Stupidity and data security in Colorado

[David Farber <dave () farber net>]

Begin forwarded message:

From: Liz Ditz <ponytrax () batnet com>
Date: May 26, 2005 3:47:20 PM EDT
To: David Farber <dave () farber net>
Subject: Stupidity and data security in Colorado


For IP if you wish.   From the Rocky Mountain News
==========================

Health agency demotes staffer after breach
Computer holding private data stolen

By Bill Scanlon, Rocky Mountain News
May 26, 2005

A [Colorado] state health department worker who took medical records  
home and left them overnight in a car - which was then stolen - has  
been demoted.

Colorado's chief medical officer, Dr. Ned Calonge, said the employee  
violated department rules by taking the laptop computer home for the  
weekend.

It contained the records of 1,600 children involved in a federal  
study of autism, a study that parents of those children were made  
aware of only after the theft became public.  Some parents were  
outraged over the security breach and the fact that they hadn't been  
informed that their children were part of a research program.  "We  
understand the parents' concerns and are taking this seriously,"  
Calonge said.

The car was recovered but the laptop was gone. Calonge doubts the  
thieves were interested in specific data in the laptop or that the  
encrypted records have been decoded. The main problem, he said, was  
the security breach.

The  [Colorado] State Board of Health has decided that autism should  
be a "reportable disease," putting it in the same category as  
infectious diseases such as whooping cough, tuberculosis and the flu,  
Calonge said.

The federal Centers for Disease Control and Prevention wants to find  
out what causes autism and whether it is truly on the rise, or  
whether it's just being reported more often. Eighteen states are  
participating in the study, which asks such questions as age of onset  
and whether the condition has been confirmed.

Autism usually appears in early childhood and is characterized by  
poor social interaction, and communication and behavioral problems.

"It fits into the category of diseases where we want to do  
surveillance activities to understand more about the condition,"  
Calonge said.

It's important to attach a name to the health records to assure there  
are no duplicates, he said.

Although the [Colorado]  autism records included the children's  
names, the panel that reviewed each case to determine if the  
condition was in fact autism didn't see the children's names, Calonge  
noted. Only employees of the Colorado Department of Public Health and  
Environment had access to the children's names, and they are under  
orders not to let the information leave state buildings.

The only exception is when a member of the surveillance team is going  
to an off-site clinic the next morning. Then, he or she has  
permission to take a laptop home - but only on a weeknight, not for  
the weekend, as the employee in this case did.

Also, the employee shouldn't have left the laptop in a car  
unattended, he said.

Calonge said relatively few parents have complained about the breach.  
That, and the facts that the information likely wasn't decoded and  
that there's a backup record of the information, makes him hopeful  
that Colorado can continue its participation.

Nonetheless, the incident spurred CDPHE to upgrade its encryption  
software and to re-examine its confidentiality procedures, Calonge said.

"We can't do our work if we can't assure confidentiality," he said.

The department "may very well change our policy" and start informing  
parents when their children are part of a program involving a  
noninfectious disease, he said.  [Colorado] Health officials say  
surveillance of infectious diseases is vital and can't wait for  
parental consent. If a child gets whooping cough, for example, it's  
important the child's school is notified and that steps are taken to  
prevent an outbreak, they said.

Still, balancing privacy rights and public health is always the  
department's goal, Calonge said.

"We're looking at how we can continue to work at improving the health  
of the population, while being sensitive to parent concerns about  
confidentiality," he said.

scanlon () RockyMountainNews com or 303-892-2897



-------------------------------------
You are subscribed as lists-ip () insecure org
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/