Odd Radio Intercept Issue Reminds Everyone To Monitor Health Ins Activity

Let’s say you’re in Kansas…or Missouri. There is weather there that can hinder some activities and keep you inside. You may get a little bit creative. In the case of a radio hobbyist in Missouri, his hobby allowed him to do a little bit of reading…of unencrypted protected healthcare information (PHI) being sent through an unsecured messaging system used by physicians at several hospitals. Some from all the way into Michigan.

Many healthcare organizations are indeed switching to secure systems and their pagers have gone the way of the cassette tape. However, some have yet to make that switch and that allows others, including hackers, to have access to the information that is being communicated between and among outdated devices. In this case, the IT worker that accidently intercepted the information, was trying to get TV channels using an antenna and his laptop. What he got was PHI. It included patients’ names, conditions, initial diagnoses, doctors’ names, and more.  He did this using software defined radio (SDR).

SDR is old hat. It is known to be used to intercept communications, even private ones. All it takes is hardware, a computer, free software, and some time on your hands. And hackers do tend to have some time on their hands.

Intercepting communications is illegal under the Electronic Communications Protection Act. Hacking into networks is also illegal. Yet, these laws don’t stop the criminals.  Sending unencrypted PHI is also a violation of HIPAA. If your organization does not have a secured solution in place, it’s time to take it seriously. The risk of someone stealing information and using it for fraud or selling it on the dark web is high. Healthcare record costs range from a few bucks to over $300 each.

Some patients in this case were notified and understandably disturbed to know that their private information was captured by an unauthorized someone, even if this person never had any intention to use it maliciously, for targeted phishing for example.

What penalties, if any for the hospitals violating HIPAA policies is unknown at writing. But there is no reason to wait for a fine before correcting this problem. Pro-action with respect to protecting patient privacy is worth the time and effort to keep accidental and intentional prying ears from listening in.