Medical Data Security

Brian Krebs had an interesting article yesterday about leaked medical records, where he quoted Verizon’s last report summary as medical material makes up 1/4 of the security breaches.  Medical records are big business because this kind of data has value.  

But it reminded me of a statement I hear from a lot of doctor’s offices.  “Sign up for our portal and get those test results on line”.  Then, they add, “It’s secure.”  This is a dream, started and fed by two groups: healthcare providers and the Federal government.  Medical records are not secure on the third-party medical records processors engaged in the business.   Would you believe that your bank data was safe on a portal on the Internet that used passwords for security?   Look at all the security that banks have added to make on-line authentication possible.  Medical records need the same level of protection, but they don’t get it.  Anyone who knows a tiny bit about security knows that what these providers are doing and the Feds have yet to set standards for service providers.  They have the same data on thefts of records that Verizon has, and more.  Yet, they have done nothing to improve the protection this data gets.  The Feds pushed medical data to be shared between physicians and their patients but never adequately addressed the protection of that data.  

The banking community got together with regulators and developed security for their products.  These service providers better do the same before the regulators decide to come to them.