<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: prescription]]></title>
    <link>http://securityratty.com/tag/prescription</link>
    <description></description>
    <pubDate>Tue, 04 Dec 2007 13:17:26 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[CBAC & Medical Identity Theft]]></title>
      <link>http://securityratty.com/article/02105d066a63c57c66a00f92ef63e99d</link>
      <guid>http://securityratty.com/article/02105d066a63c57c66a00f92ef63e99d</guid>
      <description><![CDATA[Good story to keep in mind for those of you working on CBAC. Claims neeed protection and verification. Why steal an identity when you can capture a claim? (hattip: askelizabeth
The Sopranokovs
The...]]></description>
      <content:encoded><![CDATA[<p>Good story to keep in mind for those of you working on CBAC. Claims neeed protection and verification. Why steal an identity when you can capture a claim? (hattip: <a href="http://askelizabeth.typepad.com/weblog/2008/07/medical-identity-theft-the-new-frontier-for-organized-crime.html">askelizabeth</a>)

</p><blockquote><p>
	The Sopranokovs 
	</p></blockquote><blockquote><p>The Russian mob comes to town with a new scam—medical identity theft. 	
	</p></blockquote><blockquote><p>When FBI special agent Ted Price peered through the window of a dingy brick storefront on Southwest Morrison Street in March, it was what he didn’t see that caught his attention. 	</p></blockquote><blockquote><p>The business, called UnimedCorner, claimed to provide ailing seniors with orthotics—braces and other devices to correct foot, joint and back problems. 	
	</p></blockquote><blockquote><p>Price and other federal investigators were skeptical. 	
	</p></blockquote><blockquote><p>On Unimed’s showroom floor, Price saw wheelchairs, motorized scooters, a variety of canes and, on the walls, a selection of amateurish paintings and framed photographs. There was no evidence, however, of the kinds of equipment for which Unimed had billed Medicare nearly $2 million in the previous couple of months. 	
	</p></blockquote><blockquote><p>“I observed wheelchairs and canes through the window but did not see any orthotics in the store,” Price later wrote in a search-warrant affidavit. “It is a sign of fraud that the store is not stocking the items [for which] it is billing.” 	
	</p></blockquote><blockquote><p>By the time Price arrived on the scene, the company’s owner, a shadowy Russian immigrant named Alexandr Shcherbakov, was long gone. 	
	</p></blockquote><blockquote><p>Today, Shcherbakov’s store sits undisturbed. The message light on the phone blinks, dead potted plants droop and a stuffed toy monkey slumps in a glass display case. 	
	</p></blockquote><blockquote><p>And behind the cash register hangs a framed poster of television’s best-known mobsters, the Sopranos. 	
	</p></blockquote><blockquote><p>From interviews and information presented in federal affidavits, it is clear Shcherbakov moved to Oregon to commit a crime elegant and lucrative enough to make Tony Soprano envious: medical identity theft. 	
	</p></blockquote><blockquote><p>... 	
	</p></blockquote><blockquote><p>“Medical identity theft is the new frontier for organized crime,” says Alex Johnson, a former FBI agent who investigates fraud for Regence BlueShield. “Pretty much anybody can set up a mom-and-pop operation and start cranking out claims.”
	
	Someday, most Americans will need a cane, wheelchair, home hospital bed or another of the items healthcare professionals call “durable medical equipment,” or DME. 	
	</p></blockquote><blockquote><p>For those over 64 and without private insurance, there’s a good chance federally funded Medicare will pick up the tab for that equipment. Last year, according to federal statistics, Medicare spent $8.6 billion on DME. 	
	</p></blockquote><blockquote><p>Here’s the way the system is supposed to work: A doctor prescribes a device such as a wheelchair for a patient, who presents his prescription to a DME supplier. The supplier provides the equipment and bills Medicare, which typically pays 80 percent of the cost.
	
	Unlike pharmacists, who fill prescriptions under strict scrutiny of state and federal watchdogs, DME suppliers are lightly regulated.
	
	“DME is very vulnerable to fraud,” says Consuelo Woodhead, the chief healthcare fraud prosecutor for the U.S. Attorney’s Office in Los Angeles. “It doesn’t require any background in medicine, any kind of professional licensure or appreciable capital. </p></blockquote><blockquote><p>There are barriers of entry in other medical fields, but not in DME.”
	
