Report: Electronic medical records are vulnerable

WASHINGTON — The nation's push to computerize medical records has failed to fully address security gaps that expose patients' most sensitive information to hackers and snoops, government investigators warn.

Two reports released today by the inspector general of the Health and Human Services Department find that the drive to connect hospitals and doctors so they can share patient data electronically is being layered on a system that already has glaring privacy problems. Connecting it could open new pathways for hackers, investigators say.

The market for illicit health care information is booming. Criminals covet health care records, which contain identifiers such as names, birth dates and Social Security numbers that can be used to construct a false identity or send Medicare bogus bills.

The shortcomings in the system "need to be addressed to ensure a secure environment for health data," said the main report, adding that the findings "raise concern" about the effectiveness of security safeguards for personal health care information.

President Obama has set a goal for every American to have a secure electronic health record by 2014. Eventually, hospitals and doctors would be able to instantly share patients' clinical information online.

That could prevent life-threatening medical mistakes like giving an unconscious emergency room patient a drug to which he's allergic. It could also save money by cutting duplicative lab tests and scans.

Auditors for the inspector general found that the government agency leading the push for electronic records has put in place some requirements for safely transmitting computerized medical data.

However, that same agency has not issued general security requirements for the computer systems at hospitals and doctors' offices, systems on which the information would be created, shared and stored. It's a little like putting a big lock on the front door of the house, but leaving the garage door open.

To underscore the point, the second audit examined computer security at seven large hospitals in different states and found 151 security vulnerabilities, from ineffective wireless encryption to a taped-over door lock on a room used for data storage. The auditors classified four out of five of the weaknesses uncovered as "high impact," meaning they could result in costly losses, injury or death.

The government is offering rewards and penalties to encourage hospitals and doctors' offices to adopt electronic medical records. Incentive payments could total as much as $27 billion over 10 years. Providers who insist on clinging to paper records will eventually face cuts in Medicare payments.

Responsibility for computer security is divided among several agencies in the Health and Human Services Department. The main ones are a unit called the Office of the National Coordinator, which is spearheading the drive to computerize records, and the Office of Civil Rights, which oversees the enforcement of existing privacy laws.

The inspector general said the coordinator's office has not asserted sufficient leadership on security, and the civil rights unit needs to redouble efforts to safeguard electronic privacy.

In a written response, the coordinator's office said it's trying to balance between encouraging the adoption of electronic records and adding burdensome requirements. But it agreed to "actively explore" requiring stronger safeguards.

In its response, the civil rights unit questioned whether investigators could draw sweeping conclusions from audits of seven hospitals, and added that it regularly performs compliance reviews on health care facilities that report a breach affecting 500 people or more.

The hospitals were located in California, Georgia, Illinois, Massachusetts, Missouri, New York, and Texas. For security reasons, they were not identified. But the list of vulnerabilities read like a road map for hackers.

All of the hospitals had access-control vulnerabilities, including inadequate passwords, computers that did not automatically log off inactive users, and unencrypted laptops that contained patient data.

Most of the hospitals had problems with wireless access, including inability to detect unauthorized intrusion, lack of continuous monitoring, and in some cases no firewall separating wireless from other internal networks.

Another common problem was that hospitals were slow to update their computer software to defeat known security bugs.

One case was decidedly low-tech: At one hospital, the lock on the back door of a room used to store radiology data was taped over. The report said that as the auditors were watching, they saw a maintenance worker walk in.