brain scan

More Than One Billion Medical Images Remain Unprotected On The Web

Some security experts and lawmakers have criticized the Department of Health and Human Services for failing to enforce privacy laws and fine organizations that did not protect patient records.

Over a billion medical images remain exposed due to hospitals, medical offices and imaging centers running insecure storage systems, according to a TechCrunch report.

The storage systems allow anyone with an internet connection and free software to access the sensitive images, about half of which belong to patients in the U.S. The number of exposed images has only increased since the issue was first revealed in September by ProPublica.

At first, a security firm found that the number of images was 720 million. Now, the problem has grown to 1.19 billion scans, and medical offices have not taken action to secure their servers since being notified by security researchers who discovered the issues.

“The amount of data exposed is still rising, even considering the amount of data taken offline due to our disclosures,” Dirk Schrader, who led research at the security firm Greenbone Networks, told TechCrunch, adding: “It seems to get worse every day.”

Patients are largely unaware of the fact that their medical images are being stored online for nearly anyone to see, and that the exposed information puts them at a higher risk of being targeted for insurance fraud and identity theft, according to TechCrunch.

Nearly 600 million images could be secured if all remaining medical offices removed their accessible servers from the internet. But even after being contacted by the news outlet about the status of their servers, many did not take action.

Lawmakers and former Department of Health and Human Services officials say that more must be done to address the lack of privacy and security standards for health organizations. While medical records are protected by HIPAA, the main privacy law for medical patients, HHS has not done enough to enforce penalties for security lapses, according to Sen. Mark Warner (D-Va.).

“To my knowledge, Health and Human Services has done nothing about it,” Warner told TechCrunch. “As Health and Human Services aggressively pushes to permit a wider range of parties to have access to the sensitive health information of American patients without traditional privacy protections attached to that information, HHS’s inattention to this particular incident becomes even more troubling.”

Last year, one Tennessee medical imaging company was fined $3 million for accidentally exposing a server containing 300,000 records. Former government officials said that there needs to be more security assistance available to smaller health organizations so that HHS would have more resources to dedicate to enforcing security violations.

“It may be too big of a problem for any single law enforcement agency to truly put a dent in,” said Deven McGraw, a former top privacy official in HHS’ Office of Civil Rights, which enforces the law.

In response to the criticism, the Office of Civil Rights defended its past actions to enforce HIPAA security violations.

“OCR has taken enforcement action in the past to address violations concerning unprotected storage servers, and continues robust enforcement of the HIPAA rules,” a spokesperson told TechCrunch.

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Maximizing Your Security Budget This Year

    The Importance of Proactive Security Measures: 4 Stories of Regret

    We all want to believe that crime won’t happen to us. So, some business owners hope for the best and put proactive security measures on the back burner, because other things like growth, attracting new customers, and meeting deadlines all seem more pressing. Read Now

  • New Uses for AI

    New applications of AI in IP cameras are delivering precise detection, robust search capabilities, elevated data analysis and enhanced image quality. When combined with built-in analytics, AI can help streamline forensic investigations and also supports several mission-critical business functions. Read Now

  • The Critical Missing Piece

    As technology advances, security programs have invested heavily in advanced systems and sensors. These sensors generate massive amounts of data, often overwhelming the security teams tasked with monitoring them. AI technology promises to sift through this data, using logic and reasoning to differentiate potential threats from non-threats. Read Now

  • Computers Beginning to Come Back Online After CrowdStrike Caused Crash Friday

    Computers around the world are beginning to come back online after a defective update to Windows machines from cybersecurity provider CrowdStrike Friday affected almost 9 million machines. Read Now

Featured Cybersecurity

Webinars

New Products

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3