EHIP

General paperwork for 66 patients lost on Red Line train

Paperwork containing the personal medical information of at least 66 patients at Massachusetts General Hospital was lost this month when an employee apparently left it on an MBTA train.

The hospital sent out letters last week to patients whose identities were included in the lost paperwork, telling them the information listed their names and dates of birth, and private medical information, including their diagnoses and the name of the provider with whom they met. The material constituted billing records for patients who attended the hospital's Infectious Disease Associates outpatient practice on Fruit Street on March 4.

According to hospital security reports, a manager in the infectious disease center's billing unit told supervisors that she left the paperwork on a Red Line train the morning of March 9. The manager said she had brought the paperwork home with her to work over the weekend and left the material sometime between 7:30 and 9 a.m. The Transit Police were notified, but the paperwork was not found.

Automated summary from: The Boston Globe

Nurses paid to scout for Vioxx drug firm

Australian marketing staff from pharmaceutical giant Merck & Co. paid specialist nurses half-a-million dollars to "hunt" through patient records for potential candidates for their blockbuster anti-arthritis drug Vioxx.

The Federal Court was told the company aimed to identify 100 patients of each targeted general practitioner who were not taking Vioxx and could be recommended to take up the drug for their condition.

The plaintiff also said yesterday in the court in Melbourne that Merck gave pharmacists incentives to recommend Vioxx to patients who were on other drugs such as paracetamol.

Australian Penny Dobson, who was Merck's marketing director for Vioxx and other drugs from 2001 to 2003, confirmed to the court yesterday that the $500,000 bone and joint care program was implemented.

“We employed bone care nurses who were employed by a third party agency, they were not Merck employees," she said. "They would have had access to GP records with permission of the GPs."

Automated summary from: Australian IT

Grab for Patient Records

AsteRx managing director Jon Marshall says de-identified patient data provides valuable insight into healthcare trends -- including the spread of infectious diseases -- for which drug companies, pharmacists and others are prepared to pay.

"If we were extracting data from every GP in Australia, we would be able to track the swine flu, for instance.

“From the data we already collect I can tell you whether there has been an increase in immunisations, or increased incidences of flu, right up to yesterday's figures."

“Basically, we have built a platform that allows us to gather data from any GP software package, and run it through a layer to create common data elements that we then aggregate up," he said. "From there, you can put QlikView over the top and begin to perform the analytics, data mining and reporting."

A complaint to the federal privacy commissioner was subsequently dismissed on the grounds that the patient information had been "de-identified" and neither patient nor doctor could be recognised.

Juanita Fernando, chair of the Australian Privacy Foundation's health committee, said the practice was unethical but legal.

"I think there's a clear need to regulate these kinds of commercial interventions, along with greater protection for consumer health privacy, including individual consent for use of data by other parties," she said.

Automated summary from: Australian IT

Investigation Into Huge Loss of Computerized Clinton Data

Federal authorities are investigating the loss of a computer hard drive containing a huge quantity of personal information from Bill Clinton's presidency in an apparent security breach at a National Archives record center, government officials said Tuesday.

Government officials briefed on the matter said the breach, which was confirmed in April, involved the loss of a drive containing a terabyte of computerized data, which could include millions of individual pieces of information, including personal information about one of then Vice President Al Gore's three daughters.

Other officials said it was not known whether the hard drive had been stolen or accidentally misplaced. They added that it did not appear that classified information related to national security was taken but that analysts had not yet completed their review of the vast quantity of information stored on the drive.

Automated summary from: The New York Times

Kaiser hospital fined $250,000 for privacy breach in octuplet case

California health regulators fined Kaiser Permanente's Bellflower hospital $250,000 Thursday for failing to keep employees from snooping in the medical records of Nadya Suleman, the mother who set off a media frenzy after giving birth to octuplets in January.

The fine is the first monetary penalty imposed and largest allowed under a new state law enacted last year after widely publicized violations of privacy at UCLA Medical Center involving Farrah Fawcett, Britney Spears, California First Lady Maria Shriver and other celebrities.

Since the law took effect Jan. 1, hospitals have reported about 300 incidents in which patient records were inappropriately accessed or disclosed. Most of those were inadvertent, such as giving discharge instructions or medication orders to the wrong patients, but some involved prying into patients' records without permission.

Kaiser told the public health agency on Feb. 5 that two employees inappropriately accessed the records of Suleman, who gave birth on Jan. 26 to the world's only surviving octuplets, according to a Public Health Department report issued Thursday. By Feb. 20, six employees had been identified as having accessed records without authorization. On March 20, 17 more employees were added to the list, including two doctors, for a total of 23.

Automated summary from: The Los Angeles Times

Johns Hopkins Employee May Have Stolen Patient Data

Johns Hopkins is alerting more than 10,000 of its hospital patients that they may have been victims of identity theft.

