brain scan

More Than One Billion Medical Images Remain Unprotected On The Web

Some security experts and lawmakers have criticized the Department of Health and Human Services for failing to enforce privacy laws and fine organizations that did not protect patient records.

Over a billion medical images remain exposed due to hospitals, medical offices and imaging centers running insecure storage systems, according to a TechCrunch report.

The storage systems allow anyone with an internet connection and free software to access the sensitive images, about half of which belong to patients in the U.S. The number of exposed images has only increased since the issue was first revealed in September by ProPublica.

At first, a security firm found that the number of images was 720 million. Now, the problem has grown to 1.19 billion scans, and medical offices have not taken action to secure their servers since being notified by security researchers who discovered the issues.

“The amount of data exposed is still rising, even considering the amount of data taken offline due to our disclosures,” Dirk Schrader, who led research at the security firm Greenbone Networks, told TechCrunch, adding: “It seems to get worse every day.”

Patients are largely unaware of the fact that their medical images are being stored online for nearly anyone to see, and that the exposed information puts them at a higher risk of being targeted for insurance fraud and identity theft, according to TechCrunch.

Nearly 600 million images could be secured if all remaining medical offices removed their accessible servers from the internet. But even after being contacted by the news outlet about the status of their servers, many did not take action.

Lawmakers and former Department of Health and Human Services officials say that more must be done to address the lack of privacy and security standards for health organizations. While medical records are protected by HIPAA, the main privacy law for medical patients, HHS has not done enough to enforce penalties for security lapses, according to Sen. Mark Warner (D-Va.).

“To my knowledge, Health and Human Services has done nothing about it,” Warner told TechCrunch. “As Health and Human Services aggressively pushes to permit a wider range of parties to have access to the sensitive health information of American patients without traditional privacy protections attached to that information, HHS’s inattention to this particular incident becomes even more troubling.”

Last year, one Tennessee medical imaging company was fined $3 million for accidentally exposing a server containing 300,000 records. Former government officials said that there needs to be more security assistance available to smaller health organizations so that HHS would have more resources to dedicate to enforcing security violations.

“It may be too big of a problem for any single law enforcement agency to truly put a dent in,” said Deven McGraw, a former top privacy official in HHS’ Office of Civil Rights, which enforces the law.

In response to the criticism, the Office of Civil Rights defended its past actions to enforce HIPAA security violations.

“OCR has taken enforcement action in the past to address violations concerning unprotected storage servers, and continues robust enforcement of the HIPAA rules,” a spokesperson told TechCrunch.

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Security Industry Embraces Mobile Credentials, Biometrics and AI, New Trends Report From HID Finds

    As organizations navigate an increasingly complex threat landscape, security leaders are making strategic shifts toward unified platforms and emerging technologies, according to the newly released 2025 State of Security and Identity Report from HID. The comprehensive study gathered responses from 1,800 partners, end users, and security and IT personnel worldwide, and reveals a significant transformation in how businesses are approaching security, with mobile credentials and artificial intelligence emerging as key drivers of innovation. Read Now

  • UK’s NHS Hospital Transforms Security with Edge-processing Camera System

    i-PRO Co., Ltd.,(formerly Panasonic Security), a manufacturer of edge computing cameras for security and public safety, recently announced that a leading teaching hospital in Northeast England, has enhanced its security infrastructure with i-PRO X-Series cameras integrated with Milestone’s XProtect Video Management Software (VMS). Read Now

  • Gun Violence Report Finds Retail Spaces, K-12 Schools Most Targeted

    ZeroEyes, the creators of the only AI-based gun detection video analytics platform that holds the U.S. Department of Homeland Security SAFETY Act Designation, today announced the release of its annual Gun Violence Report, offering a deep dive into the landscape of gun-related incidents across the United States. This analysis extends beyond mass fatality events, providing a more nuanced understanding of when, where, and why shootings occur. Read Now

  • Agentic AI Will Revolutionize Cybercrime in 2025 According to New Report

    Malwarebytes, a provider in real-time cyber protection, recently released its 2025 State of Malware report, which reveals insight into the emergence of agentic artificial intelligence (AI), plus the year’s most prominent threats and cybercrime tactics. The report details a significant uptick in the number of known ransomware attacks, the total value of ransoms paid in 2024, and how IT teams can address them. Read Now

New Products

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.