	To operate, DME suppliers simply need a place of business, a business license and liability insurance. Unlike pharmacists, DME suppliers operate under an honor system: The feds count on them to supply the equipment they claim to provide to the beneficiaries who need it. 	
	</p></blockquote><blockquote><p>That honor system is not working. 	
	</p></blockquote><blockquote><p>The epicenter of DME fraud, according to the federal Department of Health and Human Services, is South Florida, where Medicare billing for DME quadrupled from 2002 to 2006 to $1.7 billion.
	
	Investigators found much of that increase was due to fraud. In 2006, federal inspectors revoked the licenses of 634 DME suppliers in South Florida, nearly half the DME dealers in the region. </p></blockquote><blockquote><p>Later the same year, raids in Southern California yielded similar results: The feds shut down 95 DME suppliers.
	
	Many of the DME suppliers shut down around Los Angeles were run by immigrants from the former Soviet Union. It’s probably no coincidence that when the feds raided Los Angeles DME suppliers, some Angelenos fled to cities where there was less scrutiny—such as Portland.</p></blockquote>]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 06:09:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/dme suppliers simply">dme suppliers simply</category>
      <category domain="http://securityratty.com/tag/dme suppliers">dme suppliers</category>
      <category domain="http://securityratty.com/tag/dme fraud">dme fraud</category>
      <category domain="http://securityratty.com/tag/fraud">fraud</category>
      <category domain="http://securityratty.com/tag/dme">dme</category>
      <category domain="http://securityratty.com/tag/identity">identity</category>
      <category domain="http://securityratty.com/tag/medical identity theft">medical identity theft</category>
      <category domain="http://securityratty.com/tag/dme dealers">dme dealers</category>
      <category domain="http://securityratty.com/tag/dme supplier">dme supplier</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/07/cbac-medical-identity-theft.html">CBAC &amp; Medical Identity Theft</source>
    </item>
    <item>
      <title><![CDATA[Health care practices and UCSF patient records exposed]]></title>
      <link>http://securityratty.com/article/7cab17fdc352275114a54ec17a2e2887</link>
      <guid>http://securityratty.com/article/7cab17fdc352275114a54ec17a2e2887</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/1/08

Organization
University of California

Contractor/Consultant/Branch
University of California at San Francisco (&quot;UCSF
Target America Inc

