All Eyes On Me: Inside Third Party Trackers' Exfiltration of PHI from Healthcare Providers' Online Systems
All Eyes On Me: Inside Third Party Trackers' Exfiltration of PHI from Healthcare Providers' Online Systems
复制标题
所有人都在关注我：第三方追踪者从医疗保健提供商的在线系统中泄露 PHI 的内部情况
DOI：
10.1145/3559613.3563190
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Levchenko, Kirill
中科院分区：
文献类型：
--
作者：
Huo, Mingjia;Bland, Maxwell;Levchenko, Kirill
在美国，敏感的健康信息受到《健康保险流通与责任法案》（HIPAA）的保护。该法案限制在未经患者同意或知情的情况下披露受保护的健康信息（PHI）。然而，随着医疗服务与网络的整合，许多供应商选择使用第三方网络追踪器来进行测量和营销。这带来了一个安全问题：在线医疗保健系统请求的第三方JavaScript可以读取网站的内容，并且确保PHI不会无意或恶意泄露变得困难。本文以459个在线患者门户网站和4个远程医疗网站为研究对象，对在线医疗记录中的健康信息泄露进行了调查。我们发现14%的患者门户网站包含谷歌Analytics，它（至少）揭示了用户访问过医疗服务提供者网站的事实，而5个门户网站和4个远程医疗网站包含基于javascript的服务，向第三方披露PHI，包括药物和实验室结果。最严重的PHI泄露事件发生在b谷歌和Facebook的追踪者身上。在后一种情况下，估计每月有450万网站访问者可能面临个人信息（姓名、电话号码）和医疗信息（检查结果、药物）泄露的风险。我们将PHI泄露通知了医疗保健提供者，发现只有15.7%的人采取了纠正泄漏的行动。医疗保健运营商缺乏技术专长，无法识别第三方跟踪器造成的PHI泄露。在向医疗保健门户供应商Epic通报PHI泄漏后，我们收到了迅速的响应，并观察到供应商之间的广泛缓解，这表明供应商通知是针对PHI泄露的有效干预措施。
In the United States, sensitive health information is protected under the Health Insurance Portability and Accountability Act (HIPAA). This act limits the disclosure of Protected Health Information (PHI) without the patient's consent or knowledge. However, as medical care becomes web-integrated, many providers have chosen to use third-party web trackers for measurement and marketing purposes. This presents a security concern: third-party JavaScript requested by an online healthcare system can read the website's contents, and ensuring PHI is not unintentionally or maliciously leaked becomes difficult. In this paper, we investigate health information breaches in online medical records, focusing on 459 online patient portals and 4 telehealth websites. We find 14% of patient portals include Google Analytics, which reveals (at a minimum) the fact that the user visited the health provider website, while 5 portals and 4 telehealth websites contained JavaScript-based services disclosing PHI, including medications and lab results, to third parties. The most significant PHI breaches were on behalf of Google and Facebook trackers. In the latter case, an estimated 4.5 million site visitors per month were potentially exposed to leaks of personal information (names, phone numbers) and medical information (test results, medications). We notified healthcare providers of the PHI breaches and found only 15.7% took action to correct leaks. Healthcare operators lacked the technical expertise to identify PHI breaches caused by third-party trackers. After notifying Epic, a healthcare portal vendor, of the PHI leaks, we received a prompt response and observed extensive mitigation across providers, suggesting vendor notification is an effective intervention against PHI disclosures.
登录
查看更多内容
数字医疗相关感染：大型多院区医院系统安全案例研究
DOI：
--
发表时间：
2019
期刊：
Network and Distributed System Security Symposium
影响因子：
--
作者：
Luis Vargas;Logan Blue;Vanessa Frost;Christopher Patton;Nolen Scaife;Kevin R. B. Butler;Patrick Traynor
通讯作者：
Patrick Traynor
公共卫生领域的隐私与安全：保持个人隐私与群体安全之间的微妙平衡
DOI：
--
发表时间：
2006
期刊：
Asia-Pacific Computer Systems Architecture Conference
影响因子：
--
作者：
D. Baker
通讯作者：
D. Baker
使用 ERNIE 扩展对健康相关网站进行跟踪的深入技术和法律分析
DOI：
--
发表时间：
2021
期刊：
WPES@CCS
影响因子：
--
作者：
Vera Wesselkamp;Imane Fouad;C. Santos;Yanis Boussad;Nataliia Bielova;A. Legout
通讯作者：
A. Legout
不完整日志的策略审计：理论、实现和应用
DOI：
--
发表时间：
2011
期刊：
Conference on Computer and Communications Security
影响因子：
--
作者：
D. Garg;Limin Jia;Anupam Datta
通讯作者：
Anupam Datta
TrackAdvisor：从第三方跟踪器收回浏览隐私
DOI：
10.1007/978-3-319-15509-8_21
发表时间：
2015
期刊：
2012 IEEE Symposium on Security and Privacy
影响因子：
--
作者：
Tai;Huy Hang;M. Faloutsos;P. Efstathopoulos
通讯作者：
P. Efstathopoulos