UM expert says remedies must focus on empowering consumers, punishing breaches

By Eric Chapman
2:41 PM EDT, September 19, 2011

Two recent stories have highlighted how confidential health and patient data are at risk. First, a report from the Department of Health and Human Services' Office of Civil Rights noted that nearly 8 million Americans were affected by almost 31,000 health information breaches in the course of a year. Alarmingly, nearly 70 percent of the investigations into data breach incidents that affected 500 people or more remain open.

Second, a medical data breach of 20,000 emergency room patients at Stanford Hospital was discovered by a patient after the information had languished online for nearly a year. The information included names, diagnosis codes, admission and discharge dates, and billing charges.

While the report from the Department of Health and Human Services confirms that medical information breaches are occurring with disturbing frequency, the fact that the Stanford Hospital patient data remained available online for a year is especially shocking.

Two problems must be addressed to right this wrong that is affecting so many Americans. First, hospitals and those who contract with them must take better steps to protect confidential patient information and files. As our nation begins the push toward electronic medical health records, consumers must have the confidence that their personal information is adequately protected from inadvertent disclosure.

Next, and more importantly, consumers must be notified in a timely and efficient manner that their personal information was disclosed to an unintended party. Currently, there is a patchwork of 47 distinct state laws that require businesses to notify consumers if cyber-intruders have accessed consumers' personal information.

In May, the Obama administration submitted a comprehensive cybersecurity legislative proposal to Congress. Among other provisions, this package included a requirement that would standardize, simplify and harmonize the data breach notification requirements in existing state laws. Notifications would be made "without unreasonable delay," meaning in 60 days or less, provided there is not a compelling law enforcement reason to extend the delay for investigative purposes.

Prospects for the successful enactment of comprehensive cybersecurity legislation are far from certain; portions of the comprehensive package are considered controversial. Realizing this, the Senate Judiciary Committee is poised to address three differing data breach notification bills.

Although data breach notification extends beyond the disclosure of medical information, three important priorities should guide lawmakers in their debate to standardize notifications to consumers whose personally identifiable information and data have been inappropriately accessed:

1. Empower consumers with information. Patients assume that the information they entrust to a medical provider will be treated with utmost care and confidentiality. When that trust is broken, they must be notified within 30 days - and preferably sooner - unless there is a pressing national security interest for not doing so. California state law requires notification within five days of discovery, while others allow much greater time to notify consumers.
2. Empower consumers to take action. Users must be presented with potential remedies when their private information has been put at risk. This includes providing them free access to identity theft and protection services.
3. Impose penalties on those responsible. California and Massachusetts have taken the extraordinary step of fining hospitals in the past for delayed notification of breaches. This trend must continue, and the fines imposed must continue to escalate for hospitals to take data protection seriously. Moreover, the hospital itself needs to specify and verify that contractors with whom they work, such as billing services, adhere to guidelines to better protect patient information.

It is imperative that our elected officials take immediate steps to better protect the vast amounts of personally identifiable information that are electronically stored. A good starting point would be to enact - without further delay - a national data breach notification law.

Eric Chapman is associate director of the Maryland Cybersecurity Center on the campus of the University of Maryland, College Park. He was previously a professional staff member on the Senate Select Committee on Intelligence. His email is echapman@umiacs.umd.edu.

See full story in Baltimore Sun

Darryll Pines, dean of the A. James Clark School of Engineering; Mark Bisnow, CEO of Bisnow Media; Wallach Loh, UM president, will provide introductory remarks; panelists will include Bill Bertrand of MedImmune; Phillip Bond, CEO of TechAmerica, and other leaders in the regional technology community including technologists, venture capitalists and business development professionals.

The event will be held in the morning of September 13 the University of Maryland Riggs Alumni Center. For more information on the event and registration please go to State of Tech in MD. Registration is required.

]]> http://www.eit.umd.edu/news/news_story.php?id=4908 Thu, 25 Aug 2011 01:21:48 EDT http://www.eit.umd.edu/news/news_story.php?id=4908 The Fall 2011 Google and University of Maryland Cybersecurity Seminar Series will kick off on Thursday, September 1, at 5:30 p.m. in the J.M. Patterson Building, Rm. 3201, and will feature Prof. Stefan Savage of the University of California, San Diego The title of his talk will be "Looking Before You Leap: The Argument for Data-Driven Security."

