GAO: Health care privacy breaches widespread
107650
More than 40% of Medicare contractors and state Medicaid agencies have experienced privacy breaches involving personal health information, according to report released yesterday by the Government Accountability Office.
381447
WellCare Health Plans Inc , which manages health care for more than a million poor Americans, said on Friday that securities regulators had asked for information after the FBI raided the company's Florida headquarters.
716677
Google responds to attacks on its privacy record.
573037
Nine health trusts have lost thousands of their patients' details, it was reported Sunday, in the latest data scandal to hit the British government.
544903
EDMONTON - Auditor General Fred Dunn fears health-care fraud and identity theft are occurring because the Alberta government has failed to properly keep track of more than two million duplicate or replacement health-care cards.
288519
Google Inc.'s privacy practices are the worst among the Internet's top destinations, according to a watchdog group seeking to intensify the recent focus on how the online search leader handles personal information about its users.
620776
Investigators say computer security flaws could lead to the disclosure of medical information on people enrolled in Medicare and Medicaid.
397404
Poor information-sharing both inside and outside government is threatening homeland security, congressional investigators said Tuesday.
459603
A foursome that includes a health plan, a bank, an investment firm and a university recently joined the parade of organizations that have disclosed security breaches involving personal data.
700269
Google and Microsoft go head to head in the consumer healthcare market but privacy experts worry about personal information going online.
523277
ChoicePoint has settled with 44 states over a data breach that potentially gave criminals access to personal information from more than 145,000 consumers.
148647
Many Americans are in danger of losing their health insurance coverage due to the rapid increase of employer sponsored health insurance plans.
367998
(InfoWorld) - Most large data breaches don't appear to lead to identity theft, and proposals that would require companies to notify customers of most breaches may lead to increased costs without significant benefits, says a report from a U.S. government agency released Thursday. The report, from the U.S. Government Accountability Office (GAO), said only four of the 24 largest data breaches between January 2000 and June 2005 appear to have resulted in identity fraud. Wide-ranging data breach notification laws that would require nearly all breaches to be reported could lead to notifications that "present little or no risk, perhaps leading consumers to disregard notices altogether," the report said. While a breach notification law would have several benefits, a law that requires notification for nearly all breaches could also create significant costs for businesses, the report added. The U.S. Congress is currently considering several breach notification bills, including some that would require notification for nearly all breaches. Instead, Congress may want to consider a notification rule based on the potential for the risk of ID theft, the report said. The U.S. President's Identity Theft Task Force has recommended a national standard for determining when government agencies and private companies should report breaches, the report pointed out. A risk-based standard "could avoid undue burden on organizations and unnecessary and counterproductive notifications of breaches that present little risk," the report said. A data breach law would create costs for businesses, including the cost of developing incident response plans and notifying customers, the report said. While it's difficult to determine costs, a Ponemon Institute study in 2006 found that 31 companies with breaches incurred an average cost of $1.4 million per breach for notifying customers, staffing call centers, paying legal fees, and other expenses, the report said. The GAO researched 24 large data breaches reported in the media between 2000 and 2005, and found that 18 of them had no ID theft or fraud identified. Three of the breaches, at CardSystems Solutions, DSW, and CD Universe, had reports of fraud associated with existing customer accounts. And a breach at ChoicePoint had reports of unauthorized new accounts opened. In the remaining two breaches, GAO was unable to determine if there had been ID fraud. It's difficult to track ID theft resulting from data breaches, the report said. In some cases, thieves don't attempt to use the data until a year or more after the breach, the report said. A breach notification law could be beneficial because it would encourage organizations to improve data security, the report said. "Care is needed in defining appropriate criteria for data breaches that merit notification," the report said. "Because breaches vary in the risk they present, and because most breaches have not resulted in detected incidents of identity theft, a notification that is risk based appears appropriate." Alan Paller, director of research at the SANS Institute, a security research and training company in Maryland, praised the report, saying some in Congress have focused too much on data breaches. Some lawmakers have "dropped the ball on the far more important area of attack-based defenses," he said. The report is important because it gives Congress more information about data breaches, added Thomas Lenard, senior fellow and acting president at the Progress and Freedom Foundation, a conservative think tank. "Itâs very good to have more data on this issue," he said. "[The report] reinforces my view that we should only adopt new regulations in this area if it can be shown that their benefits are greater than their costs."
733098
A Pfizer employee has exposed Social Security numbers and other personal data belonging to about 17,000 employees.
749295
Fraud in the $300 billion-a-year Medicaid program is widespread and the federal government is not doing enough to combat it, congressional investigators said in a report released on Wednesday.
207163
Thousands of credit card numbers and other personal data may have been compromised.
185253
(InfoWorld) - Members of the U.S. Congress introduced a flurry of new technology-related bills this week, including two bills that would require companies with data breaches to notify affected customers. Senators Patrick Leahy, a Vermont Democrat, and Bernie Sanders, a Vermont independent, introduced the Personal Data Privacy and Security Act. In addition to requiring data breach notification, the bill would also require data brokers to disclose what information they hold on individuals. The bill would allow individuals to correct information held by data brokers, and it would require companies that have databases with personal information on more than 10,000 U.S. residents to implement data privacy and security programs. Representatives Bobby Rush, a Illinois Democrat, and Cliff Stearns, a Florida Republican, introduced the Data Accountability and Trust Act this week. Their bill, with 24 co-sponsors, authorizes the U.S. Federal Trade Commission (FTC) to draw up data privacy requirements for businesses, including requirements that they have vulnerability assessments and policies for disposing of obsolete data. After a company reports a data breach, the FTC would conduct an audit of its security practices, and, like the Leahy-Sanders bill, the bill would require data brokers to disclose the information they hold on individuals and allow individuals to correct wrong information. Organizations have lost 100 million personal records belonging to U.S. residents in data breaches since 2005, Leahy said in a speech on the Senate floor. Leahy, chairman of the Senate Judiciary Committee, singled outÂ data breaches at the U.S. Department of Veterans AffairsÂ last May andÂ retailer The TJX Companies,Â announced in January, in his speech. "These data security breaches are compelling examples of why we need strong federal data privacy and security laws to protect Americansâ personal data and to address the ills of lax data security," he said. "In the information age, any company that wants to be trusted by the public must earn that trust by vigilantly protecting the databases they use and maintain." Members of Congress introduced about a dozen bills requiring data breach notification after a series of breaches in early 2005, but legislation stalled largely over committee jurisdictional wrangling. About 30 states have passed breach notification laws, most of them since 2005. The Cyber Security Industry Alliance, a trade group of IT security vendors, in January called on Congress to pass a comprehensive data protection bill, including breach notification. But some groups, including conservative think tank the Progress and Freedom Foundation, have questioned the need for a breach notification law, saying the cost to businesses may far outweigh the benefits to consumers. Other tech-related bills introduced this week: -- Two bills allowing the FTC toÂ investigate the practice of pretexting, when an investigator assumes a false identity to gain access to a person's telephone records. President George Bush signed a bill creating penalties for pretexting in January, but the two new bills would give the FTC the authority to investigate and prosecute pretexters. Many lawmakers became interested in the issue afterÂ Hewlett-Packard disclosedÂ in September that investigators it had hired used pretexting in an attempt to gain access to board members' and reporters' phone records. -- A bill targeted at spyware by establishing criminal penalties for a number of actions. The bill would prohibit keystroke logging, taking control of a computer without the user's consent, diverting Web browsers, using computers to create botnets and modifying a computer users' browser and security settings without permission. Two spyware bills passed the House of Representatives by overwhelming majorities in March 2005, but the Senate didn't act on them. Â