Virginia Hackers Still at Large; Will EHRs Be Secure?

RICHMOND, Va.–The 8.3 million confidential health records that
were allegedly stolen when hackers got into Virginia’s Department
of Health Professions Web site could still be at risk. And the
hackers are still at large.
 
On April 30, hackers breached the site—the DHP is an agency
that licenses and regulates health care professionals in
Virginia—and demanded $10 million from the state government,
threatening to sell the records to the highest bidder. (See
“Hackers Hold Medical
Records Hostage,” May 7.) 
 
But Gov. Tim Kaine said Virginia wouldn’t pay the ransom, and
on June 3, the state notified 530,000 people that their personal
and medical information might have been swiped. The information,
from the DHP’s Prescription Monitoring Program computer
system, includes prescription records (possibly 35 million of them)
and some Social Security numbers.
 
According to the DHP, an investigation by the FBI and state
law enforcement has yet to identify the hackers. Meanwhile, the
agency said the state’s computer security experts “are
putting in place a number of advanced measures to prevent
incursions, including new firewalls, reconfiguring the network and
conducting vulnerability assessments of the agency’s
systems.”
 
The incident comes on the heels of the Health Information
Technology for Economic and Clinical Health (HITECH) Act, part of
the federal stimulus law, that toughened HIPAA’s security
provisions. The law also includes $20 billion to facilitate health
IT projects, including a nationwide network of electronic health
records.
 
While shared electronic records could reduce health care costs and
improve outcomes, according to some health IT experts, others have
said stronger security regulations will be necessary as the
government pushes for increased adoption of EHRs.
 
According to a Wall Street
Journal report, David Blumenthal, who took over in April as
national coordinator for health information technology at HHS, said
he sees “huge challenges” ahead on that front,
including data privacy concerns among physicians and
patients.