Premera healthcare: US govt security audit gave hacked biz thumbs up

Re: Bah!

There's more to HIPPA just like there's the PCI compliance that all financial institutions have to deal with.

Re: Bah!

HIPAA covers how Protected Health Information that is identifiable can be accessed be people. Because of changes to technology in the last 20 years, the enforcement of HIPAA has been extended to include information security.

Having working in healthcare previously, I can attest to the rectal probing that an audit should bring when done with actual compliance in mind. Generally, even automated or transactional accesses to PHI was logged and justified. Since it extended to automated processes, just having a generic "SysUser" account for any and all applications that might access the data was not cool, so a unique identifier was required.

We were often asked to "Give me all you've got," by incoming systems and we had to get them to outline the exact data they needed, what it was needed for, and what, if any, was going to persist in their system. Even if they persisted none of it, however, there was a conversation way above my pay grade that often resulted in a much reduced field count and/or without any kind of the forbidden identifiers.

I'd heard that others around us were similar, though that might have been because healthcare is a rather important field in my geographical location, so there is a lot of poaching... err, cross-pollination of ideas, so it wouldn't surprise me to learn that through sheer luck, the healthcare companies in my neck of the woods are a bit stronger... but I'll probably see a local company hacked in tomorrow's paper just to make an idiot of me.

As far as the "seal of approval" from the OPM, I think they only are really concerned about the security of federal employee data... and it wouldn't surprise me if such data was kept sequestered from the other information to please government auditors. Where I was, the PHI of Medicare, Medicaid, Military, and Federal Employees were kept separate from other clients and had tighter control as the government had standards in excess of what was required by law, while the other clients were more concerned about NDAs, IP, and trade secrets (which they often considered things like benefits to be). So at Premera, don't be surprised if few, if any, people associated to a federal contract were compromised.

BOFH is real. Most folks I know in IT are trying like hell to make things right and their managers are trying like hell to fuck it all up.

Don't even get me started about internal politics and how many upper level execs will gladly throw everyone to the wolves to get their way.

Re: Lax US Security Rules????

Kaplow! You nailed it.

Our current government, especially congress, is totally uninterested in impeding the free flow of capitalism. Don't let regulations and audits get in the way. After all, we're encouraging the rest of the world to be as corrupt and capitalistic as we are (steal from the people, deliver to the crooks)!

Re: Lax US Security Rules????

HIPAA was updated with the ACA (I think) to extend the same protections on physical data to electronic health records. How every company implements those requirements, or if they've decided that a claim filed through a provider portal should have the same level of security as one sent via fax probably varies much more than necessary. To me, it's logical that an electronic claim is protected the same way a paper claim is, especially since even before electronic claims became a thing, those paper claims were often entered into some green-text "UI" that used keystrokes and Function keys to navigate (I noticed those still existed in 2014).

The reality is that the OPM's audit was likely more concerned about the protection of the federal employees then the overall security of the system. And as many federal contracts demand security that is in excess of the legal requirements, companies often maintain separate datastores, user tables, and even applications to deal with those requirements. One the other side, non-governmental clients worry about things like the company logo is scaling properly, the exact color hex codes are used for the portal, and that their employees are being served an HR-approved message on some tertiary screen that is only accessed during 0.1% of all portal sessions, likely the HR bod worried about the messaging.

Re: Lax US Security Rules????

Yes and no. As always how it gets implemented in a particular office often has more to do with the people implementing it.

Technically I haven't worked in such an environment myself (although God knows why given some of the data a company I use to work for analyzed*), but for two years I had a boss who had. There's an IT end to it that in theory is every bit as important as the physical end of it. She had the processed nailed down hard, and tried to adopt as much of it as she could to our environment on the basis that most of it is actually bog standard horse sense.

*Yeah, it was insurance and hospital data. But because we were working under the auspices of Congress instead of actually being the medical facility we were somehow "exempted" from HIPAA. No, I didn't really believe if anything bad happened that would hold up. But I wasn't high enough in the food chain to say otherwise. Fortunately I also never handled the data, only occasional desktop support on some of the systems, and always under the watchful eye of someone who was authorized to be in the room.

Re: So?

I can't speak for all locations, all insurance companies, etc. Only for what I've seen with my own eyes.

The word goes out when the auditors are coming. There'll be a mad dash in the customer service and claims areas to hide paper.. privacy screens come out from under the desks.... the day after the auditors leave, the privacy screens go back under the desk, and paper suddenly reappears magically.

In IT, they don't ever look at the servers via screens or examine the admin logs. They look at a logbook or a paper print-out of a log.

I really believe there's more break-ins coming and we'll have more discussions along this line.... I wouldn't be surprised if the break-ins are already underway and the companies just don't know it.

Hell, we have 5,000 employees and per the CIO, we have almost as many servers: mainframes, web-facing, departmental, test, etc. It's a no-win job trying to secure them all and even harder if there's any turnover in personnel. They discovered 20 servers last year that hadn't been used in 5 years or updated, but there they sat... connected to the network and happily idling. Overlooked, never used for much, and never audited because the sysadmin who set them up was made redundant before he got the paperwork done on their being launched.

Re: It's genuinely scary...

and that's from the outside looking in. For the inside looking out...

<<Shudder>>