Victims...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/ucsf.jpg" align="right" height="54" width="79"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/1/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.universityofcalifornia.edu/">University of California</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.ucsf.edu/">University of California at San Francisco ("UCSF")</a> <br><a href="http://www.tgtam.com">Target America Inc.</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>6,313<br><br><span style="font-weight: bold;">Types of Data:</span><br>"The information included names, addresses, medical departments and some patient medical record numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"(05-01) 17:22 PDT San Francisco -- Information on thousands of UCSF patients was accessible on the Internet for more than three months last year, a possible violation of federal privacy regulations that might have exposed the patients to medical identity theft"<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/05/02/MNKE10DRGN.DTL">San Francisco Chronicle</a> <br><a href="http://www.news.com/8301-10784_3-9934612-7.html">CNET</a> <br><a href="http://www.upi.com/NewsTrack/Science/2008/05/03/hospital_data_left_open_online/2530/">United Press International</a> <br><a href="http://pub.ucsf.edu/newsservices/releases/200805051/">UCSF News Release</a> <br><br><b>Report Credit:</b><br>Elizabeth Fernandez, San Francisco Chronicle<br><br><b>Response:</b><br>From the online sources cited above:<br><br>Information on thousands of UCSF patients was accessible on the Internet for more than three months last year, a possible violation of federal privacy regulations that might have exposed the patients to medical identity theft, The Chronicle has learned.<br><br>The information accessible online included names and addresses of patients along with names of the departments where medical care was provided.<br><br>Some patient medical record numbers and the names of the patients' physicians also were available online.<br><br>The breach was discovered Oct. 9, but the medical institution did not send out notification letters to the 6,313 affected patients until early April, nearly six months later.<br><br>Sensitive information can be used by employers, health insurers and other entities to discriminate<br><br>thieves can use purloined information to obtain medical treatment and prescription drugs and to file false medical claims.<br><i>[Evan] Purloined is a funny word.&nbsp; </i><br><br>"This is a large and very significant data breach," said Pam Dixon, executive director of the World Privacy Forum<br><br>"To commit medical identity theft, all you need is a patient's name, address and the name of the hospital. If you have a doctor's name and the medical department where the patient was being treated, it is gold. If you add a medical record number, it is a disaster for patients."<br><i>[Evan] I don't think most people know this.&nbsp; Many people think that they are fine if there were no Social Security numbers or credit card numbers exposed.</i><br><br>Hospital officials say there's no indication of identity theft to date.<br><br>UCSF had shared information on its patients with a vendor, Target America Inc., which mines electronic databases amassing information about a nonprofit's potential or existing donors.<br><br>Target America, whose Web site says it maintains "the highest standards of security," tunnels through millions of electronic records to help nonprofits identify and cultivate future donors as well as current donors "who could be giving you more." Additionally, it unearths financial information about donor friends and business acquaintances - even offering maps of a donor's neighborhood.<br><i>[Evan] Seems wrong, doesn't it?&nbsp; You go to the clinic, the clinic farms out your information to a company that determines whether or not you are a good candidate to hit up for money (you probably don't pay enough in health insurance, deductibles and co-pays).&nbsp; If you are a deemed a good donor candidate, you get emails and letters that you never signed up for.&nbsp; The purpose of the emails and letters is to build a rapport with you with the intention of getting you to donate money.&nbsp; Personally, I would be more willing to donate if an organization were straight with me.</i><br><br>The breach was discovered, said UCSF officials, when the hospital was alerted that a patient's name had been queried on the Internet "and it was listed in association with UCSF."<br><br>Corinna Kaarlela, UCSF director of news services, said immediate action was taken to close off the information. Ten days after the breach's discovery, UCSF ended its business agreement with Target America.<br><br>Nancy Johnson, president of Target America, said she could not discuss the matter because of client confidentiality.<br><i>[Evan] There is no mention of this breach anywhere on Target America's site either.&nbsp; Sweep it under the rug and maybe it will go away?</i><br><br>The breach spotlights a little-known practice among medical institutions to plow the ranks of patients for fundraising purposes.<br><br>Hospitals and other health care providers are turning patients into "fundraising free-fire zones," said Dr. Arthur Caplan, chairman of the department of medical ethics at the University of Pennsylvania School of Medicine.<br><br>"The breach is a symptom, but the real ethics challenge is the extent to which health care institutions are tracking patients and their families for nonmedical reasons - for fundraising, marketing, advertising," Caplan said. "I don't think people are aware of the degree to which this is occurring, whether it's by a hospital or a nursing home or a hospice."<br><br>Since 2004, UCSF said it provided the names and addresses of 30,590 patients to Target America, paying the company $12,000 a year.<br><br>Hospital officials said it contracted with the company to assist "with identifying names of individuals who could potentially receive communications from UCSF."<br><i>[Evan] Why not say it like it is.&nbsp; The true motive?</i><br><br>"These opportunities included upcoming events, developments in specific UCSF programs, and opportunities to support the University."