It was kind of funny reading this recent article from the New York Times that focuses on a relatively small health data breach from Stanford Hospital’s emergency room:
A medical privacy breach involving Stanford Hospital in Palo Alto, Calif., led to the public posting of data for 20,000 emergency room patients, including names and diagnosis codes, on a commercial Web site for nearly a year, the hospital has confirmed.
Since discovering the breach last month, the hospital has been investigating how a detailed spreadsheet made its way from one of its vendors, a billing contractor identified as Multi-Specialty Collection Services, to a Web site called Student of Fortune, which allows students to solicit paid assistance with their schoolwork.
Gary Migdol, a spokesman for Stanford Hospital and Clinics, said the spreadsheet first appeared on the site on Sept. 9, 2010, as an attachment to a question about how to convert the data into a bar graph.
Although medical security breaches are not uncommon, the Stanford breach was notable for the length of time that the data remained publicly available without detection.
"Medical security breaches are not uncommon" is an understatement. According to the Department of Health and Human Services, 5,408,977 people have had their medical data lost or stolen, so an article that cries foul of 0.37% of this 2010 total seems fairly trivial. Worse, the reported trend is rising.
The real question that should be asked is this: What is the Department of Health and Human Services going to do about all of these data breaches? They seem to be intent on assuring us they’re doing a good job enforcing these breaches, but we have to wonder.
So far, it seems they really can’t do much to stem the tide: there are just too many people with computers claiming a "need to know" that have access to patients’ private health data.
-Wes
Addendum: Make that 7.9 million records breached since 2009. (h/t: PDara, MD viaTwitter)
Related: KevinMD blog: Your medical information is not private, and it’s sold routinely.
