Four Massachusetts hospitals investigating patients' files left at public dump

  When there are so many moving parts, just how secure is patient data?

Four Massachusetts community hospitals are investigating how thousands of patient health records, some containing Social Security numbers and sensitive medical diagnoses, ended up in a pile at a public dump.

The unshredded records included pathology reports with patients’ names, addresses, and results of breast, bone, and skin cancer tests, as well as the results of lab work following miscarriages. By law, medical records and documents containing personal identifying information must be disposed of in a way that protects privacy, and leaving them at a dump is probably illegal, privacy lawyers and hospital officials said. Violators face steep fines.

A Globe photographer discovered the records July 26 when he was dumping his trash at the Georgetown Transfer Station. When he got out of his car, he said, he saw a huge pile of paper about 20 feet wide by 20 feet long. Upset that the paper wasn’t being recycled, he looked more closely.

See tne entire article at Boston.com

...

NOTE: Article text has been summarized. Click here for the entire post.

TJX: What if it hadn't happened?

Albert Gonzalez, the man accused of hacking into major retailers such as TJX Cos., Hannaford Brothers Co. Inc. and 7-Eleven plead guilty today in Boston district court. It's been a long-road for him to come to justice, and it makes us think about how things would be different had that "major" hack into TJX's servers not happened. How long would it have taken for something like PCI compliance to happen?

That singular event was the major catalyst behind PCI compliance and the need to secure data relating to credit cards. In many ways, it was an after-thought before.

From Mass High Tech:
Accused of conspiracy in the hacking attacks on payment systems supporting companies such as retailers TJX Cos., Hannaford Brothers Co. Inc. and 7-Eleven, Albert Gonzalez, 28, of Miami, today pleaded guilty to the final charges against him in U.S. District Court in Boston.

Federal prosecutors said that Gonzalez, who allegedly controlled servers that gained access to the corporate servers and then gave information to hackers that would use malware to launch attacks on the victims, pleaded guilty to two cou...

NOTE: Article text has been summarized. Click here for the entire post.