<br><i>[Evan] Closer.</i><br><br>After the breach was discovered, the hospital said it required Target America to hire "an objective third-party firm" to investigate. UCSF received the forensic analysis report March 26. It showed that information was potentially accessible from July 1 to Oct. 9 last year "if a query for a specific name was made." Notification letters were mailed to patients April 4.<br><br>While UCSF officials stressed that the breach did not involve Social Security numbers, Dixon said that patients could nonetheless be at risk for harm.<br><br>"With medical identity theft, there is so much on the line - only minimal information needs to go out for there to be a problem," she said.<br><br>Linking patients to the departments where they were treated, for instance, is problematic because it can serve as a key identifier of a patient's health condition.<br><i>[Evan] Don't think that this doesn't happen.&nbsp; Insurance companies are not in business to help people, they are in business to make money.&nbsp; They want to identify as many pre-existing conditions as possible.</i><br><br>UCSF officials say the use of a department's name is not prohibited under HIPAA. But it acknowledged that such a disclosure is against its own "best practice" policy.<br><i>[Evan] I think that this is open to interpretation.&nbsp; HIPAA is not clear (nor can it be) in all circumstances, and some people would argue this claim with UCSF officials.</i><br><br>"Steps have been taken to reinforce this practice," <br><i>[Evan] Like what?&nbsp; Are "steps" enough?</i><br><br>For one outraged UCSF patient whose name was part of the online data disclosure, the incident involved an alarming breach of medical trust.<br><br>"They told a fundraising company that I'm a patient - morally this should not ever be done by any health care provider," said the patient, a retired executive living in San Francisco. He asked that his name not be published. <br><br>"Medical records are supposed to be of utmost privacy," he said. "The University of California is high up in the totem pole for quality medical care. When you go there, the first thing you see are notices regarding patient privacy. Why in the world would they give out my private information? It boils down to monetary greed."<br><i>[Evan] There is no doubt that UCSF Medical Center is an outstanding health provider in terms of providing innovative medical care and saving lives.&nbsp; One of the best from what I read.</i><br><br>UCSF is committed to maintaining the privacy of patient information and takes any compromise of patient information very seriously. When patients are seen at UCSF, they are provided with a Notice of Privacy Practice (NOPP), which describes how UCSF may use and disclose their medical information in accordance with the Federal HIPAA Privacy Rule.<br><br>UCSF continually modifies systems and practices to enhance the security of patient information.<br><br><b>Commentary:</b><br>Hmm.&nbsp; I agree with Dr. Caplan when he stated that "The breach is a symptom, but the real ethics challenge is the extent to which health care institutions are tracking patients and their families for nonmedical reasons - for fundraising, marketing, advertising,".&nbsp; There is not much discussion surrounding the details of the actual breach itself.&nbsp; I have also read concern of the length of time it took before patients were notified.<br><br>From Target America's "<a href="http://www.tgtam.com/why.php">Why Target America?</a>" page:<br>"Target America data base, culled from 75 data sources, contains more than 7 million records of the wealthiest and most generous people in the nation -- the top 5 percent in terms of income, assets, and philanthropic history. Ninety-four percent of the individuals on the data base give more than $5,000 a year to charities. The breadth of our data is unique: we focus not only on high-profile, corporate America, but include emerging sources of wealth such as minority-owned business and women entrepreneurs."<br>Looks like a pretty important database to me.&nbsp; <br><br>There are no apologies made by UCSF or Target America for the breach. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>University of California:<br>April, 2008 - <a href="http://breachblog.com/2008/04/10/uci.aspx">University of California Irvine students are hit with mysterious breach</a> </font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/07/ucsf.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 07 May 2008 12:10:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ucsf">ucsf</category>
      <category domain="http://securityratty.com/tag/ucsf patient">ucsf patient</category>
      <category domain="http://securityratty.com/tag/ucsf patients">ucsf patients</category>
      <category domain="http://securityratty.com/tag/patients">patients</category>
      <category domain="http://securityratty.com/tag/patient">patient</category>
      <category domain="http://securityratty.com/tag/sensitive information">sensitive information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/patient information">patient information</category>
      <category domain="http://securityratty.com/tag/ucsf medical center">ucsf medical center</category>
      <source url="http://breachblog.com/2008/05/07/ucsf.aspx">Health care practices and UCSF patient records exposed</source>
    </item>
    <item>
      <title><![CDATA[Microsoft Senior PC - not just for the elderly]]></title>
      <link>http://securityratty.com/article/b40833af463c4e7344afed3fa409ff04</link>
      <guid>http://securityratty.com/article/b40833af463c4e7344afed3fa409ff04</guid>
      <description><![CDATA[My mother-in-law is, to give her some credit, an intelligent lady. However, faced with an upgrade from Windows XP to Vista and IE7 from IE6 and you have a situation akin to explaining quadratic...]]></description>
      <content:encoded><![CDATA[
      My mother-in-law is, to give her some credit, an intelligent lady. However, faced with an upgrade from Windows XP to Vista and IE7 from IE6 and you have a situation akin to explaining quadratic equations to a two year old. Both circumstances will result in heavy objects being thrown around in frustration. 

