Credit-Card Security Falters

Industry Standard
Hasn't Prevented
Recent Breaches

By JOSEPH PEREIRA
April 29, 2008; WSJ

Despite efforts by the credit-card industry to force retailers to protect their customers' data, several recent security breaches suggest that current requirements aren't enough.

Hannaford Bros., a unit of Belgium's Delhaize Group SA, says it received a certificate on Feb. 27 stating it was fully compliant with the credit-card industry's security protocols. But that same day, the New England supermarket chain was informed by its card-transaction processor that there appeared to be a problem with its customers' credit-card accounts. The chain soon learned that data for 4.2 million cards may have been stolen.

Until now, most known retail-data breaches occurred at companies that failed to comply with steps mandated by a credit-card industry group called the Payment Card Industry Security Standards Council, or PCI, in Wakefield, Mass. The Hannaford attack -- and another disclosed last month at Okemo Mountain Resort, a ski operator in Vermont -- has prompted retailers to seek security systems well beyond PCI standards.

Hannaford last week announced the adoption of two such measures. The company installed a round-the-clock security monitoring-and-detection service provided by International Business Machines Corp. to track all user log-ins. The chain has also begun to encrypt all its customer card information immediately from the time the card is swiped at the cash register, so that data is scrambled all the way to the company's corporate servers, from where it is sent to the credit-card company. "PCI is a good place to start but retailers are going to have to go above and beyond PCI," said Bill Homa, Hannaford's chief information officer.

Says Bonnie MacPherson, a spokeswoman for the ski resort, which lost card data for nearly 50,000 customers, "We did everything we were supposed to." The company says it doesn't know whether the breach resulted in any theft.

Joshua Jewett, information chief at Family Dollar Stores Inc. in Charlotte, N.C., plans to beef up the cash register systems at about 2,500 of the company's stores by August with more data encryption than mandated by PCI. Both Hannaford and Family Dollar are purchasing security systems from Verifone Holdings Inc. of San Jose, Calif.

Until two years ago, retailers faced a cacophony of security requirements, with each of the major credit-card brands -- including Visa Inc., MasterCard Inc. and American Express Co. -- issuing their own set of standards. Then the credit-card industry established PCI, and consolidated the best data security practices into a single, unified code.

The compilation, called PCI Data Security Standards, requires such things as encrypting or masking customer data, regularly updating antivirus software, restricting access to card data to only certain authorized personnel and protecting stored information with firewalls, among other things.

Retailers that fail to meet the requirements are subject to fines.

In January, Visa announced that 77% of its largest U.S. merchants became PCI compliant in 2007, up from 12% in 2006. Compliance among midsize merchants grew to 62% last year from 15% the year before.

Credit card-related fraud grew to $5.49 billion in 2007 from $1.46 billion in 1997, according to industry tracker Nilson Report. Law-enforcement officials attribute the rise to new technological applications as well as increased participation by international organized-crime groups.

Bob Russo, PCI's general manager, says PCI believes its standards -- derived with input from more than 500 data-security specialists -- are adequate, but he adds that PCI is still awaiting the results of investigations into the Hannaford and Okemo breaches. "If there is something that's lacking in the standards, then we'll address it immediately," he says.

In both the Hannaford and Okemo heists, hackers attacked an area that previously had been thought impenetrable -- a company's private internal computer network. Many previous breaches involved wireless network systems.

PCI mandates that all transaction data sent over networks that are publicly accessible -- such as in coffee shops -- be encrypted, but it doesn't require that for transmissions over internal private lines.

At Hannaford and Okemo, hackers managed to install malicious software into the companies' private networks to steal credit-card information being transmitted to processors for approval.

"This kind of attack would not have been possible if the credit-card data had been encrypted," says Avivah Litan, a security analyst for Gartner Inc. in Stamford, Conn.

Michael Cherry, an online-security consultant, says companies can encrypt credit-card data at cash registers, which PCI doesn't require, at minimal cost. "You can be worry free for less than $100 per cash register," says Mr. Cherry.

