EHR sabotage for ransom: Try this with paper!

I have frequently written that health IT, touted as a technology that will deterministically "transform medicine", allows (aside from clinical chaos) new sorts of problems, such as information security abuses en masse, to occur.  See this query link for numerous postings on that topic:  http://hcrenewal.blogspot.com/search/label/medical%20record%20privacy

I am not, of course, advocating a return to paper; I am in fact "pro-good IT" but "anti-bad IT."

"Bad IT" is IT that interferes with quality patient care for any reason, permits evidence spoliation, permits overbilling, exposes confidential medical information to unauthorized parties, etc.

Here is another example of unintended consequences of bad health IT.  Try this trick with paper:

Attackers Demand Ransom After Encrypting Medical Center's Server
John E Dunn, Techworld
August 14, 2012 

Details have emerged of an extraordinary data breach incident in which a U.S. medical practice had thousands patient records and emails encrypted by attackers who then demanded a ransom to unscramble the data.

The incident appears to have come to light after a security blogger 'Dissent Doe' noticed a data breach report made by Illinois-based The Surgeons of Lake County medical centre to the US Department of Health and Human Services.

According to a small newswire that reported events, attackers were able to compromise one of the medical centre's servers, encrypting its contents including 7,067 patient records and a quantity of emails.

The first the centre knew about the attack was on 25 June when a ransom note for an undisclosed sum was posted on the server, at which point it was turned off.

It is not clear whether the data was recovered through backups but the organisations reported the incident to the police and Department of Health.

... What marks the compromise out from almost every data breach attack recorded is that the attackers opted to extort the victim organisation rather than attempting to sell or exploit the data itself.  [Cyber criminals should never be assumed to be uncreative - ed.]

It remains unlikely that the intention was to abuse this data directly; having occurred only days before the extortion note was received, the criminals would normally want a longer period to execute data and identity theft crimes. Most data theft criminals attempt to go undetected for this reason.

The criminals will, nevertheless, had access to sensitive data including names, addresses, social security and credit cards numbers plus medical records, prompting the centre to inform its affected patents of the breach.

"This is a warning bell. Maybe they're the canary in the coal mine that unpredictable things can happen to data once it's digitized," [you think? - ed.] said Santa Clara University law school professor, Dorothy Glancy, quoted by Bloomberg.

This incident is, quite simply, stunning.  In addition to identity theft concerns, a patient whose information was cybernetically 'held hostage' could have suffered clinically as a result.

A warning bell indeed about "bad IT."

-- SS