So, the idea of Microsoft to provide a range of "<a href="http://www.microsoft.com/enable/aging/seniorpc.aspx">Senior PC packages</a>" is, in my mind, borderline genius and something I wish I had thought of first. Computer Weekly <a href="http://www.microsoft.com/enable/aging/seniorpc.aspx">mock the idea</a> in this weeks magazine, something I think is very unfair given that I'm sure some of their editorial team are getting on a bit and would probably be able to make good use of the built-in prescription software...

If home computing can be made as easy as taking the PC out of the box, plugging it in and turning it on (not a word from the Mac users please - I know you've been able to do this for years) then that's to be encouraged for everyone, not just the elderly. And if it stops the "support" calls from my mother-in-law then that's priceless!
      
   ]]></content:encoded>
      <pubDate>Tue, 06 May 2008 15:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/built-in prescription software">built-in prescription software</category>
      <category domain="http://securityratty.com/tag/computer weekly mock">computer weekly mock</category>
      <category domain="http://securityratty.com/tag/heavy objects">heavy objects</category>
      <category domain="http://securityratty.com/tag/intelligent lady">intelligent lady</category>
      <category domain="http://securityratty.com/tag/mother-in-law">mother-in-law</category>
      <category domain="http://securityratty.com/tag/situation akin">situation akin</category>
      <category domain="http://securityratty.com/tag/quadratic equations">quadratic equations</category>
      <category domain="http://securityratty.com/tag/idea">idea</category>
      <category domain="http://securityratty.com/tag/editorial team">editorial team</category>
      <source url="http://www.computerweekly.com/blogs/stuart_king/2008/05/my-motherinlaw-is-to-give.html">Microsoft Senior PC - not just for the elderly</source>
    </item>
    <item>
      <title><![CDATA[Human error is blamed in WellCare Health Plans breach]]></title>
      <link>http://securityratty.com/article/cbc5414d6865f7f4f33a04c97a433326</link>
      <guid>http://securityratty.com/article/cbc5414d6865f7f4f33a04c97a433326</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/7/08