Two companies that provide such technology -- called personal identification number pad encryption -- are courting new customers, playing up Hannaford and Okemo's vulnerabilities.

Verifone Holdings is promoting its VeriShield system, which was purchased by Family Dollar. A similar product, called MagneSafe, is offered by MagTek Inc., of Carson, Calif.

Rob Caulfield, chief executive of TrustCommerce, an Irvine, Calif., credit-data processor that works with MagTek's clients, says he knows of about two dozen retailers currently using MagTek encryption and about 300 others that "are queuing up to become clients."

Meanwhile, PCI has been upgrading its requirements for retailers as more information about vulnerabilities is gleaned from data breaches. In February, PCI required merchants to ensure that PIN pads are tamper proof and their credit-card data are rendered useless if they are opened. The requirement follows a theft last year where thieves stole PIN pads from Dutch retailer Royal Ahold NV's Stop & Shop stores in the Northeast U.S. and accessed customers' debit-card passwords.

As of June 30, retailers must install firewalls that prevent hackers from accessing internal company files through software programs that are exposed to the Internet, such as applications that handle online credit-card transactions. PCI also plans to toughen its standards in September in the areas of wireless transmissions, card-preauthorization procedures and software applications that handle credit-card data. "From all the data breaches we've seen, we're quickly learning that the point-of-sale is our weakest spot in the payment chain," says Mr. Russo.

Are Your Medical Records at Risk?

Amid Spate of Security Lapses,
Health-Care Industry Weighs
Privacy Against Quality Care

By SARAH RUBENSTEIN
April 29, 2008; WSJ

When it comes to protecting the privacy of patients' computerized information, the main threat the health-care industry faces isn't from hackers, but from itself.

In a spate of recent security lapses at hospitals, health insurers and the federal government, private information on hundreds of thousands of patients, ranging from Social Security numbers to fertility-treatment and cancer records, has been compromised. The incidents have included the theft of an unencrypted laptop from an employee of the National Institutes of Health and the inadvertent posting of personal data unsecured on the Web from insurers WellCare Health Plans Inc. and WellPoint Inc. At the UCLA Hospital System, several employees were fired or disciplined recently for sneaking peeks at Britney Spears' computerized medical files.

In another recent incident, a former patient-admissions employee at NewYork-Presbyterian Hospital/Weill Cornell Medical Center was arrested this month for allegedly selling at least 2,000 patient identification records, according to the U.S. Attorney for the Southern District of New York. The employee improperly accessed nearly 50,000 patient records in a computer system storing names, Social Security numbers and addresses, court documents allege. Hospital spokeswoman Myrna Manners says some patients have told the hospital they suspect their information had been "used," though it wasn't clear for what purpose or whether identity theft had occurred.

Health care isn't the only industry whose slip-ups can upset consumers or expose them to identity theft. But hospitals are notable for the sheer number and types of employees -- including billing staff, nurses, doctors, researchers and lab technicians -- who have quick access to individuals' private information. A number of hospitals have been installing controls that limit by job function the types of data that employees can see. But institutions also are reluctant to control access to patients' private data too tightly, for fear that doing so could get in the way of patient care, especially in emergencies.

"There are just thousands of people who have access -- and need to have access -- to confidential information, and to try to change their behavior is a challenge," says Donald Bradfield, a senior counsel for Johns Hopkins Health System.

The steady stream of privacy breaches threatens to undermine the health-care industry's effort to adopt electronic medical records. That push is meant to make medical care both safer and more convenient for patients, but a major barrier to health-care digitization has been anxiety about preserving the security of such sensitive data.

"What patient is going to want their data to be transmitted electronically if they can't trust the system to keep their data safe?" says Jill Dennis, a senior vice president at the American Health Information Management Association, a professional organization. "The internal mistakes and the internal carelessness seem to be more prevalent than the stranger from the outside trying to crack into your system."

