Medicare Patient Data Insecure, GAO Says
81249
Security weaknesses have left millions of elderly, disabled and poor Americans vulnerable to unauthorized disclosure of their medical and other personal records, federal investigators said yesterday.
175149
WASHINGTON - Privacy advocates are concerned that an implantable microchip designed to help doctors tap into a patient&#39;s medical records could undermine confidentiality or could even be used to track the patient&#39;s movements.
683732
(InfoWorld) - The cybersecurity provisions in a U.S. Department of Veterans Affairs (VA) bill approved by Congress late last week are in some ways too narrow and in others too broad, a cybersecurity group says. The Veterans Benefits, Health Care, and Information Technology Act, largely focused on veterans' health-care programs, includes a section on information security requiring the VA to report data breaches of any "sensitive" personal information, potentially including breaches where only veterans' names were exposed, said Liz Gasster, general counsel for the Cyber Security Industry Alliance (CSIA), a trade group representing cybersecurity vendors. The bill, passed by Congress late last week, requires the VA to report breaches of sensitive personal information to Congress and requires VA Secretary R. James Nicholson to create plans for notifying affected veterans, as well as offering credit monitoring and identity theft insurance to affected veterans. If the VA ends up notifying veterans every time a document with just names on it is lost, veterans may become numb to breach notifications that contain real dangers, Gasster said. Thirty-four enacted state data breach notification bills require that a name be coupled with other data, such as an unencrypted Social Security number, drivers' license number or financial account number. "Essentially, the loss of a list of names on a piece of paper constitutes a data breach under the law, which seems far too broad," she said. "Clearly, your name is not sensitive personal information." The VA announced in mid-May that a laptop and hard drive containing the personal information of 26.5 million military veterans and their spousesÂ had been stolen from an employee's home about two weeks earlier. Police later recovered the hardware, and VA officials said the personal information had not been compromised, but the breach set off a firestorm of criticism from Congress. In addition to its potentially broad definition of sensitive personal data, the bill does not exempt the VA from reporting data breaches if the information was encrypted, Gasster said. In supporting a national data breach notification bill, CSIA and other groups have called on Congress to exempt encrypted data from notification rules, saying the exemption would encourage companies and government agencies to encrypt more data. The lack of an exemption "seems like it deprives the benefit of encryption from the VA," Gasster said. Although the bill's language on personal sensitive information and encrypted data is too broad, in some ways the bill doesn't do enough to protect consumers, Gasster added. The bill only addresses VA data breaches, not breaches at other government agencies or private companies. CSIA and some consumer groups have pushed for a national data breach notification bill after a rash of breaches in early 2005, but Congress failed to pass a notification law. While the VA's large breach generated significant attention from Congress, other agencies have lost dozens of laptops containing personal information in recent years, and private businesses continue to have breaches, Gasster said. CSIA wants a bill that would require agencies and companies to take reasonable security measures to protect data, Gasster added. A spokesman for Senator Larry Craig, the Idaho Republican who sponsored the veterans bill, didn't return messages seeking comment on the CSIA's concerns.
434978
WASHINGTON - Privacy advocates are concerned that an implantable microchip designed to help doctors tap into a patient's medical records could undermine confidentiality or could even be used to track the patient's movements.   "If privacy protections aren't built in at the outset, there could be harmful consequences for patients," said Emily Stewart, a policy analyst at the Health Privacy Project...
749121
A day before the first presidential debate, the government's health policy watchdog raised concerns that early mailings to seniors about the new Medicare prescription discount cards championed by President Bush were confusing or inadequate.
749295
Fraud in the $300 billion-a-year Medicaid program is widespread and the federal government is not doing enough to combat it, congressional investigators said in a report released on Wednesday.
584210
Medical records are frequently  incomplete or missing during patient visits to the doctor,  posing potential danger and wasting time, a survey of  physicians said on Tuesday.
342172
Privacy advocates are concerned that an implantable microchip designed to help doctors tap into a patient&#39;s medical records could undermine confidentiality or could even be used to track the patient&#39;s movements.