Organization
WellCare of Georgia, Inc

WellCare Health Plans, Inc. provides managed care services exclusively for government-sponsored healthcare...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/wellcare.jpg" align="right" height="54" width="161"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/7/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.wellcare.com/">WellCare of Georgia, Inc.</a>* <br><br><font size="1">*WellCare Health Plans, Inc. provides managed care services exclusively for government-sponsored healthcare programs, focusing on Medicaid and Medicare. Headquartered in Tampa, Florida, WellCare offers a variety of health plans for families, children, the aged, blind and disabled and prescription drug plans, currently serving more than 2.3 million members nationwide. </font><br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Members of "Georgia Families"<br><br><span style="font-weight: bold;">Number Affected:</span><br>up to 71,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"name, birth date, dates of eligibility, Medicaid or PeachCare for Kids member identification number, social security number or other health plan related information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"ATLANTA, GA (April 7, 2008) — WellCare of Georgia, Inc. today announced that a human error made some Georgia Families member data available on the Internet. On March 28th, WellCare secured the data on its own computer systems and by April 2nd, all WellCare member information had been removed from the Internet. "<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.wellcare.com/WCAssets/corporate/assets/Georgia_press_release_040708_final.pdf">WellCare announcement</a> <br><a href="http://triangle.bizjournals.com/triangle/othercities/tampabay/stories/2008/04/07/daily18.html">Triangel Business Journal</a> <br><a href="http://www.ajc.com/metro/content/metro/stories/2008/04/08/breach_0409.html">The Atlanta Journal-Constitution</a> <br><a href="http://www2.tbo.com/content/2008/apr/09/bz-georgia-wellcare-data-exposed/">The Tampa Tribune</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>WellCare Health Plans<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Private records of up to 71,000 Georgia families who are members of health insurance programs for the poor or working poor were accidentally made available on the Internet for several days, and some of the data may have been viewed by unauthorized people, Tampa-based WellCare Health Plans Inc. said today.<br><br>“We were able to determine what data was available on the Internet,” explained Anil Kottoor, WellCare’s chief information officer, “and we are notifying anyone who might have been affected.”<br><br>a human error allowed the information to be accessible for an unknown period of time, but that the secret data was removed from the Internet on April 2. It was not immediately known when the data breach occurred or how long the secret data was available.<br><br>The state of Georgia said it was notified March 31.<br><br>WellCare believes that this affected only our Georgia Families membership in Georgia, and not our Medicare coordinated care, private fee-for-service or prescription drug plan membership. <br><br>The files exposed did not contain credit card, debit card or financial account numbers. <br><br>They may have contained personal identifying information, such as a member’s name, birth date, dates of eligibility, Medicaid or PeachCare for KidsTM member identification number, social security number or other health plan related information. <br><br>about 10,500 members' Social Security numbers may have been viewed by unauthorized people on the Internet, all members of Medicaid or PeachCare.<br><br>"There is a possibility that an initial 59,000 members may have had some personal information made accessible, so we are notifying them as well, just to be safe," Knapp said. (spokeswoman Amy Knapp)<br><br>At this time, WellCare is not aware of any misuse of its member information due to the accidental exposure of the file on the Internet.<br><br>A Web developer prepared a copy of a DCH report folder that was "to be deployed to our Georgia Web portal" but instead made it accessible on the Internet. <br><span style="font-style: italic;">[Evan] Ugh.&nbsp; I can state from a lot of first-hand experience that developers can either be your information security best friend or your information security worst enemy.&nbsp; Developers that put functionality and usability first without taking information security into account along the way can be dangerous.&nbsp; Effective information security governance and information security training and awareness can help significantly.&nbsp; Having said all of that, people are people and we all make mistakes.&nbsp; I wonder if there is room for significant process improvement here though.</span><br><br>She said at least 53 folders of names were accessed 248 times.<br><span style="font-style: italic;">[Evan] This means that the folders and files did not go completely unnoticed.</span><br><br>WellCare is now notifying in writing the members who could have been affected by this incident. Members should receive those letters by the middle of this week. <br><br>WellCare is offering to pay for one year of credit monitoring for those individuals.<br><span style="font-style: italic;">[Evan] Every time I see this offering in a breach notification if feel like this is really short-sighted.&nbsp; Better than nothing I guess, but people need to recognize it for what it is.</span><br><br>“We regret that this incident occurred,” said Mike Cotton, president of WellCare’s Georgia region. “WellCare takes the privacy and security of personal information very seriously. It is an honor to serve our members in Georgia, and we apologize for any inconvenience this issue has caused.” <br><br>To ensure its data security for the future, WellCare has retained a national information technology firm to perform a full assessment of its security and privacy controls.<br><span style="font-style: italic;">[Evan] I wonder who.&nbsp; A "national information technology firm" means very little to me.&nbsp; The "national information technology firm" may do a good job for helping improve "information technology", but who is going to handle "information security"?&nbsp; Information security is NOT an information technology issue.&nbsp; It's bigger than that. </span><br><br><span style="font-weight: bold;">Commentary:</span><br>This breach is being chalked-up as human error, but I think there are many times when "human error" could have been avoided by effective processes and controls.&nbsp; I appreciate WellCare's candid explanation and attempt to make things better. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/04/09/wellcare.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 09 Apr 2008 08:39:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/wellcare">wellcare</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/wellcare health plans">wellcare health plans</category>
      <category domain="http://securityratty.com/tag/health plans">health plans</category>
      <category domain="http://securityratty.com/tag/information technology issue">information technology issue</category>
      <category domain="http://securityratty.com/tag/georgia families">georgia families</category>
      <category domain="http://securityratty.com/tag/breach description">breach description</category>
      <source url="http://breachblog.com/2008/04/09/wellcare.aspx">Human error is blamed in WellCare Health Plans breach</source>
    </item>
    <item>
      <title><![CDATA[Some Massachusetts seniors are at risk]]></title>
      <link>http://securityratty.com/article/e5ab89e51e3da41fa9d30552261ef453</link>
      <guid>http://securityratty.com/article/e5ab89e51e3da41fa9d30552261ef453</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
11/30/07

