Paul Chambers🚧<p>Since December 26, I have been working with the team for a major medical <a href="https://oldfriends.live/tags/EMR" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EMR</span></a> portal third part imaging portal about a <a href="https://oldfriends.live/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> and <a href="https://oldfriends.live/tags/HIPAA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>HIPAA</span></a> breach I discovered. This portal has tens of millions of medical patients from several thousand hospitals, almost half the inpatient and outpatient patient base in the US. They run in house and external medical operations. Not hyperbole.</p><p>On the patient side, essentially, portal A, the main EMR portal, allows others to share their medical chart with you, even letting you manage their medical records from your account.</p><p>Recently, they hooked up with a third-party imaging portal, Portal B.</p><p>If you want to see your imaging, x-rays, CTs, etc, you have to click to go out to Portal B, automatically logged in.</p><p>The first time you view medical imaging; it creates the third-party Portal B user account.</p><p>Well, a family member shared their medical chart account with me with full access on Portal A a long time ago. This past week they were hospitalized and had some imaging.</p><p>I logged into my EMR chart at Portal A, I changed to their view and then clicked to view their imaging which led the third part Portal B for the first time and it created the new, first-time account, without any intervention from me, by populating data from the main Portal A EMR site.</p><p>Because I had never done the Portal B setup by viewing my imaging first, Portal B created my new account with my Portal A credentials and because I was doing it from their view from within my account, mixed up my data and demographics and my family members when it was created. This actually gave them the imaging account with my credentials. </p><p>On the security side, it also shared with them every person that entrusted me with their medical information by sharing with me, and added them to their account, partially with my credentials. So, now they could see my trusted sharers imagining, without their consent or knowledge.</p><p>I am not confident they are really fixing it. So far, they deleted the erroneous account and then told me to log in to Portal A, go to my imaging and click view imaging and then recreate my account to clear that mess up.</p><p>I plan on filing notice with Portal A and HHS OCR (Office of Civil Rights) to make sure they aren't just doing a Band-Aid fix. They need to pull the 3rd-party access until it is resolved. I don't expect to get an autopsy of how they worked on a fix, what the issues are, etc, but both Portal A and HHS needs to make sure there isn't a big security and HIPAA breach out there waiting to be exploited. <a href="https://oldfriends.live/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Infosec</span></a>. I am keeping all emails and records. That's another thing, why am I involved at this point. </p><p>I believe they are working on it, and this discovery made a significant headache for them and probably ruined their New Years plans. I hope, at least, they are taking this as seriously as they should be. </p><p>Because this EMR runs in thousands of hospitals with tens of millions of patients, somebody big needs to look into this. As I said above, this is not hyperbole.</p>