Patient advocates criticize as too lax institutions' enforcement of a federal privacy law that restricts health providers, insurers and certain other entities from allowing access to private health information to those who don't need to see it. Since the privacy provisions of the law, the Health Insurance Portability and Accountability Act, were implemented in 2003, some 35,000 reports of privacy violations have been submitted to the Department of Health and Human Services. But the department has not levied a single civil fine.

Instead, the department says, it has sought and gained "voluntary compliance" with the law in 6,000 cases. An HHS spokeswoman said the department's approach has led to "improvements that were constructive and were achieved more quickly than through imposition of monetary penalties." Those actions have often involved educating employees about what the law says and how to follow it.

HHS says several hundred reports of violations have been referred to the Department of Justice for criminal prosecution. A DOJ spokeswoman says the department has filed around 200 criminal cases since the 2003 fiscal year under a statute that includes HIPAA, but didn't have a breakdown of just HIPAA-related cases.

David Feinberg, chief executive of the UCLA Hospital System in Los Angeles, calls the celebrity snooping incident "almost mind-boggling," considering that employees had been repeatedly warned not to look at patients' files. Prior to the privacy breaches, UCLA had a computer system that audited who was looking at information on a handful of patients. The hospital permits any patient to request auditing, though high-profile patients more commonly do so.

In the coming months, UCLA plans to start using a new system that will block certain details of patients' records, depending on who is accessing them. For instance, a lab technician would get only lab results, rather than a full medical chart that may also contain radiology reports and notes from doctors and nurses. The system will also allow for auditing on a larger scale, and will include features that require all employees to list their relationship to the patient and will warn them if they're entering "an especially protected chart," Dr. Feinberg says.

Another health system beefing up security is Johns Hopkins, in Baltimore, which has increased employee education on privacy and started adding encryption software to its computers. The action comes after an embarrassing episode last summer, when a computer chained to a desk at Johns Hopkins was pried loose and stolen by a Hopkins employee and an outside vendor's employee. The computer, which was password-protected but not encrypted, had information on about 5,800 patients who were in a registry for people with tumors, including their names, addresses, dates of birth, Social Security numbers, genders, races, medical record numbers and cancer diagnoses.

In another incident involving Johns Hopkins, a deliveryman for a vendor of computer storage devices in late 2006 lost a shipment of the devices on a loading dock at a florist, where he was picking up flowers that he needed to deliver for another client. The misplaced storage devices contained the names, dates of birth, genders, races, mothers' maiden names, fathers' names and medical record numbers of more than 83,000 Johns Hopkins patients.

The hospital also has made other adjustments. Nurses affiliated with Johns Hopkins who are making home calls sometimes used to carry files with them on a "whole roster of patients," not all of whom they were visiting that day, or had extraneous information on those they were visiting, says Mr. Bradfield, the senior counsel. Now, nurses are supposed to carry only what's essential. Johns Hopkins has also instructed its departments to monitor more closely when packages leave their premises and arrive at their destination.

Many hospitals are reluctant to control access to data too tightly for fear that it will create red tape in emergency situations. "We have to be able to take care of patients, too," says Wendy Mangin, president of the American Health Information Management Association and director of medical records and privacy officer at Good Samaritan Hospital, in Vincennes, Ind., which audits clinical staff's access to medical data but doesn't block it.

Most health organizations that have experienced recent privacy breaches say they haven't received reports of identity theft related to the incidents. A report from the U.S. Government Accountability Office in June 2007 said there is little evidence that identity theft has resulted from data breaches in a variety of industries, including health. But the GAO added that it's hard to find the original source of data used in identity-theft cases.

More than identity theft, some patient advocates worry about emotional trauma. "Monetary damages don't really get at the sense of invasion that people experience when their privacy has been breached," says Ms. Dennis of the health-information management association. Patients may also worry about their medical information finding its way to a potential health insurer or employer.

In another recent incident, health insurer WellCare said a Web developer inadvertently made the Social Security numbers, dates of birth, names and medical details of about 10,500 Georgia patients publicly available through Internet searches while sending the data to state regulators. More limited information on as many as 71,000 other patients may also have been made publicly available.

