By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Health Works CollectiveHealth Works CollectiveHealth Works Collective
  • Health
    • Mental Health
  • Policy and Law
    • Global Healthcare
    • Medical Ethics
  • Medical Innovations
  • News
  • Wellness
  • Tech
Search
© 2023 HealthWorks Collective. All Rights Reserved.
Reading: Lessons from the Anthem Breach
Share
Notification Show More
Font ResizerAa
Health Works CollectiveHealth Works Collective
Font ResizerAa
Search
Follow US
  • About
  • Contact
  • Privacy
© 2023 HealthWorks Collective. All Rights Reserved.
Health Works Collective > eHealth > Medical Records > Lessons from the Anthem Breach
BusinesseHealthMedical RecordsPolicy & LawTechnology

Lessons from the Anthem Breach

David Harlow
David Harlow
Share
0 Min Read
SHARE

King_Henry_V_at_the_Battle_of_Agincourt,_1<p><a class=King_Henry_V_at_the_Battle_of_Agincourt,_1415

Anthem experienced a major data breach last week, and reportedly some records (Social Security Numbers and other identifying information, but not health data) of up to 80 million members and employees were obtained by hackers.

There is much to be said (and much has already been said) about the need for privacy and security and protections in the case of Anthem, just as “helpful hints” have been provided after the fact to victims of all significant data breaches. My reaction, when reading about the unencrypted SSNs that were accessed in this attack, was: Why in the world are we using social security numbers as ID numbers? It doesn’t have to be this way.

The social security number is the only universal unique identifier we have at our disposal in this country. It’s easy to ask for, and to use, but … it’s not supposed to be used for anything other than administration of Social Security benefits. Until not all that long ago, states used SSNs as driver’s license numbers. No longer (at least around these parts). Most of us get asked for the last 4 (or 5 or 6) digits of our SSNs constantly for all kinds of reasons. How many of us refuse every time?

More Read

inappropriate antibiotics for a cold just say no
Antibiotics for a Virus? How to Just Say “No”
Some Further Disruptive Changes in HealthCare Delivery
The Impact of ACA Market Reforms Without a Mandate: Infographic
Patient Centered Reception Areas
SNMMI 2013: Siemens Takes The Wraps Off Two Major Innovations

Way back in 1998, as folks were trying to figure out how to implement HIPAA, the question arose: Gee, why don’t we establish a unique patient identifier system so that we can be assured that each electronic health record is properly tied to the right individual? (Check out this vintage HHS white paper on the Unique Health Identifier, published as prologue to a rulemaking process that never went anywhere.)  Eventually, that approach was taken for providers (UPIN, then NPI), but not for patients. In fact, every year since then, Congress has included a special line in the HHS budget that says Thou Shalt Not establish a unique patient identifier system.

This approach has spawned a sub-industry that scrubs data sets to ensure that an individual patient doesn’t have duplicate records, each including only a part of the whole, by triangulating from all the data points used to perpetrate identity theft: SSN, DOB, name, address, etc. All those data points are needed in order to make sure that we’re talking about the right Mr. Jones. If the only identifier attached to the health data were the patient ID number, then health records would suddenly become much less valuable to identity thieves — and it would be easier to determine which record belongs to whom.

Using patient ID numbers (which could be encrypted and thus protected — because, after all, who wants to get a new patient ID number? Getting a new credit card number after some system or other gets hacked is bad enough, and remember, you can’t get a new SSN just because your health records have been hacked) would be one element of a data minimization approach designed to lessen the likelihood of damage resulting from a breach. Couple that with the auditing capabilities that allowed Anthem to notice its breach in short order (vs. some breaches which were exploited over the course of years before anybody noticed), and we’d be looking at some real improvements to health data security.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting 

TAGGED:security
Share This Article
Facebook Copy Link Print
Share

Stay Connected

1.5kFollowersLike
4.5kFollowersFollow
2.8kFollowersPin
136kSubscribersSubscribe

Latest News

dental care
Importance of Good Dental Care for Health and Confidence
Dental health Specialties
October 2, 2025
AI in Healthcare
AI in Healthcare: Technology is Transforming the Global Landscape
Global Healthcare Policy & Law Technology
October 1, 2025
Choosing the Right Swimwear for Health and Safety
News
September 30, 2025
sports concussions
Concussion In Sports: How Common They Are And What You Need To Know
Infographics
September 28, 2025

You Might also Like

depression and diet link
Home HealthNewsPublic HealthSpecialtiesWellness

Can Diet Cause Depression?

December 22, 2013
Psychiatrists are now working online
Global HealthcareHealth ReformMental HealthPolicy & LawPublic Health

Psychiatrists Now Working Online: How the Mental Healthcare Industry Is Evolving

December 12, 2021

What Patients Want… Online Access to Data!

October 1, 2012
What are The Uses Of Delta 8 Hemp Tincture
Health care

What are The Most Important Benefits Of Delta 8 Hemp Tincture?

July 5, 2021
Subscribe
Subscribe to our newsletter to get our newest articles instantly!
Follow US
© 2008-2025 HealthWorks Collective. All Rights Reserved.
  • About
  • Contact
  • Privacy
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?