Thread by @LawHealthTech

Your health data is being breached every day through stupidity and ignorance

I am collecting together some data about the larger breaches, but I am seeing evidence that many small breaches of hundreds of patient records happen every single day around the world - a short 🧵

As I collect data on larger breaches, there are two common themes for the cause that I am seeing

The first centres on the fact that senior experience in hospital & Health IT workers has been so eroded that the quite frankly uncompetent staff who remain are not up to the task...

While many in the media portray the breaches as being caused by little more than the absence of things like 2FA or multi-factor authentication, this ignores some of the quite frankly simple IT security lapses & issues that are repeatedly observed...

these include
The over-reliance on 'cloud' based solutions that mean sensitive data is constantly traversing the public internet
and
The repeated use of solutions that even where the data is maintained locally, the platform itself must always be able to see the internet...

What this means is that there is no clear border or boundary between sensitive health data that should not be accessible to or from the internet, and the wider internet with all its scary inhabitants...

And no, the ignorant belief that we think our Checkpoint firewall or intrusion monitoring system will catch or prevent hackers or inappropriate access to the data is not a replacement for securing that data in a way that prevents it being accessible in the first place

This accessibility has led to millions of personal and highly sensitive health records being accidentally leaked to search engines through the 'secure' access apps having embedded scripts that allow Google or Facebook to see the user session...

and on a daily basis allows hackers and ransomware apps to simply walk right in and both steal copies of the data, and then encrypt the data, making it inaccessible to doctors. Ransomware attacks have gained hackers tens of millions of dollars and harmed patients

This highly sensitive data that includes personal identifiers (an individual's ID, social security or national identifier numbers, names, addresses, DOB) and their diagnosis, treatment and medication information should be maintained in closed networks without internet access

I have walked into NHS, NSW Health and NZ MOH datacentres and Server rooms and watched as IT staff simply open up a browser window (often insecure and highly hackable Chrome-based browsers like Edge) on an EHR records server and browse the web like it's their home computer

Computers with sensitive data should be on secure VLANs with absolutely NO internet access for any reason. If we fought back against software platform vendors who want 'always on connectivity' from their platform to the internet, they would very quickly back down

The second type of attack is enabled by the same mistake. Hospital & health IT people roll out ward computers with a standard image that often has unfettered access through the network to a myriad of secure, cloud and insecure internet sources....

All too often their approach to desktop security is to make it a combination of the users problem, or to rely on those firewalls in the datacentre to do all the heavy lifting for them. They create login & password and MFA complications that users get annoyed with and defeat...

And they believe that all their user-level complications mean that they can be lax with both the desktop security, and the rest of the network platform security. Yes, there are a lot who CLAIM their networks are highly secure - but the huge number of breaches says otherwise

While the first type is little more than data leaking from internet-connected servers and server platforms, the second type is data leaking from all the hundreds of user-land devices around the hospital.

The doctor browses the web that was poorly secured by IT, and through the Edge browser (which is swiss cheese security at its finest) the drive-by hacker gets access from the browser to the EHR database.

In a recent example that affected Epworth and Royal Melbourne Hospitals in Australia, one cadiologist's web browsing on the hospital network coupled with poorly secured EHR solutions in the server room downstairs gave a drive by hacker 40Gb of highly sensitive patient data

The takeaway message?

Hospital IT staff - get patient data out of the cloud and off the web. If the systems were not able to access the internet and were not internet accessible, almost none of the thousands of recent data breaches could have occured

@threadreaderapp unroll