This is not good and should have been avoidable:
Commissioner urges vigilance in wake of computer virus outbreak at Alberta Health ServicesJuly 8, 2009
The Office of the Information and Privacy Commissioner has been notified by Alberta Health Services that a virus was present on the Alberta Health Services network in Edmonton. The virus impacted the network and Netcare, Alberta’s electronic health record, before it was discovered and removed.
The virus is a new variant of a Trojan horse program called coreflood and is designed to steal data from an infected computer and send it to a server controlled by a hacker. Coreflood captures passwords and data the user of the computer accesses. The virus was active from May 15 to 29 before it was detected and removed.
AHS identified two groups who are potentially at risk. Patients whose health information was accessed in Netcare through an infected computer and employees who accessed personal banking and email accounts from work using an infected computer. AHS is sending letters to the 11,582 patients whose information may have been exposed and has notified all affected employees.
Commissioner Frank Work says this does not necessarily mean Netcare itself has been infected by the virus; rather the virus may have captured patient data accessed through Netcare from an infected computer and sent it to an external party. “While it appears the risk to patients is low, viruses don’t discriminate and this is an important message to everyone about the need to run up to date anti virus software”, says the Commissioner.
The Commissioner’s office is investigating. In the meantime Work is expecting a full forensic report from Alberta Health Services on how this happened and what steps will be taken to prevent future breaches. Work says “AHS responded quickly when the virus was detected and that steps have been taken to notify users and patients with advice on what they should do to protect personal and health information”.
2 comments:
One of the quotes I read earlier today indicated that the virus software did not detect the virus because the variant was too new (not because the virus definitions were out of date). As a result, it is difficult to place the blame on AHS isn't it? We are all running up-to-date anti-virus software -- but how many of us have undetected malware running right now?
I agree with Mike's comments. It is all too easy to take the mental shortcut and say that we're secure/insecure because we have anti-virus or not...
In reality, anti-virus is just one tool for protecting information systems. At best, anti-virus provides some protection from malicious code, but is by no means is a panacea or an indicator of being in a 'secure' state.
Securing the general purpose computers used by our health professionals everyday is an administrative nightmare and constant balance between usability and security (which often restricts functionality).
The truth is that these types of infections are common place across all industries; including health care. They make good news stories because they're sensational.
The results of the forensic investigation will be telling as to where reasonable precautions were taken to protect the AHS systems...
Post a Comment