Organization
State of Massachusetts

Contractor/Consultant/Branch
Executive Office of Health and Human Services

Victims
Prescription Advantage...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/mass.jpg" align="right" height="51" width="167"><font size="2"><strong>Date Reported: </strong><br>11/30/07<br><br><strong>Organization: </strong><br>State of Massachusetts<br><br><strong>Contractor/Consultant/Branch:</strong><br>Executive Office of Health and Human Services<br><br><strong>Victims:</strong><br>Prescription Advantage insurance program members*<br><br><font size="1">*Prescription Advantage is a state-run program that offers drug insurance to seniors in Massachusetts.</font><br><br><strong>Number Affected:</strong><br>150,000<br><br><strong>Types of Data:</strong><br>"personal information"<br><br><strong>Breach Description:</strong><br>Authorities arrested an identity thief in August, 2007 who had been using information obtained from the Massachusetts Presrciption Advantage program in an attempted identity theft scheme.&nbsp; It is not yet clear how the thief obtained the information.<br><br><strong>Reference URL:</strong><br><a href="http://www.pcworld.com/article/id,140206/article.html" target="_blank"> PC World Story</a><br><a href="http://www.infoworld.com/article/07/11/30/Data-theft-touches-Massachusetts-seniors_1.html" target="_blank"> Information World Story</a><br><a href="http://www.bostonherald.com/entertainment/health/healthcare/view.bg?articleid=1048101" target="_blank"> The Boston Herald Story</a><br><br><strong>Report Credit:</strong><br>Associated Press via The Boston Herald<br><br><strong>Response:</strong><br>From the sources cited above:<br><br>Thousands of senior citizens are being warned about a computer security breach involving the state’s Prescription Advantage program.<br><em>[Comfyllama] It seems like senior citizens are among the easiest prey for identity theives.</em><br><br>Executive Office of Health and Human Services spokeswoman Alison Goodwin wouldn’t say what kind of personal information may have been compromised, such as names, addresses or Social Security numbers.<br><br>Local authorities arrested a lone identity thief in August who had been using information taken from the program in an attempted identity theft scheme, said Alison Goodwin, a spokeswoman for the state's Executive Office of Health and Human Services.<br><br>Goodwin could not add many details on the nature of the breach, citing an ongoing criminal investigation, but she said Prescription Advantage is conducting an internal review of the incident to determine if additional security measures might be required.<br><em>[Comfyllama] If data leaked, then I would say that additional security measures are probably required.&nbsp; Sounds obvious, but to some it just doesn't sink in.</em><br><br>The data breach did not affect all members of the program, Goodwin said<br><em>[Comfyllama] I wonder how this conclusion is drawn?&nbsp; If the breach does not affect all 150,000 then why inform 150,000?&nbsp; Maybe Prescription Advantage doesn't know who was affected and who wasn't.</em><br><br>Prescription Advantage recently began notifying 150,000 members potentially affected, as required by state data-breach laws.<br><br>"A few members were recently the victims of attempted identity theft," the state said in a Nov. 19 letter sent to possible victims.<br><em>[Comfyllama] OK, here it states that a few members were victims of identity theft and earlier statements said the identity thief "had been using information taken from the program".</em><br><br>The staff that maintains the program has "no reason to believe" that any Prescription Advantage members' data has been misused, the letter adds.<br><em>[Comfyllama] Here, the letter states that there is no reason to believe that any data was misused?!&nbsp; A little confusing and contradictory.&nbsp; If confidentiality cannot be assured, assume it has been lost.</em><br><br>Members who have questions about the breach can call Prescription Advantage during regular business hours: 1-866-523-6846 or 1-877-610-0241 for those who are hearing impaired.<br><br><strong>Commentary:</strong><br>Much is left in the dark about this breach.&nbsp; I certainly hope that more details are being shared with victims.&nbsp; They should demand it.<br><br>I am curious about too many things to even mention them all. <br><br><strong>Past Breaches:</strong><br>October, 2007 - <a href="http://breachblog.com/2007/10/03/mass.aspx" target="_blank"> Massachusetts DPL sends Social Security numbers in mail</a></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2007/11/30/masspa.aspx" type="text/javascript" charset="utf-8"></script>
<br>
<br>
<script type="text/javascript"><!--
google_ad_client = "pub-4721162729073131";
google_ad_width = 468;
google_ad_height = 60;
google_ad_format = "468x60_as";
google_ad_type = "text_image";
google_ad_channel = "";
//-->
</script>
<script type="text/javascript">
</script>]]></content:encoded>
      <pubDate>Tue, 04 Dec 2007 13:17:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/computer security breach">computer security breach</category>
      <category domain="http://securityratty.com/tag/breach description">breach description</category>
      <category domain="http://securityratty.com/tag/prescription advantage">prescription advantage</category>
      <category domain="http://securityratty.com/tag/security breach">security breach</category>
      <category domain="http://securityratty.com/tag/prescription advantage program">prescription advantage program</category>
      <category domain="http://securityratty.com/tag/data-breach laws">data-breach laws</category>
      <category domain="http://securityratty.com/tag/lone identity thief">lone identity thief</category>
      <category domain="http://securityratty.com/tag/thief">thief</category>
      <source url="http://breachblog.com/2007/11/30/masspa.aspx">Some Massachusetts seniors are at risk</source>
    </item>
  </channel>
</rss>
