-national-security-250201/ https://torrentfreak.com/annas-archive-urges-ai-copyright-ov...
- stackskipton 10mo ago>I am not even sure what would be an appropriate remedy at this point. It will have to be political and it's got to be fines/damages that are business impacting enough for companies to pause and be like A) Is it worth collecting this data and storing it forever? and B) If I don't treat InfoSec as important business function, it could cost me my business. It also clear that certification systems do not work and any law/policy around it should not offer any upside for acquiring them. EDIT: I also realize in United States, this won't happen.
- closeparen 10mo agoThe State of Illinois is going to lose its "business" already for other reasons. Do you think there is a reasonable privacy regime that prevents health systems from knowing where their patients live or using that information to site clinics?
- fc417fc802 10mo agoWhy is my data freely and instantly available within a centralized "health system" to begin with? Why can't we implement a digital equivalent of clunky paper records? Everything E2EE. Local storage requiring in person human intervention to access. When a new provider wants my records from an old one there should be a cryptographic dance involving all three parties. Signed request, signed patient authorization, and then reencryption for the receiving party using the request key. What the health system should impose is a standard for interoperability. Not an internal network that presents a juicy target.
- dajtxx 10mo agoI agree but I think the problem will be if the consequences are that dire then entire classes of business will cease to exist OR the cost of doing things properly will be passed on to the consumer. I struggle to see how data brokers, social media, etc are a net benefit to society so would be happy to see those sorts of businesses cease to exist, but I suspect I'm in the minority.
- 10mo ago
- skeptic_ai 10mo agoChange name to a very common one. Much better privacy.
- EvanAnderson 10mo agoI grew up around some people with the last name "Null". I often wonder how they're doing for data privacy today.
- fhsm 10mo agoI’m from a culture in which family use a very small number of very highly conserved names and non standard name positions. I’ve noticed this is sufficient to confuse the low rent data brokers that do statistical linkage. My parents and grandparents and my siblings and my children have all at various points shared addresses landlines and have overlapping names. The brokers are very unclear on how many people are involved , what sex , what generations what states.
- closeparen 10mo agoThis has nothing to do with the "data broker system." Reading between the lines it was more of a "shadow IT" issue where employees were using some presumably third-party GIS service for a legitimate business purpose but without a proper authentication & authorization setup.
- A4ET8a8uTh0_v2 10mo agoAssuming your tea leaf reading is correct, that particular third party would not even exist in its current form without 'data broker ecosystem'. It is, genuinely, the original sin.
- closeparen 10mo agoA website where you can upload POIs to a shareable map seems like one of those things that's so obvious and so useful it exists almost under any economic arrangement of the advertising industry. I get that data brokers and big tech are a much sexier topic, but this breach - like so many of the most pressing threats to our privacy - are mundane shortages of competence and giving-a-shit in the IT activities of boring old organizations.
- A4ET8a8uTh0_v2 10mo agoHeh. The shareable map is operated by someone and that someone has information that other people crowdsourced for them for free is even more valuable. If you want a more relatable example, I would like to point to defuct effort ( karma or something.. I can't find the specifics now ), where people were invited to crowdsource all sorts of info on other people. It only got shut down, because it was too on the nose. On the other hand, items like the shareable map like the one you mention is more easily defensible... << I get that data brokers and big tech are a much sexier topic, but this breach - like so many of the most pressing threats to our privacy - are mundane shortages of competence and giving-a-shit in the IT activities of boring old organizations. I posit that both could be true at the same time.
- 10mo ago
- miki123211 10mo agoDid you actually suffer any negative consequences of these breaches? I see so many comments about how punishments for data breaches should be increased, but not a single story about quantifiable harm that any of those commenters has suffered from them.
- A4ET8a8uTh0_v2 10mo agoIt is difficult to read this. On the one hand, for a good chunk of the population that is true and yet, one knows that is absolutely not true to individuals, who will be affected. Since I do have multiple breaches under my belt, I could offer you an anecdote, but I won't. Do you know why? Because it is not up to me to quantify harm that was done the same way I don't have to explain, to a reasonable person, why doxxing people is not something people should have to suffer through. I have a personal theory as to why that state persists. The quantifiable harm is small per individual affected, but high across the population and thus underreported. Sadly, the entities that could confirm that are not exactly incentivized to say they are causing harm to begin with..
- SilverElfin 10mo agoWould you like 2 years of credit monitoring? Or perhaps you can get $5 from this class action settlement.
- rationalist 10mo agoI don't even understand paid credit monitoring. Each of the big three credit bureaus offer free accounts where they email me if something changes and allow me to lock and thaw my credit.
- scottLobster 10mo agoUnfortunately there's no money in privacy, and a lot of money in either outright selling data or cutting costs to the bare minimum required to avoid legal liability. Wife and I are expecting our third child, and despite my not doing much googling or research into it (we already know a lot from the first two) the algorithms across the board found out somehow. Even my instagram "Explore" tab that I accidentally select every now and then started getting weirdly filled with pictures of pregnant women. It is what it is at this point. Also I finally got my last settlement check from Equifax, which paid for Chipotle. Yay!
- maxtaco 10mo agoAlso on the front page of HN right now is a job posting for Optery (YC W22). Seems like they are growing really fast.
- vasco 10mo agoCould be as simple as buying a bunch of scent free soap / lotion and some specific vitamin supplements. Walmart / Target were able to detect pregnancy reliably back in 2012 from just their own shopping data.
