For two months, the records sat anonymously in cyber space. According to the University of Michigan Health Care Systems, only a few unauthorized people saw records that included everything from names and addresses to Social Security numbers and diagnosis codes before the database was moved off the Internet. The incident points out how the medical industry has been slow to adopt Internet security rules, said Alex Fowler, a privacy expert with the Electronic Frontier Foundation in San Francisco. This information does require the utmost security and the savviness that isn't there yet in the medical community.
Many hospitals are wary of giving out information in low-tech ways, such as over the phone.
I'd be upset. I wouldn't want my daughter's hospital records out there. Harry Rhodes, a former health information manager at Columbia HCA, who now helps hospitals make information security decisions, agreed. Having the Social Security numbers included in the records just makes it worse, he said. While hackers can be a problem, the real issue is that many hospitals simply fail to put safeguards in place or get in too much of a hurry, Rhodes said.