WellCare learned of the problem March 20, when a health-plan member called customer service to complain, but company employees assumed the state was responsible. Only after the same health-plan member contacted the company again did WellCare shut down online access to the information, on April 2.

And in February, a laptop with information from MRI reports, names and dates of birth of about 3,200 people enrolled in a cardiac-imaging clinical trial at the National Institutes of Health was stolen from the car trunk of a researcher who'd taken it along to his daughter's swim meet. The laptop -- which was password-protected but not encrypted, contrary to government policy -- also had Social Security numbers for 1,281 of the participants whose records had been sent to the National Death Index, which keeps track of vital statistics including whether trial participants are still alive.

Patients who are worried their medical records may be accessed inappropriately can take some limited steps to try to prevent it. Denver Health in Colorado, for instance, allows patients after receiving care to be informed of every person who has accessed their information. And some hospitals grant patient requests that access to their records be restricted more than is normal.

Patients whose health-insurance identification numbers have been compromised should monitor the "explanations of benefits" statements that insurers send home to make sure a criminal isn't using their stolen account information to obtain insurance coverage.

Going back to traditional paper records, as some patients advocate, wouldn't necessarily solve the problem. Recently, a schoolteacher buying a box of scrap paper in Utah discovered that it contained patient medical records from Central Florida Regional Hospital that were destined for a Medicare auditor in Las Vegas. The hospital says shipping via UPS is typically "secure and reliable." But UPS spokeswoman Lynnette McIntire cautioned: "In general, we don't recommend that those kinds of paper records be sent."

Looking out for identity theft, fraud

BY SUSAN TOMPOR • FREE PRESS COLUMNIST • April 23, 2008

Retired teacher Donna St. John's hand shot up the minute the workshop instructor asked if anyone ever had his or her identity stolen.

St. John recalled the time several years ago that somebody tried to buy a refrigerator, washer and dryer with one phone call to Sears after opening a credit card in her name. The store caught it. But St. John, who used to teach at Sterling Heights High School, never forgot how quickly trouble could start.

About 50 people attended the two-hour identity theft seminar sponsored by Michigan First Credit Union in Lathrup Village on Monday. The event was one of more than 300 classes, seminars and activities scheduled in Michigan during Money Smart Week this year. See www.moneysmartweek.org/michigan for other events.

Crooks' tricks

On Monday, about 15 in the group raised their hands after David Waxer, a financial counselor for GreenPath Debt Solutions in Southfield, asked people if they ever experienced identity theft or fraud.

Some spotted fraudulent charges on a credit card after renting a car or going to a restaurant. One man signed up for a trial promotion that cost $4.95 online. He canceled the service before the trial was up. But later, he was wrongly charged $140 twice for that service.

One man's wife pulled out a card one day and it wasn't hers. Somehow, somebody slipped her another card, letting her think she still had her own plastic and then used her card without her knowledge.

Somebody stole a child's Social Security number.

We're all vulnerable to identity theft. We all need to protect our information.

"Keep a close watch on every electronic transaction -- every bank statement," Waxer told the group.

How to fight back

Other suggestions:

• Study your credit report to see if someone has opened credit cards using your name.

See www.annualcreditreport.com. That is the only central site that enables you to request a free report once every 12 months from Equifax, Experian and TransUnion. You can request all three reports at once. Or you can monitor your credit by staggering requests -- say getting one report from Experian in January, another from TransUnion in May and one from Equifax in September.

• Avoid carrying too many credit cards or other ID.

If you've got a pocket-size birth certificate, keep it at home. Don't carry your checkbook on daily errands. Do not leave a car rental agreement in a rented car. Do not carry your Social Security card.

• Be aware that some crooks use cell phones to take pictures of card numbers.

• Pay attention to when certain bills arrive in the mail. Some crooks complete a change of address form so your mail is forwarded to another address where they have access and can buy more goods using your card.

And read every statement. You could find somebody trying to charge $1,000 in Christmas decorations to your bill. One man in the group said that's what happened when somebody got access to credit by stealing his personal information.