Knowledge is power. . . who has your personal information?

The Department of Health and Human Services (HHS) recently fined Idaho State University (ISU) half a million dollars for HIPAA violations.

Data on 17,500 patients of ISU’s medical clinic was exposed during, at minimum, a 10 month period, during which the university had disabled a firewall. More on that here:

We’ve been noticing this spate of attacks on education institutions and healthcare organizations, and a recent USA Today article points out that universities are tightening security in the wake of so many attacks.

Negligence like this is surprising but, sadly, common. Lax security measures are often cited as the cause of data breaches. Things like incorrect access settings, misconfigurations, unencrypted sensitive data on stolen laptops, lost tapes, data emailed to a personal account and more. . . all these issues are unacceptable and avoidable, yet they continue to happen. Is no one paying attention?

Another thing that may come as a surprise is that very often there’s little (or no) security in place. Yet it should come as no surprise that as systems are increasingly connected to the internet, they become much more vulnerable to exploits.

Educational and healthcare institutions need to seriously step up their game.

In the meantime, students and patients should do a better job of taking their own personal privacy into their own hands, and asking about security measures their providers are taking. For example, when asked to fill out forms, don’t simply include personal information like your social security number, driver’s license, mother’s maiden name and other obvious private information that can fall into the wrong hands. If they ask for it, you’re entitled to ask why they need it, why it’s on paper rather than entered into a system and immediately encrypted so that even the workers cannot access it. Demand to know how they plan to protect your privacy. You have a right to know. More than that, no one should care as much about you and your personal privacy. And you’re the only one that’s going to have to face the music if your data or identity is breached. Law enforcement and the government simply don’t have the resources to investigate every issue, and it’s often difficult to tell how and from where breaches originate.

Teachers and medical practitioners tell us “Knowledge is power.” Meanwhile the very institutions they work for are practically handing over knowledge about us over to attackers. Shouldn’t they have a duty to protect and secure?

Bottom line: Don’t give your personal power and identity away.