An investigation suggests a former employee who worked in patient registration may have been linked to a scheme to create fake drivers' licenses in Virginia, according to this letter from Baltimore-based Hopkins to the Maryland attorney general's office.

The employee, whom the hospital says it expects to be indicted, had access to information such as dates of birth and Social Security numbers, but not to any health or medical information, according to the letter.

Automated summary from: The Wall Street Journal Health Blog

Facebook content showing up in lawsuits

Lawyers in Canada are increasingly warning their clients about the perils of posting information on social websites such as Facebook after a small but growing number of cases faltered because of damning messages and photographs.

Last month, a Newfoundland man's lawsuit was largely foiled, partly because of Facebook postings that contradicted his claims. Dennis Terry filed the suit after suffering whiplash from two car accidents in 2001 and 2003. In addition to other losses, he argued the injuries harmed his social life, claiming his friends stopped phoning him to go out after he repeatedly declined their invitations.

But after defence lawyers produced evidence from Terry's Facebook profile that suggested a life brimming with activity, provincial Supreme Court Justice James Adams concluded the plaintiff exaggerated the toll his injuries took.

Brenda Hollingsworth, a personal injury lawyer in Ottawa, says uncovering as much information as possible about potential clients has become part of her vetting process before taking on cases.

But online scribbles and pictures can be an unfair evidentiary tool if used out of context, she said.

"You may have someone after an accident who goes to one special occasion and swallows a bottle of Tylenol to go, and then all of a sudden that one three-hour night five years ago becomes blown out of proportion," she said.

"These pictures get blown up for the jury and they've got you with a beer in your hand, sitting in a lawn chair and no amount of explanation can really shake that image."

Automated summary from: Canoe.ca

Inside a data leak audit

When the director of IT at a Boston-based, midsize pharmaceutical firm was first approached to participate in a data leakage audit, he was thrilled. He figured the audit would uncover a few weak spots in the company's data leak defenses and he would then be able to leverage the audit results into funding for additional security resources.

But he got way more than he bargained for. The 15-day audit identified 11,000 potential leaks, and revealed gaping holes in the IT team's security practices.

Specifically, the auditors, Networks Unlimited, looked for violations of the pharmaceutical firm's internal confidentiality policy, corporate information security policy, Massachusetts Privacy Laws (which go into effect in 2010), Health Insurance Portability and Accountability Act (HIPAA), and Security and Exchange Commission and Sarbanes-Oxley regulations.

"We thought we were in good shape. We had done internal and external audits in preparation for the Massachusetts Privacy Laws, we did extensive penetration testing, we have security tools such as intrusion detection and prevention and laptop encryption in place, and we do employee training. This just goes to show you can do all that and it's just not enough," the CIO said.

Automated summary from: NetworkWorld

More like Casebook

Be careful what you post on Facebook or MySpace, because anything you say or upload can and will be used against you in a court of law.

In a Vancouver courtroom last month, defendants in a personal injury case produced photos from the plaintiff's Facebook profile showing that while Myla Bagasbas was seeking $40,000 in damages for pain, suffering and loss of enjoyment after a car accident, she was still able to kayak, hike and bike post-accident.

"Facebook will be seen as a gold mine for evidence in court cases," said Ian Kerr, Canada Research Chair in ethics, law and technology at the University of Ottawa.

"The courts sometimes don't get it," Kerr said. "The tendency in judicial opinion and popular thinking is that once something is out in the public, there's no such thing as privacy anymore. But that can't be right because we all have curtains."

Likewise, in Murphy versus Perger, a judge ordered that the plaintiff, who was suing for claims of personal injury and loss of enjoyment of life after a car accident, produce copies of her Facebook pages showing photos of her engaging in social activities. In her judgment, Ontario Superior Court Justice Helen Rady wrote "The plaintiff could not have a serious expectation of privacy given that 366 people have been granted access to the private site."

But having 366 Facebook friends doesn't entitle the rest of the world to view personal information meant only for certain eyes, said Avner Levin, director of the Privacy Institute at Toronto's Ryerson University.

"It's not how many people you share it with, it's who you choose to share the information with," Levin said. "The judge is missing the point. What's important is not how many people are your friends, but who you choose to know you."

Automated summary from: Toronto Sun

UC Berkeley Health Services Center Databases Hacked

The University of California, Berkeley, began notifying students, alumni and others that their personal information may have been stolen after hackers attacked restricted computer databases in the campus's health services center.

The databases contained individuals' Social Security numbers, health insurance information and non-treatment medical information, such as immunization records and names of some of the physicians they may have seen for diagnoses or treatment. UC Berkeley administrators pointed out that the hackers fortunately did not access University Health Services' (UHS) medical records.

The campus learned of the breach in April, immediately removed from service the exposed databases to prevent any further attacks, and alerted campus police and the FBI. In all, more than 160,000 individuals will be alerted, including those who had their Social Security numbers accessed and others who may be at risk for identity theft.

Automated Summary from: Security Dark Reading