Unsecured Database of Addiction Service Provider Potentially Contained Records of 145,000 Patients
A database containing highly sensitive information of patients who had previously sought treatment for addiction at rehabilitation centers has been discovered to be freely accessible over the internet.
The database contained approximately 4.91 million records which related to an estimated 145,000 patients of the Levittown, PA-based addiction rehabilitation service provider Steps to Recovery.
The unsecured database was discovered on March 24, 2019 by Justin Paine, Director of Trust and Safety at Cloudflare. Following the discovery, Paine notified Steps to Recovery and its hosting provider on March 24. No reply was received from Steps to Recovery, but its hosting company made contact and the database has now been secured and is no longer accessible online.
Paine had performed a search on the Shodan search engine to identify unsecured databases and devices. According to Paine, the ElasticSearch database contained two indexes which included more than 1.45 GB of data. The information could be accessed by anyone over the internet without the need for any authentication. The database was exposed online for more than two years, from the middle of 2016 to the end of 2018.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The types of information contained in the database included patients’ names, details of the treatments and services received at Steps to Recovery, the dates those services were provided, locations visited by patients, and billing information.
Paine was also able to obtain further information on patients with simple Google searches using information contained in the database. For a small sample of patients, Paine was able to discover information such as ages, dates of birth, email addresses, and possible contact telephone numbers.
The number of patients impacted by the breach has yet to be confirmed by Steps to Recovery and the incident is not yet listed on the Department of Health and Human Services’ Office for Civil Rights Breach portal. It is unclear if any other individuals found the database during the time it was accessible online.
