Dental contractor set up secret account with access to 4,000 patient records then left the company

PWNED Welcome back to PWNED, the weekly column where we highlight examples of how not to handle your security. This week’s tale of woe comes from a very unhealthy part of the healthcare sector. Have a story about someone leaving a gaping hole in their network? Share it with us at [e-mail]. Anonymity is available upon …

[Anonymous Coward]

"digital marketing and SEO company"... "also does security audits".

If ever there was a combination of services that would not inspire confidence in the quality of a security audit...

[Anonymous Coward]

This is good advice, but what is better advice is that you are already legally obliged to be doing this if you work with healthcare data.

[Excused Boots]

Yes but is the ‘security audit’ just ticking a load of boxes on a form and submitting it? Presumably you can just hope (probably likely) that you don’t get hit and caught out.

Quis custodiet ipsos custodes?

[Philo T Farnsworth]

All jokes. . .

. . . referencing "extraction" to be taken as read.

BTW, my own dentist has a parking lot with signs saying either "Parking for patients only, violators will be extracted" or "violators will be given an appointment."

Probably better than a sign in a church parking lot I saw a few years ago which said "Violators will be baptized."

Or maybe not, depending upon your religious sentiments and/or dental hygiene.

[Doctor Syntax]

Re: All jokes. . .

"violators will be given an appointment."

For those places with a shortage of dentists this might be the only way to get an appointment.

[Andy Non]

Re: All jokes. . .

Getting an appointment is like erm... pulling teeth.

[M.V. Lipvig]

Re: All jokes. . .

Must be a socialized medicine problem. In my for-profit nation, if I need a dental appointment I just call my dentist and have an appointment within a couple of weeks. If it's an emergency, I can be seen within 24hrs.

[Doctor Syntax]

Re: All jokes. . .

Can everyone in your country afford to do that?

[MachDiamond]

Re: All jokes. . .

"violators will be given an appointment."

Novocaine charged at 10x the normal rate.

[Missing Semicolon]

Re: All jokes. . .

In the UK, if parking illegally at a dentist resulted in an appointment, there'd be queues round the block.

[Valeyard]

I'd have thought step 1 is identifying and letting the client know.

but then the work begins; Step 2 is sigh and brew a coffee because now you have to do a full audit trail on that account and figure out if it's been used since the person left and if it has which actions were taken or records were accessed, and hope that's zero otherwise people have to be notified

[Excused Boots]

Hah, you think there are audit trails?

Oh, sweet summer child!

[Doctor Syntax]

Those accounts gave Chris something to get his teeth into. At least his bark wasn't worse than his bite.

[Anonymous Coward]

Old admin accounts

Anyone have the experience of shutting off/deleting old admin accounts and suddenly several important process stop working for apparently no visible reason?

Much fun.

[KittenHuffer]

Re: Old admin accounts

Been there! Broke that!

[Excused Boots]

Re: Old admin accounts

Ditto.

So don't delete, disable and then wait a couple of weeks (no, maybe months) and see what breaks and/or who screams.

[MachDiamond]

So what if there's regs

It matters not that there are laws surrounding the security of health data. People stealing and selling this data aren't known for their civic contributions.

[DS999]

Why should vendors need admin accounts at all?

For a SCHEDULING vendor?

If you are outsourcing your IT management to a third party then fine, obviously they need admin access. But for anything else you should fight hard and make them really justify why they need admin level access. If their only response is "that's what our software requires" then find a different vendor!

[Basmman63]

Poor admistration

This is an example of piss-poor administration. It should be part of the off-boarding process, when anyone leaves a company, ALL their access should be removed.