A configuration error at the authentication level of a server allowed hackers from Eastern Europe to access 25,000 social security numbers and the personal records of over 181,000 individuals collected by the Utah Department of Health (Utah DOH). The server was managed by the Utah Department of Technology Services (DTS). In the process of moving Medicaid claims records to a new server, hackers were able to access ePHI despite the DTS’s security system, resulting in the latest HIPAA violation.
Hackers removed 24,000 files from the server – according to the Utah DOH, one file can potentially contain claims information on hundreds of individuals. The Utah DOH reports that the DTS servers have multi-layered security systems containing perimeter security, network security, identity management, application security and data security, but the question remains, would they pass a HIPAA audit of their controls?
The Utah DOH claims that the DTS has process in place to secure their data, but the “particular server was not configured according to normal procedure.” This may have simply been an oversight by DTS staff, but it also raises the question of whether or not their employees are trained in HIPAA security policies and procedures.
An IT or data center organization that handles ePHI on their servers need to have multiple layers of security, including staff trained to implement technology in accordance with HIPAA standards. The DTS should have an appointed security and risk management officer employed to oversee training, with documented dates of completion.
The Utah DOH blog states the DTS has implemented new processes to prevent a future breach, including improving security controls related to implementing computer hardware and software, and increasing network monitoring and intrusion detection capabilities.