eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
The Veteran Affairs Department ordered doctors to immediately stop using a Yahoo Calendar Application to store confidential data. Notifications of a possible security breach have been sent to nearly 900 affected patients, according to VA’s monthly report to Congress on Dec. 22.
The report called the breach as a “mishandling of electronic information,” because doctors were storing patients’ medical information, such as full names, dates and types of surgery and the last four digits of Social Security numbers, for 878 patients.
Information security authorities at the Chicago Health Care System first discovered on Nov. 23 that four residents in the facility’s orthopedic department had been using Yahoo Calendar to maintain a calendar of patient medical data since July 2007. The data was protected by a single password that had never been changed in the past three years, the report said. Since a rotating series of residents over the past few years had access to that account it was unclear exactly how many people knew that password.
According to the report, the account was blocked a day later, all information deleted on Nov. 29 and affected veterans were notified on Dec. 2.
VA policy states that no patient information can be stored on systems outside its firewalls.
Roger Baker, VA’s assistant secretary for information and technology, said on a media call that the incident was an example of the need for better and more secure IT tools for VA employees, including cloud-based tools.
“I love the tools. I just wish I could better control what’s stored on them,” he said.
This is not the first example of VA hospital physicians and employees using unauthorized applications to store patient data, said Baker. An earlier incident involved eight hospitals using Google Docs to store patient information before being shut down, he said.
All VA doctors have access to a secure network to store patient information and a Microsoft Excel application to schedule appointment and surgeries, according to Baker.
In the Chicago incident, Baker said it was possible that the orthopedics residents developed the Yahoo account in order to access VA patient information while working at non-VA hospitals.
Baker said the incidents illustrate the inevitable demand for access to cloud computing. He noted that he needed to figure out how to provide remote access for medical staff on VA systems so that they don’t start using Yahoo or Google applications.
“VA is spending a lot of time trying to figure out how to go from saying no to saying yes for these kinds of apps,” Baker said.
There were other data security breaches in November listed in the report, such as nearly 150 incidents where patient information was “mishandled” and “mismailed.” This included incidents where information for one veteran was provided to another. The VA also reported that a number of computers, digital cameras and laptops were missing. It also disclosed an incident where data for 57 veterans were shared with an unauthorized agency. The VA also reported that 19 BlackBerry mobile phones were lost.
There is a glimmer of good news in the report. The department has been taking steps to improve security and privacy, such as encrypting data on laptops and desktops. Of the seven missing laptop incidents, six were already encrypted and the one that wasn’t encrypted did not contain any sensitive or private data because it was used primarily to access the online Computerized Patient Record application. No patient data was stored locally on the lost laptop, according to the report.