Database on Doctor Discipline Is Restored, With Restrictions

By Duff Wilson

The New York Times

Health

A federal health agency on Wednesday restored to its Web site a database of doctor disciplinary actions two months after removing it from the Internet in response to a doctor’s complaints.

But the return of the information came with a catch. It has a new requirement that anyone who uses it must first promise not to link information in the database with publicly available information, like court files, that would identify individual doctors.

And that was exactly the way journalists for many news organizations had used the national data bank, which masked individual doctors’ names, as material for articles about weaknesses in the oversight of doctors with dozens of malpractice cases and gaps in disciplinary actions.

(cut)

But journalists and other researchers have linked specific malpractice payments in court cases with the specific amounts reported in the Public Use file to fairly easily crack the code, add up cases against doctors, and report the results.

Dr. Sidney M. Wolfe, director of health research at the Washington nonprofit group Public Citizen, said it was “obnoxious” and “unacceptable” for the administration to impose the condition on journalists and researchers.

The entire story can be read here.

A prior blog entry on this issue can be found here.

Ten Best: Preventing Privacy and Data Breaches

By Tony Bradley, PCWorld

The antics of groups like Anonymous and LulzSec over the past few months have made data breaches seem inevitable. If information security vendors like HBGary and RSA Security aren't safe, what hope does an average SMB have? It is true that there is no silver bullet, and no impervious network security, but there are a variety of things IT admins can do to prevent network breaches and protect data and privacy better.

The Web safety and online identity protection experts at SafetyWeb.com and myID.com helped put together a list of ten different data and privacy breach scenarios, along with suggestions and best practices to avoid them.

1. Data Breach Resulting From Poor Networking Choices. Names like Cisco and Sun are synonymous with enterprise-level networking technologies used in large IT departments around the world. Small or medium businesses, however, generally lack the budget necessary for equipment like that. If an SMB has a network infrastructures at all, it may be built around networking hardware designed for consumer use. Some may forego the use of routers at all, plugging directly into the Internet. Business owners can improve network security and block most threats by using a quality router, like a Netgear or Buffalo brand router and making sure to change the router password from the default.

2. Data Breach Resulting From Improper Shredding Practices. Dumpster diving identity thieves target businesses that throw out paperwork without shredding it. Most home shredders will suffice for small businesses in a pinch, but a commercial shredder is a wise investment if private information is printed and shredded daily. Make sure that documents with sensitive information or personally identifiable data are thoroughly shredded before disposal.

3. Tax Records Theft Around Tax Time. On a similar note, businesses need to pay extra attention to incoming and outgoing information related to taxes. Businesses must ensure that tax returns are dropped off at the post office and refunds are collected promptly from the mailbox. Identity thieves often steal tax returns from an outbox or mailbox.

4. Identity Theft Resulting From Public Databases. Individuals, especially business owners, often publish lots of information about themselves in public databases. It is a sort of catch-22 because a small business owner wants to maximize exposure while still protecting individual privacy. Businesses are registered with the county clerk, telephone numbers are in the phone book, many individuals have Facebook profiles with their address and date of birth. Many identity thieves can use information searchable publicly to construct a complete identity. SMBs need to think carefully about how and where to gain exposure for the business, and consider the consequences of sharing sensitive information publicly.

5. Identity Theft Resulting from Using a Personal Name Instead of Filing a DBA. Along those same line, sole proprietors that do not take the time to file a Doing Business As application are at a far higher risk of identity theft due to their personal name, rather than their business names, being published publicly.

The rest of the story is here.