InformationWeek reports that a man hacked into a medical database to steal patient information:
Eric McNeal, a 38-year-old information technology specialist from Atlanta, Ga., has been sentenced for hacking into the patient database of a former employer, stealing patient information, and then deleting the information from the system.
For his crime, McNeal was sentenced on Jan. 10 to serve 13 months in prison with three years of supervision after his release. McNeal also was ordered to perform 120 hours of community service. […]
According to court documents, McNeal, who pleaded guilty to the charge on Sept. 28, worked as an information technology specialist for APA, a perinatal medical practice in Atlanta. He left APA in November 2009, and subsequently joined a competing perinatal medical practice, which was located in the same building as APA.Â
In April 2010, McNeal used his home computer toÂ hackÂ into APA’s patient database; download the names, telephone numbers, and addresses of APA’s patients; and then delete all the patient information from APA’s system. McNeal used the patient names and contact information he stole to launch a direct-mail marketing campaign for his new employer. There is no evidence that McNeal downloaded or misused specific patient medical information.
Christine Marciano, president of Cyber Data Risk Managers, said medical facilities looking at this case should ask themselves how they can realistically protect against similar hacking attempts. “Having an exit strategy in place when an employee leaves or is terminated should be strictly enforced,” Marciano toldInformationWeek Healthcare.Â “The exit strategy needs to include cutting off the employee’s access to all of the facility’s databases in order to prevent unauthorized access.”