[IP] Stupidity and data security in Colorado
Begin forwarded message:
From: Liz Ditz <ponytrax@xxxxxxxxxx>
Date: May 26, 2005 3:47:20 PM EDT
To: David Farber <dave@xxxxxxxxxx>
Subject: Stupidity and data security in Colorado
For IP if you wish. From the Rocky Mountain News
==========================
Health agency demotes staffer after breach
Computer holding private data stolen
By Bill Scanlon, Rocky Mountain News
May 26, 2005
A [Colorado] state health department worker who took medical records
home and left them overnight in a car - which was then stolen - has
been demoted.
Colorado's chief medical officer, Dr. Ned Calonge, said the employee
violated department rules by taking the laptop computer home for the
weekend.
It contained the records of 1,600 children involved in a federal
study of autism, a study that parents of those children were made
aware of only after the theft became public. Some parents were
outraged over the security breach and the fact that they hadn't been
informed that their children were part of a research program. "We
understand the parents' concerns and are taking this seriously,"
Calonge said.
The car was recovered but the laptop was gone. Calonge doubts the
thieves were interested in specific data in the laptop or that the
encrypted records have been decoded. The main problem, he said, was
the security breach.
The [Colorado] State Board of Health has decided that autism should
be a "reportable disease," putting it in the same category as
infectious diseases such as whooping cough, tuberculosis and the flu,
Calonge said.
The federal Centers for Disease Control and Prevention wants to find
out what causes autism and whether it is truly on the rise, or
whether it's just being reported more often. Eighteen states are
participating in the study, which asks such questions as age of onset
and whether the condition has been confirmed.
Autism usually appears in early childhood and is characterized by
poor social interaction, and communication and behavioral problems.
"It fits into the category of diseases where we want to do
surveillance activities to understand more about the condition,"
Calonge said.
It's important to attach a name to the health records to assure there
are no duplicates, he said.
Although the [Colorado] autism records included the children's
names, the panel that reviewed each case to determine if the
condition was in fact autism didn't see the children's names, Calonge
noted. Only employees of the Colorado Department of Public Health and
Environment had access to the children's names, and they are under
orders not to let the information leave state buildings.
The only exception is when a member of the surveillance team is going
to an off-site clinic the next morning. Then, he or she has
permission to take a laptop home - but only on a weeknight, not for
the weekend, as the employee in this case did.
Also, the employee shouldn't have left the laptop in a car
unattended, he said.
Calonge said relatively few parents have complained about the breach.
That, and the facts that the information likely wasn't decoded and
that there's a backup record of the information, makes him hopeful
that Colorado can continue its participation.
Nonetheless, the incident spurred CDPHE to upgrade its encryption
software and to re-examine its confidentiality procedures, Calonge said.
"We can't do our work if we can't assure confidentiality," he said.
The department "may very well change our policy" and start informing
parents when their children are part of a program involving a
noninfectious disease, he said. [Colorado] Health officials say
surveillance of infectious diseases is vital and can't wait for
parental consent. If a child gets whooping cough, for example, it's
important the child's school is notified and that steps are taken to
prevent an outbreak, they said.
Still, balancing privacy rights and public health is always the
department's goal, Calonge said.
"We're looking at how we can continue to work at improving the health
of the population, while being sensitive to parent concerns about
confidentiality," he said.
scanlon@xxxxxxxxxxxxxxxxxxxxx or 303-892-2897
-------------------------------------
You are subscribed as roessler@xxxxxxxxxxxxxxxxxx
To manage your subscription, go to
http://v2.listbox.com/member/?listname=ip
Archives at: http://www.interesting-people.org/archives/interesting-people/