Registration is required. Guests can register online at: http://goo.gl/G5tll

To date, most research efforts have focused on the technical components of the cybersecurity battle: identifying new vulnerabilities, exploits, and attacks, building and deploying new defenses, and so on. In this talk, Prof. Savage will argue for a complementary research agenda based on understanding the economic forces that drive today's Internet attacks, deconstructing the underlying value chain for attackers, and ultimately using this information to better focus on security interventions. Prof. Savage will also provide a rough sketch of the modern cyber-criminal ecosystem, describe its dependencies, and highlight some of the key questions about the future of cybersecurity.

Stefan Savage is a professor of Computer Science and Engineering at the University of California, San Diego. He received his Ph.D. in Computer Science and Engineering from the University of Washington and a B.S. in Applied History from Carnegie Mellon University. Savage's research interests lie at the intersection of distributed systems, networking, and computer security, with a current focus on embedded security and the economics of cybercrime. He currently serves as director of UCSD's Center for Network Systems (CNS) and as co-director for the Cooperative Center for Internet Epidemiology and Defenses (CCIED), a joint effort between UCSD and the International Computer Science Institute.

The Google and University of Maryland Cybersecurity Seminar Series is organized by the Maryland Cybersecurity Center, a multidisciplinary initiative at the University of Maryland aimed at research, education, and technology development in cybersecurity. The Maryland Cybersecurity Center brings together faculty experts from engineering and computer science with colleagues from across campus in fields such as information sciences, business, public policy, social sciences and economics, mirroring the comprehensive perspective of the new seminar series that places special emphasis on “the human factor” of cybersecurity. For more information, please visit www.cyber.umd.edu/seminars.

NASA News Release:

NASA Awards Space Technology Research Fellowship Grants

On July 13, the students on the Gamera human-powered helicopter team from the University of Maryland's A. James Clark School of Engineering completed their scheduled summer flight session with a new unofficial flight duration of 12.4 seconds. If verified by the National Aeronautic Association, this new time will shatter the team's previous 4.2-second U.S. national record set in May.

Between the May flights and yesterday's, the students enhanced Gamera's cockpit and transmission and added LEDs to its landing gear that turn on when the vehicle is off the ground. Judy Wexler, the biology student who piloted the record-setting flight in May, was also on board in the most recent session.

"Our students demonstrate the combination of technical expertise and determination to succeed that will bring continued technological progress to our nation and our world," stated Clark School Dean Darryll Pines. "During these flight tests they faced formidable obstacles when Gamera suffered its first significant structural problems, but they worked through the night to repair these and the next day achieved our best flights. Their spirit fills me with pride."

The team plans further flights in the fall to move closer to winning the Sikorsky Prize, established by the American Helicopter Society in 1980. The prize requires a flight of one minute, during which the vehicle attains an altitude of three meters at some point and remains within a 10 square meter area. No team has yet come close to winning the prize, now valued at $250,000.

Low-res video available: http://www.youtube.com/watch?v=qzuXMbtSIpk

NOTE: higher-res video will be available later today.

 

Several Clark School buildings are included in the effort.

Installation of occupancy sensors has already begun in some empty classrooms. Classrooms having special AV systems will not be affected. The goal is to install occupancy sensors in all general purpose classrooms.

For classrooms that are centrally scheduled, these occupancy sensors will be installed when classrooms are scheduled to be vacant. Project managers will work with department chairs to install the sensors in classrooms scheduled by individual departments. Facilities Management has researched many types of sensors during the past two years, and has selected models that have proven to be efficient and reliable through campus pilot projects.

The changes envisioned by this program have been piloted in several selected general purpose classrooms across campus over three years. Responses from students and faculty have been supportive. It is estimated that the first work to be completed this summer will result in an estimated annual cost savings of $100,000 and yield a five-year payback period. Eight hundred thirteen (813) tons of carbon emissions will also be avoided. UM will seek additional funds and utility rebates to install new energy efficient lighting fixtures in additional general purpose classrooms during the next two summers.

Maryland’s new student e-mail system will be called TERPmail. While students will have the use of other Google Apps when logged into TERPmail, the University of Maryland Office of Information Technology only supports the students’ use of the e-mail and calendar features of TERPmail.

Read the full story.