Data States, Regulated Data, and Policies

Burglars broke into an administrative office of Advocate Medical Group in Park Ridge, Illinois, overnight into July 15, 2013, and carried out four desktop computers. Each computer had a password, but the drives inside weren't encrypted. Between them they held the names, addresses, birth dates, and Social Security numbers of about 4 million patients, with some clinical and insurance details. Advocate began mailing the patients letters that August and offered each a year of credit monitoring.

The soccer league's registration site holds a medical note for many of its players: an allergy, an inhaler, a condition a coach should know about. The figure follows one note from the parent who typed it to the coach who reads it at the field.

The third panel is the one encryption can't cover. The coach has to read the note, so on the tablet it is plain text, and the protection there is deciding who can open it at all. Each state needs its own control, and a gap in one isn't closed by the other two.

Which state was Advocate's data in when the computers were carried out of the office?

The patients' records were at rest, stored on the computers' drives, and both protections that state calls for fell short. The office's physical guarding was too weak to stop burglars from walking out with four desktops, and nothing scrambled the records on them. The sign-in password guarded only the sign-in screen; a drive taken out and read in another computer never shows that screen.

The league sorts its data into three labels. Public is the schedule and the field map. Internal is the volunteers' contact list. Restricted is anything about a particular child: birth date, medical note, and parents' names and addresses. Since the data review, restricted data is encrypted wherever it is stored, and only the people who need a given record can open it.

The league's restricted label holds two of the kinds of data described next: the parents' names and addresses and a child's birth date identify a person, and the medical note is about the child's health.

Health information doesn't have to be on a computer to count. HIPAA's Privacy Rule covers it on paper and spoken aloud as well. A separate Security Rule sets the safeguards for electronic records, the kind on Advocate's stolen desktops.

Each law reaches particular organizations, so the label and the law aren't the same thing. HIPAA binds health care providers, health plans, health care clearinghouses, and the businesses that handle records for them; a medical note given to a soccer league is health information, but the league isn't one of those, and it protects the note under its own policy. The Privacy Act of 1974 binds U.S. federal agencies. COPPA covers collecting personal information online from children under 13. On the league's site the parents do the registering, which keeps most of it outside that law; a site where the players signed themselves up would be squarely inside it.

Advocate, a group of doctors' offices, is exactly who HIPAA was written for. Its parent organization, Advocate Health Care Network, agreed in 2016 to pay 5.55 million dollars to the U.S. Department of Health and Human Services, the largest HIPAA settlement with a single organization up to then. The settlement covered the stolen desktops and two smaller breaches from the same year. The department found that Advocate had not made an accurate and thorough analysis of the risks to all of its patients' electronic records.

Families pay the registration fee by card on the league's site. Which of these rules reaches that part of the site, and what does it ask about?

PCI-DSS reaches it, because the league accepts payment cards, and it sets rules for how the card number and expiration date are stored and sent, and forbids keeping the security code once a payment is approved. The league's site keeps those details off its own server altogether: the payment page belongs to a card processor, which returns only a receipt.

The league's written data policy, rewritten after that review, turns those choices into rules a new volunteer can follow. Its cryptography section names the encryption the league allows for each use, such as AES, a common encryption method, with a 256-bit key for stored files, sets the shortest key it accepts, and says keys are made by the cloud provider's key service and kept apart from the files they unlock.

Its web application section is about the registration site itself. The site is tested each winter before registration opens and whenever it starts collecting a new kind of data. A flaw rated high is fixed within a week, one rated moderate within a month. The testing follows a published checklist of web application weaknesses, so a volunteer with a security background can repeat it the next year.