Hello,

We noticed you're browsing in private or incognito mode.

To continue reading this article, please exit incognito mode or log in.

Not an Insider? Subscribe now for unlimited access to online articles.

A View from Fred Trotter

Heartbleed Bodes Ill for Sensitive Health Data

Research suggests that electronic health information is particularly vulnerable to software bugs.

  • April 22, 2014

Recent discoveries, along with the recent drama over the Heartbleed bug, make me believe that in next few months we could see the largest leak of private patient information ever reported. Attacks against health IT systems are particularly concerning because so much personal data lives in an electronic health record. If hackers compromised such a system, they’d get contact and financial information, as well as lots of even more personal health data. 

Heartbleed, the recently exposed vulnerability in a very common version of OpenSSL, put pressure on many IT security professionals to roll out quick fixes. Unfortunately, backwards thinking in health IT, arguably one of the most important-to-protect arenas, leaves many vendors unprepared to respond quickly to bugs like Heartbleed.

There is already evidence that companies that develop electronic health record software and other health IT products are not prepared to react to security vulnerabilities of any kind. For example, on April 4, Josh Mandel, a health IT expert with the SMART project, an effort to develop a common interface for health IT platforms, discovered a significant vulnerability in a common part of a health-care informatics software adopted by many electronic health record software vendors. Mandel and his team reported the bug, but very few vendors of electronic health record software responded appropriately. Mandel found that less than 10 percent of electronic health record vendors he contacted had the proper procedures in place to handle vulnerabilities.

Hackers generally move at breathtaking speed, and can take over millions of machines in minutes. The only advantage that security professionals have is that they can take certain steps to prepare for attacks. If those preparations are in place, the IT professionals can (barely) keep up. But in the case of health information, most security professional aren’t properly prepared to react.

Has Heartbleed affected any electronic health record systems? It is hard to say. Usually leaks of protected health information must be reported to the HHS Office of Civil Rights under the Health Insurance Portability and Accountability Act. But it is an open secret in health IT circles that health-care providers frequently fail to report “smaller” problems. Even if hospitals and other providers did report back to the Office of Civil Rights, it might be difficult for us to tell, as an industry, how well health IT vendors performed.

It will be interesting to see, over the course of the next few months, what kinds of hacking attempts are reported. Let’s hope I’m wrong about that leak.

Fred Trotter is chief operating officer at Open Source Health, founder of CareSet, and a technical blogger for O’Reilly Radar.

The latest Insider Conversation is live! Listen to the story behind the story.

Subscribe today
Already a Premium subscriber? Log in.
More from Rewriting Life

Reprogramming our bodies to make us healthier.

Want more award-winning journalism? Subscribe and become an Insider.
  • Insider Plus {! insider.prices.plus !}* Best Value

    {! insider.display.menuOptionsLabel !}

    Everything included in Insider Basic, plus the digital magazine, extensive archive, ad-free web experience, and discounts to partner offerings and MIT Technology Review events.

    See details+

    What's Included

    Unlimited 24/7 access to MIT Technology Review’s website

    The Download: our daily newsletter of what's important in technology and innovation

    Bimonthly print magazine (6 issues per year)

    Bimonthly digital/PDF edition

    Access to the magazine PDF archive—thousands of articles going back to 1899 at your fingertips

    Special interest publications

    Discount to MIT Technology Review events

    Special discounts to select partner offerings

    Ad-free web experience

  • Insider Basic {! insider.prices.basic !}*

    {! insider.display.menuOptionsLabel !}

    Six issues of our award winning print magazine, unlimited online access plus The Download with the top tech stories delivered daily to your inbox.

    See details+

    What's Included

    Unlimited 24/7 access to MIT Technology Review’s website

    The Download: our daily newsletter of what's important in technology and innovation

    Bimonthly print magazine (6 issues per year)

  • Insider Online Only {! insider.prices.online !}*

    {! insider.display.menuOptionsLabel !}

    Unlimited online access including articles and video, plus The Download with the top tech stories delivered daily to your inbox.

    See details+

    What's Included

    Unlimited 24/7 access to MIT Technology Review’s website

    The Download: our daily newsletter of what's important in technology and innovation

/3
You've read of three free articles this month. for unlimited online access. You've read of three free articles this month. for unlimited online access. This is your last free article this month. for unlimited online access. You've read all your free articles this month. for unlimited online access. You've read of three free articles this month. for more, or for unlimited online access. for two more free articles, or for unlimited online access.