Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Friday May 09 2014, @01:33PM   Printer-friendly
from the first-do-no-harm dept.

An inadvertent data leak that stemmed from a physician's attempt to reconfigure a server cost New York Presbyterian Hospital and Columbia University Medical Center $4.8 million to settle with the U.S. Department of Health and Human Services (HHS). The hospitals and HHS announced the voluntary settlement, which ends an inquiry into the incident, on Wednesday.

From the article:

The breach occurred in 2010 after a physician at Columbia University Medical Center attempted to "deactivate" a personally owned computer from an New York Presbyterian network segment that contained sensitive patient health information, according to the HHS.

In a joint statement, the two hospitals blamed the leakage on an "errantly configured" computer server. The error left patient status, vital signs, laboratory results, medication information, and other sensitive data on about 6,800 individuals accessible to all via the Web.

New York Presbyterian will pay $3.3 million, while Columbia will pay $1.5 million to settle the complaint. The hospitals also agreed to take "substantive" corrective action, including development of a new risk management plan and new policies and procedures for handling patient data. HHS will also be provided with periodic progress updates under the agreement.

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 1) by Alien8r on Friday May 09 2014, @02:56PM

    by Alien8r (1322) on Friday May 09 2014, @02:56PM (#41277) Homepage

    Yep, really short on details AND poorly worded.
    The article mixes terms that might describe an end user device and a server.
    In total they are talking a bout a server, not some end user device.
    So, some doctor reconfigured a server and left it less secure.
    -----
    In hospital environments doctors are the top of the food chain and IT people are tolerated.
    Different departments will set up their own systems, different departments will have outside vendors configure their systems and allow firewall holes for outside 'management'.
    It is worse then you imagine and the CIO/CTO (in my experience) will be forced to allow the various doctors whims.
     

    --
    No brain, no pain.