This is extremely troubling news. It is really important to find out exactly what the compromise was here. Was the legit clinic using an unsecure platform or do they have a bad actor among them. I did find it interesting that the third party software companies weren't commenting on the case. It would be absolute mayhem in the healthcare industry if it turns out that the software was easily compromised by bad actors. I understand that a lot of smaller companies "get what they pay for" however HIPAA isn't something to fuck around with. And I would definitely like to see some criminal charges for the crisis center's theft of data and patients here. Those snake oil salesmen are a plague on real healthcare.
this post was submitted on 08 Sep 2024
203 points (99.5% liked)
News
22876 readers
3942 users here now
Welcome to the News community!
Rules:
1. Be civil
Attack the argument, not the person. No racism/sexism/bigotry. Good faith argumentation only. This includes accusing another user of being a bot or paid actor. Trolling is uncivil and is grounds for removal and/or a community ban.
2. All posts should contain a source (url) that is as reliable and unbiased as possible and must only contain one link.
Obvious right or left wing sources will be removed at the mods discretion. We have an actively updated blocklist, which you can see here: https://lemmy.world/post/2246130 if you feel like any website is missing, contact the mods. Supporting links can be added in comments or posted seperately but not to the post body.
3. No bots, spam or self-promotion.
Only approved bots, which follow the guidelines for bots set by the instance, are allowed.
4. Post titles should be the same as the article used as source.
Posts which titles don’t match the source won’t be removed, but the autoMod will notify you, and if your title misrepresents the original article, the post will be deleted. If the site changed their headline, the bot might still contact you, just ignore it, we won’t delete your post.
5. Only recent news is allowed.
Posts must be news from the most recent 30 days.
6. All posts must be news articles.
No opinion pieces, Listicles, editorials or celebrity gossip is allowed. All posts will be judged on a case-by-case basis.
7. No duplicate posts.
If a source you used was already posted by someone else, the autoMod will leave a message. Please remove your post if the autoMod is correct. If the post that matches your post is very old, we refer you to rule 5.
8. Misinformation is prohibited.
Misinformation / propaganda is strictly prohibited. Any comment or post containing or linking to misinformation will be removed. If you feel that your post has been removed in error, credible sources must be provided.
9. No link shorteners.
The auto mod will contact you if a link shortener is detected, please delete your post if they are right.
10. Don't copy entire article in your post body
For copyright reasons, you are not allowed to copy an entire article into your post body. This is an instance wide rule, that is strictly enforced in this community.
founded 1 year ago
MODERATORS
I want to know how this was accomplished. I meand did they hack them. Article is a bit short on detail:
"“AWHC’s outreach to Four Women’s patients appears to be the result of their unlawful infiltration of Four Women’s electronic platforms,” said Matthew Patton, an attorney representing Four Women. “The patients they are intercepting are seeking a range of reproductive health care services, from birth control to abortions to ultrasounds.”"
In some states, these “Crisis Pregnancy Centers” receive government funding. (Texas)
It is unclear exactly how Four Women’s patient communications were allegedly compromised. A digital security analyst contracted by Four Women, Robert Knapp with Rapid7 in Texas, said in court filings that the “most likely points” through which the center allegedly accessed patient data are Klara and AthenaHealth, two third-party vendors that Four Women uses to communicate with patients and manage their data. Neither company responded to GBH News’ requests for comment.
[…]
“I would love to hear from the app developers ... I want to hear from tech people exactly what is happening,” Barnett said. “It’s actually quite rare that an app itself is so heavily compromised — like, technically speaking, that there’s some vulnerability that is being burned by some hackers.”
I doubt it's anything so sophisticated. Probably purchasing targeted advertising and setting up front websites. It's far easier to masquerade as another party than it is to steal their data.
This is why the DPH awareness campaign referenced in the article is so important. This is some predatory bullshit interfering with people's healthcare. Ain't always fun being in MA but this is leading by example.
I hope CMS works with the clinic to improve information handling, rather than fining it out of existence.
Are you saying the clinic that illegally intercepted communication that wasn't meant for them and wouldn't have provided ALL info and options should get a pat on the wrist, rather than receive punishment for deceitful actions?
I know where I stand and it should be fined out of existence for pushing its christo-fascist bullshit.
Well, one is a clinic and the other isn't a licensed health care facility at all, so I think OP was expressing worry that the abortion clinic would be fined out of existence for HIPAA violations related to not properly securing patient data.
The way I read it was that the patient was deceived by a website put up by the "not clinic". It's a recognised tactic that they use.
That's not at all what the article says. These women went to the actual Four Women's Health Services website, filled out a form, and were contacted by someone who didn't work at Four Women's to schedule an appointment elsewhere.
Edit: In the article, their lawyer says, "AWHC’s outreach to Four Women’s patients appears to be the result of their unlawful infiltration of Four Women’s electronic platforms." Later in the article, a spokesperson for the EFF says what's more likely is that an employee is intentionally leaking data. Either way, there's no indication that this is the result of pregnant women being duped by a website.
In IT systems that I've been a part of that manage HIPAA data, there are access controls and audit trails required for compliance. The fact that the victims are receiving calls within mere hours of posting the request should make a very short audit trail. What will turn up is either the perpetrator's user account, or possibly a non-related worker that had compromised account credentials (username/password). Even then it will show access from a specific IP address, and that IP address can be audited back to which piece of hardware (desktop, laptop, tablet) had that IP address at that time. From that point there are cameras and timeclock tracking.
Since this has happened more than once, it is unlikely the exact same staff has been working at the same time for all the recorded incidents of leaks. Its a process of elimination problem at that point. Example using fake names of workers:
Leak 1 workers:
- Brie
- Noah
- Fatima
- Dennis
Leak 2 workers:
- Noah
- Fatima
- Dennis
- Maria
Leak 3 workers:
- Brie
- Dennis
- Maria
- Sofia
Leak 4 workers:
- Dennis
- Maria
- Sofia
- Miguel
The leaker is Dennis as he is the only worker that was there on all 4 shifts when the request came in.
I'm talking about the actual health care clinic.