Published: January 18 2011, 01:25 PM | no comments
by Sumner Blount

The shootings in Tucson have stunned the nation.  But, almost any high-profile event like this often brings out the curious - folks who want to find out more about the famous or infamous people involved in it.  And, when those folks have access to private information, the results can be bad.

Bill Brenner's recent blog at CSO.com, A Sickening Breach of Privacy, described how several employees of the hospital where the victims were sent had violated privacy policies and viewed their hospital records.  These intrusions were detected, and it appears that all the policy violators were immediately fired, a very suitable punishment for these hideous breaches of patient privacy.  Here's another comment on this situation at Healthcareinfoscurity.com, Great Work on Records Snoops Crackdown, which supports the swift dealing with the perpetrators.

There are two things that strike me about his particular case.  The first one is that anytime someone can access information that you don't want them to access, there's something wrong with your security controls. It might be that these people had access rights to view the records of any patient, which almost certainly is more than their job requires.  In this case, the problem might lie in insufficient granularity in their access privileges.  An automated role management system, along with periodic access certification, also could help to make sure that each user had only the appropriate access rights at all times.  But, whatever the cause, clearly there is some area of access management that could be improved.

Another thing that struck me was the fact that these people apparently were detected almost immediately, and summarily fired.  This reminds me of a similar case many years ago that only the old-timers will remember.  In the early 70's, President Nixon was going through a PR disaster as the extent of the Watergate scandal was unfolding.  One seminal event that in some ways sealed his fate with the public was when his tax return was breached and it showed that he only paid a little over $700, on an income of several hundred thousand dollars.  To the best of my knowledge, the person who disclosed that tax return was never found nor punished.    The whole saga of the Nixon tax returns can be found here, and it's fascinating reading even for someone too young to remember it all.

Why is this relevant?  Because back in those days, there were not only minimal controls on access to confidential information, but there was essentially no auditing of access nor monitoring to look for suspicious events like this.  We've at least progressed to the point where privacy breaches can often be detected soon after the event (even if the information is not disclosed) and dealt with quickly.

Brenner's blog appropriately states:

"Curiosity makes us do stupid things from time to time. If you work in a hospital and you have some famous patients, the urge to look at their confidential records must be overwhelming. It's still wrong, though."  

The fact that people are human is reason enough to ensure that all private information is protected by rigorous security controls, that users have access to information only if it is essential, and that controls over what they can do with the information once they access it are in place and monitored.

The shootings in Tucson have stunned the nation.  But, almost any high-profile event like this often brings out the curious - folks who want to find out more about the famous or infamous people involved in it.  And, when those folks have access to private information, the results can be bad.