RICHMOND, Va.--The 8.3 million confidential health records that were allegedly stolen when hackers got into Virginia's Department of Health Professions Web site could still be at risk. And the hackers are still at large.
 
On April 30, hackers breached the site—the DHP is an agency that licenses and regulates health care professionals in Virginia—and demanded $10 million from the state government, threatening to sell the records to the highest bidder. (See “Hackers Hold Medical Records Hostage,” May 7.) 
 
But Gov. Tim Kaine said Virginia wouldn’t pay the ransom, and on June 3, the state notified 530,000 people that their personal and medical information might have been swiped. The information, from the DHP’s Prescription Monitoring Program computer system, includes prescription records (possibly 35 million of them) and some Social Security numbers.
 
According to the DHP, an investigation by the FBI and state law enforcement has yet to identify the hackers. Meanwhile, the agency said the state’s computer security experts “are putting in place a number of advanced measures to prevent incursions, including new firewalls, reconfiguring the network and conducting vulnerability assessments of the agency’s systems.”
 
The incident comes on the heels of the Health Information Technology for Economic and Clinical Health (HITECH) Act, part of the federal stimulus law, that toughened HIPAA’s security provisions. The law also includes $20 billion to facilitate health IT projects, including a nationwide network of electronic health records.
 
While shared electronic records could reduce health care costs and improve outcomes, according to some health IT experts, others have said stronger security regulations will be necessary as the government pushes for increased adoption of EHRs.
 
According to a Wall Street Journal report, David Blumenthal, who took over in April as national coordinator for health information technology at HHS, said he sees “huge challenges” ahead on that front, including data privacy concerns among physicians and patients.