Issue link: https://viewer.e-digitaledition.com/i/44902
The hospital "takes the privacy and security of our patients' information very seriously,'' the hospital's chief informa- tion officer said in a statement. "We are taking steps to reduce the risk of such events occurring in the future, including addressing the incident specifically with those involved, reviewing and augment- ing our policies and procedures, and enhancing our training regarding techni- cal safeguards required on external hard drives that may contain sensitive data, as well as limiting the amount of data stored on such devices.'' Hospital representatives also said they have no knowledge that anyone has used data on the device; however, the hospital is offering patients identity protection services. With almost 700 patients potentially having their medical records com- promised, the situation could be a big problem. The person who found the lost drive could sell the valuable information, which could be sliced, diced and sold on the Internet to criminal organizations who, surprisingly, can make good and very mischievous use of this information. We have taught our clients that the Internet is not the only or most prominent place for patient data losses. "Analog" circumstances — files left open, computer terminals with open records or no security log-in, and, especially, carelessness with laptops and external hard drives and flash drives — are actu- ally the most likely instances in which patient and client data is compromised. At the very least, every device used by doctors and other patient care providers should have information encrypted. That will make access to the data more diffi- cult — although sophisticated criminals are often able to break the code. Laptops and data storage devices should never be left unattended in cars, airplanes (theft of such devices from seats and overhead bins have been reported), restaurants, bars or hotel rooms. We urge every practice to conduct a short, sensitive data awareness-training MDNEWS.COM MD NEWS Twin Cities | 15 program for every employee on a yearly basis — not after a data breach has occurred, which is when these training sessions are often enacted. Changes in data theft techniques mean that a refresher course is vitally important to keep employees apprised of the latest security risks and to restimulate their awareness of the need for best practice security behavior. The lesson is that both personal security awareness and organizational practices are crucially important in the medical field, where criminals can increasingly harvest a rich trove of sensitive and valuable information. Steve Baker is an independent associate and Executive Director with Pre-Paid Legal Services Inc. For additional information, contact him at (651) 493-9394. n