- throwway120385 10mo agoRegular purchase of prenatal vitamins is probably a huge marker for either being pregnant or intention to become pregnant.
- simulator5g 10mo agoJust shopping in the store and lingering by those products for a few moments is enough for the algorithm to detect a possible pregnancy. They use Bluetooth beacons & camera software to see how long you look at everything in the store.
- Larrikin 10mo agoFacial recognition may be possible. BLE beacons were a useful technology that is dead now because even ten years ago it was being abused for this. It's fully blocked without a ton of jumping through hoops.
- Xeoncross 10mo agoRestrict data collection? It would kill all startups and firmly entrance a terrible provider monopoly who can comply. Have the government own data collection? Yeah, I don't even know where to start with all the problems this would cause. Ignore it and let companies keep abusing customers? Nope. Stop letting class-action lawsuits slap the company's wrists and then give $0.16 payouts to everyone? What exactly do we do without killing innovation, building moats around incumbents, giving all the power to politicians who will just do what the lobbyists ask (statistically), or accepting things as is?
- gassi 10mo ago[deleted]
- nemomarx 10mo agoWhy do the start ups need to collect data like this?
- thinkingtoilet 10mo agoI work for a medical technology company. How do you propose we service our customers without their medical data?
- cheeseomlit 10mo agoAsk for it?
- pear01 10mo agoI hope you're joking... Otherwise it would suggest you think the problem is they didn't ask? When was the last time you saw a customer read a terms of service? Or better yet reject a product because of said terms once they hit that part of the customer journey? The issue isn't about asking it's that for take your pick of reasons no one ever says no. The asking is thus pro forma and irrelevant.
- 10mo ago
- renewiltord 10mo agoUntil we can guarantee privacy and security maybe it’s best we shut down Illinois health care system.
- jckahn 10mo agoAssuming this is a serious comment, what do you propose instead if the health system is shut down?
- deleted 10mo ago[deleted]
- renewiltord 10mo agoA system where no one's data is held electronically.
- nradov 10mo agoFor better or worse it's simply no longer possible to operate a healthcare provider organization using paper records while maintaining compliance with federal interoperability and reporting mandates. That time has passed. https://www.cms.gov/priorities/burden-reduction/overview/interoperability https://www.cms.gov/priorities/burden-reduction/overview/int...
- rvz 10mo agoI just heard a chorus of AI agents rejoicing that there's more private data now made public available to train on.
- swores 10mo agoIt's not often anybody writes a sentence that combines cynicism/negativity about AI with anthropomorphising AI agents!
- sehugg 10mo agoSeveral maps created to assist the agency with decisions — like where to open new offices and allocate certain resources — were made public through incorrect privacy settings between 2021 and 2025 ... the mapping website was unable to identify who viewed the maps ... implemented a secure map policy that prohibits uploading customer data to public mapping websites. So a state employee/contractor (doesn't say) uploaded unaggregated customer records to a mapping website hosted on the public internet?
- teeray 10mo agoSounds like some patients are in for some lucrative free credit and identity monitoring /s
- gen220 10mo agoFYI, there's a .gov-maintained portal where healthcare companies in the U.S. are legally obliged to publish data breaches. It's an interesting dataset! https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- fhsm 10mo agoThis is a suboptimal characterization of this site. I think it would be less wrong to say this is where covered entities that discover reportable breaches of PHI (whether their own or that of a BA) that trigger the immediate reporting obligation report them. This is a narrower scope of coverage and shallower depth of epistemic obligation than you implied.
- mexicocitinluez 10mo agoOne of my favorite HIPAA stories is about a doctor who utilized his patient list when sending out campaign-related information when he was running for local office. Over 2 decades of schooling and still didn't understand how stupid this was.
- citizenpaul 10mo agoI've been saying this forever. Computer security is and always will be nothing more than theater for with some minimal effort to cover bases, like hiring an INFOSEC then ignoring them. No on in charge cares about security because the number of people in charge punished for these breaches is still ZERO.
- tonymet 10mo agoI've built Healthcare SAAS APIs that required custom integrations with EHR partners, as well as consulted on similar apps for others. On top of common OWASP vulnerabilities, the bigger concern is that EHR and provider service apps do not have the robust security practices needed to defend against attacks. They aren't doing active pen testing, red-teaming, supply chain auditing -- all of the recurring and costly practices necessary to ensure asset security. There are many regulations, HIPAA being the most notable, but their requirements and the audit process are incredibly primitive . They are still using a 1990s threat model. Despite HIPAA audits being expensive, the discoveries are trivial, and they are not recurring, so vulns can originate between the audit duration and the audit summary delivery.
- didgetmaster 10mo agoAlthough almost every company issues a 'we care about your privacy' statement, but there is often very little 'money where your mouth is' resources to back that up. This is why I am almost always very reluctant to give out any information that is not absolutely necessary to provide me the service that I need. If they don't know it, they can't leak it. Every company wants you to fill out their standard form that tries to get you to volunteer way more info than they really need.
- rationalist 10mo agoIf it's a paper form, I leave it blank. If it's a digital form and required, I put in the business's own phone number, address, etc.
- 1970-01-01 10mo agoAnd everyone was fired, the top management has stepped down, and the fines were so massive that nobody ever took a chance with sloppy security ever again. Oh, it's actually the opposite of all that.
- theLegionWithin 10mo agoone more reason to overhaul the system. if a health care provider has a security incident they should be sued for the value of the data - and if that bankrupts them, then other providers will (hopefully) learn from that mistake. sort of like OSHA