Recent discoveries, along with the recent drama over the Heartbleed bug, make me believe that in next few months we could see the largest leak of private patient information ever reported. Attacks against health IT systems are particularly concerning because so much personal data lives in an electronic health record. If hackers compromised such a system, they’d get contact and financial information, as well as lots of even more personal health data.
Heartbleed, the recently exposed vulnerability in a very common version of OpenSSL, put pressure on many IT security professionals to roll out quick fixes. Unfortunately, backwards thinking in health IT, arguably one of the most important-to-protect arenas, leaves many vendors unprepared to respond quickly to bugs like Heartbleed.
There is already evidence that companies that develop electronic health record software and other health IT products are not prepared to react to security vulnerabilities of any kind. For example, on April 4, Josh Mandel, a health IT expert with the SMART project, an effort to develop a common interface for health IT platforms, discovered a significant vulnerability in a common part of a health-care informatics software adopted by many electronic health record software vendors. Mandel and his team reported the bug, but very few vendors of electronic health record software responded appropriately. Mandel found that less than 10 percent of electronic health record vendors he contacted had the proper procedures in place to handle vulnerabilities.
Don’t settle for half the story.
Get paywall-free access to technology news for the here and now.