U.S. Army hospital says patient information was compromised

Updated 3:30 p.m. PT with idCure opinion.

Personal information of some 1,000 former patients of the Walter Reed Army Medical Center may have been leaked via a peer-to-peer network, hospital investigators say.

Hospital officials learned of the security breach last month and publicized it on the Walter Reed Web site early on Tuesday, however the message has since been removed, according to an article on the SearchSecurity.com site.

It's unclear what information was compromised, but the hospital specified certain types of data that were not included on the unsecured hospital computer.

"The information did not contain any protected health information such as medical records, diagnosis or prognosis for patients," Col. Patricia Horoho, commander of the Walter Reed Health Care System, reportedly wrote in the message.

"I need everyone to ensure that they are not loading or downloading programs that are not authorized by the command as it increases our vulnerability and possibly can cause a breach in protected information being shared," Horoho wrote.

All the technical controls in the world won't help if employees don't know what they can and can't do with regard to safe Internet activities at work, said Bryan Thornton, director of information security planning for idCure, a company that helps corporations and consumers prevent and counter identity theft.

"Walter Reed has a very robust information security program in place. They have done all kinds of things over the last decade specifically to address privacy concerns," Thornton says. "But what they've done here is show that everything they have done may as well be worthless simply because of the fact that they didn't make their employees a part of it."

[Schratboy]

The user is always going to be the biggest security threat. If this public system contained confidential information, why was the system even connected to the Internet?

[Kings X Rocks!]

Because users think that internet access is a god given right...

[UNiHacker]

I agree with Schratboy, if this stuff is so sensitive, disconnect it from the Inter-NET. We do this at my office in our labs. We never connect ubber critical systems to the internet.

[JR_Reagan]

There is an inherent assumption that a hospital will protect its customers' information. For customers, hearing "it's unclear what information was compromised" has the potential to break trust and reflect the conditions that customer data is constantly moved, copied, accessed and forwarded across organizations, opening the door for a host of security risks. For hospitals and other organizations, we've been counseling to protect customer data from the inside out, focusing on management first, with defense against attacks and threats coming second.

- J.R. Reagan, Vice President, Global Risk, Compliance & Security www.bearingpoint.com

[benjaminstraight]

What a shame. People served and then info is compromised.