372103
Patients going under the knife face a significant risk of becoming the victim of a medical error involving medication, according to a report being released today.
367998
(InfoWorld) - Most large data breaches don't appear to lead to identity theft, and proposals that would require companies to notify customers of most breaches may lead to increased costs without significant benefits, says a report from a U.S. government agency released Thursday. The report, from the U.S. Government Accountability Office (GAO), said only four of the 24 largest data breaches between January 2000 and June 2005 appear to have resulted in identity fraud. Wide-ranging data breach notification laws that would require nearly all breaches to be reported could lead to notifications that "present little or no risk, perhaps leading consumers to disregard notices altogether," the report said. While a breach notification law would have several benefits, a law that requires notification for nearly all breaches could also create significant costs for businesses, the report added. The U.S. Congress is currently considering several breach notification bills, including some that would require notification for nearly all breaches. Instead, Congress may want to consider a notification rule based on the potential for the risk of ID theft, the report said. The U.S. President's Identity Theft Task Force has recommended a national standard for determining when government agencies and private companies should report breaches, the report pointed out. A risk-based standard "could avoid undue burden on organizations and unnecessary and counterproductive notifications of breaches that present little risk," the report said. A data breach law would create costs for businesses, including the cost of developing incident response plans and notifying customers, the report said. While it's difficult to determine costs, a Ponemon Institute study in 2006 found that 31 companies with breaches incurred an average cost of $1.4 million per breach for notifying customers, staffing call centers, paying legal fees, and other expenses, the report said. The GAO researched 24 large data breaches reported in the media between 2000 and 2005, and found that 18 of them had no ID theft or fraud identified. Three of the breaches, at CardSystems Solutions, DSW, and CD Universe, had reports of fraud associated with existing customer accounts. And a breach at ChoicePoint had reports of unauthorized new accounts opened. In the remaining two breaches, GAO was unable to determine if there had been ID fraud. It's difficult to track ID theft resulting from data breaches, the report said. In some cases, thieves don't attempt to use the data until a year or more after the breach, the report said. A breach notification law could be beneficial because it would encourage organizations to improve data security, the report said. "Care is needed in defining appropriate criteria for data breaches that merit notification," the report said. "Because breaches vary in the risk they present, and because most breaches have not resulted in detected incidents of identity theft, a notification that is risk based appears appropriate." Alan Paller, director of research at the SANS Institute, a security research and training company in Maryland, praised the report, saying some in Congress have focused too much on data breaches. Some lawmakers have "dropped the ball on the far more important area of attack-based defenses," he said. The report is important because it gives Congress more information about data breaches, added Thomas Lenard, senior fellow and acting president at the Progress and Freedom Foundation, a conservative think tank. "Itâs very good to have more data on this issue," he said. "[The report] reinforces my view that we should only adopt new regulations in this area if it can be shown that their benefits are greater than their costs."
48148
Be aware of the Medicare drug plan's gaps.
276797
The federal government plans to target medical equipment suppliers in Los Angeles and South Florida in an effort to root out fraud in Medicare, the insurance system for the elderly and disabled, a Medicare official said yesterday.
595416
An IT specialist at a Department of Veterans Affairs medical center in Birmingham, Ala., failed to properly protect sensitive data on an external hard drive lost in January, according to an investigation of the incident by the VA's inspector general.
229920
The U.S. Justice Department is  investigating the medical supply industry over concerns that  some health care providers bilked government programs including  Medicare, The New York Times reported on Saturday.
640269
For more than a year, officials who run Social Security and Medicare have struggled to mesh their computer systems.
709784
Medicare patients will likely have a  harder time seeing a doctor if proposed cuts to the program are  implemented, according to a survey of doctors released by the  American Medical Association on Monday.
433103
Maximus Inc., which manages federal programs for state and local governments, disclosed yesterday that federal prosecutors have subpoenaed records connected to Medicaid reimbursement claims it prepared for the District.