Dozens of states have apparently filed a federal lawsuit against Medical Informatics Engineering, Inc (MIE) and its subsidiary NoMoreClipboard LLC. This will be the first time state AG\u2019s have jointly sought a HIPAA based case in federal court.<\/p>\n
MIE\u2019s WebChart EHR application had been hacked in 2015. The case claims MIE had a generic \u201ctester\u201d account which utilized a shared password of \u201ctester\u201d and also another called \u201ctesting\u201d with \u201ctesting\u201d as the password. Digital Defense had flagged these as high risk in an earlier audit (Jan 2015.) While the \u201ctester\u201d account did not have elevated privileges, it did allow a SQL injection attack which returned error messages from queries allowing details into the database structure. The hacker in 2015 apparently was able to access the \u201ccheckout\u201d account which did indeed have elevated privileges and exfiltration of approximately 1.1M patient records.<\/p>\n
The case seeks HIPAA corrective actions as well as financial judgments, civil penalties, and injunctive relief. The company not only violated provisions of the Health Insurance Portability and Accountability Act (HIPAA) but also violated many state laws such as the Arkansas state deceptive trade practices law, notice of data breach statues, and personal information protection acts.<\/p>\n<\/div>\n
]]><\/p>\n","protected":false},"excerpt":{"rendered":"
\t\t\t\t\t\t<\/p>\n","protected":false},"author":1,"featured_media":7670,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"amazonpipp_noncename":"","amazon-product-isactive":"","amazon-product-single-asin":"","amazon-product-content-location":"","amazon-product-content-hook-override":"","amazon-product-excerpt-hook-override":"","amazon-product-singular-only":"","amazon-product-amazon-desc":"","amazon-product-show-gallery":"","amazon-product-show-features":"","amazon-product-newwindow":"","amazon-product-show-list-price":"","amazon-product-show-used-price":"","amazon-product-show-saved-amt":"","amazon-product-timestamp":"","amazon-product-new-title":"","amazon-product-use-cartURL":"","amazon_featured_post_meta_key":"","_amazon_featured_alt":"","amazon-product-template":"","footnotes":""},"categories":[66,65],"tags":[],"class_list":["post-7548","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaches","category-vulnerabilities"],"_links":{"self":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/7548","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7548"}],"version-history":[{"count":1,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/7548\/revisions"}],"predecessor-version":[{"id":7669,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/7548\/revisions\/7669"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/media\/7670"}],"wp:attachment":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}