There’s a report on silicon.com this morning about details of 6,500 Floridan HIV patients being emailed by mistake to 800 medical staff:
The list was accidentally attached to an email by a Palm Beach County Health Department statistician and sent to hundreds of health workers who weren’t normally granted access to it, according to a report by the Associated Press.The department’s tech staff shut down the email system within minutes of the email being sent, by which time an estimated 10 people had opened it. Additional reports put the number at 16 although it isn’t yet known how many actually opened the attachment, AP reports.
Mistakes of this type are something that we’ve all done at some point – that sinking feeling as you realise that you really shouldn’t have clicked the ’send’ button, although thankfully for most people their mistakes aren’t quite as catastrophic as this one.
This is a great example of another reason why email is broken. There’s no practical way to control the dissemination of confidential information by email, whether it’s by mistake as in this case or deliberate. The practical benefit of email – that it’s quick and easy to send information to anyone – is its downfall. Once you’ve sent the message, you’ve got no control over it, as the system administrators in this situation will be able to testify.
If, on the other hand, the Palm Beach County Health Department were using RSS to disseminate this information, the problem would never have occurred in the first place. It’s trivial to wrap a webfeed in the same level of security as you would a secure webpage. You can control access to a feed, and you can keep track of who’s accessing it, and when, and from where. The risks of accidental disclosure are minimised and you have an audit trail – in other words, when the auditors ask whether you’ve done everything you can to protect the information assets of your organisation, you can reply ‘yes’.
Fortunately in this case, the damage appears to have been relatively contained – save for the reputation of the Health Department and the distress of those on the list. But it’ll happen again, you can be sure of that.
