24 ms·
Medical cannabis patient data exposed by unsecured database
- hacker_yacker 1y agoNearly a million records, which appear to be linked to a medical-cannabis-card company in Ohio, included Social Security numbers, government IDs, health conditions, and more.
- shifty1 1y agohttps://archive.is/Mp0qt https://archive.is/Mp0qt
- sailfast 1y agoSo are people storing these things in a non-HIPAA-compliant way or is this mostly attributable to some other vector that would not have been helped by compliance? What a terrible leak - med records and marijuana use, especially in some circles - could be very useful blackmail material. :/
- nickff 1y agoFrom some quick research, it seems unclear whether dispensaries are covered entities under HIPAA, as they are not reimbursed by Insurers, due to the federal illegality of the drug. https://mjbizdaily.com/do-medical-marijuana-companies-need-to-comply-with-hipaa/ https://mjbizdaily.com/do-medical-marijuana-companies-need-t...
- sailfast 1y agoKinda incredible - even if they’re not covered providers they are still requesting medical records!
- nickff 1y agoThey usually require records for compliance with state regulations (but the state does not require them to follow HIPAA).
- lmkg 1y agoHIPAA is not a privacy law, nor even a healthcare law. It's an insurance law. It does not cover medical records generally. It deals strictly with how doctors bill insurance companies, and mandates security for health information being billed about. For the same reason, health & wellness apps are not generally covered by HIPAA, and in fact quite a few of those exist solely for the purpose of selling medical data to data brokers. Especially ones related to women's health.
- adi4213 1y agoI think there are even more basic table stakes that were missed here well prior to conducting any manner of formal compliance auditing - like unauthenticated users accessing this database!
- hx8 1y agoSure, but if it was a HIPPA compliance issue then the legal action path is easier and more lucrative.
- deleted 1y ago[deleted]
- time0ut 1y agoMedical marijuana dispensaries are not covered entities under HIPAA [0]. The way the law works is weird, but they are not required to comply. All the more reason the federal government needs to catch up with the times on cannabis. [0] https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...
- cpursley 1y agoMongo?
- riffic 1y agomy neighborhood weed guy would never betray my trust in this way.
- s5300 1y ago[dead]
- dolebirchwood 1y agoMine once asked if I'd like a referral to a doctor who was quite liberal in approving people for medical cards in my jurisdiction. I said, "And end up being tracked as a known user in a government database? No thanks." Safer on the streets.
- jrflowers 1y agoIn Ohio the neighborhood weed guy could get hit with a felony and 18 months in jail for a half pound so… like, he might
- kjkjadksj 1y agoIn practice its pretty hard to actually get caught selling drugs.
- grugagag 1y agoYour neighborhood weed guy would never have your personal information, perhaps not even your full name, a nickname would suffice. But I get the point and the pun. It’s all a big charade
- s5300 1y ago[dead]
- yieldcrv 1y agofree bank accounts for money laundering (new account online, new coinbase account online, stuff new account with cash, transfer to coinbase, transfer onchain, swap to monero, wait, access all with new mac address, new wifi, new browser session, or Tor if the services allow) daily reminder that KYC is a joke, the institutions and enforcement agencies that think it works, don’t know when its not working as long as a real id and ssn and address is used
- aspenmayer 1y agoNow show cashing out. This isn't meant to be a gotcha or a takedown, as I appreciate that you're one of the few HN users knowledgeable about crypto who isn't a shill or dismissive of crypto out of hand. For those who aren't familiar with this industry, there are folks whose job it is to solve these problems with KYC being less effective than it ought to be. Many work in industry as devs, and many do the same as part of the Department of Justice or an affiliated agency or approved third party contractor. There are relevant working groups that bring all relevant parties together for operations. I don't want to assume that you don't know this, but you should not make it out like crime is easy, or that it pays. That said, government salaries are criminally low across the board. I can only assume the private sector of this niche pays better, as it can't very well pay much less than the public sector. Why this is the case is absurd, as it is mostly to do with pay scales and levels, and the near-impossibility of paying workers more, even when it's ready money that is already allocated.
- yieldcrv 1y agoYou cash out in your personal account by launching a memecoin and buying a tiny bit on launch (or minting extra for yourself) the baked xmr funds are once again swapped into virgin addresses that all buy your memecoin, with your clean funds you sell your position into the liquidity pool of the pumped coin it looks the same as any other launch. are they bots, are they retail degens? who knows, pay capital gains tax and move on. you can modify this by having the virgin addresses with dirty funds launch and pump the coin too, as long as your clean address buys near the beginning and sells into liquidity this can all be scripted and done with unlimited amounts, a “bundler” can manage many virgin addresses with a nice GUI now, specifically to be multiple buyers and sellers of a launch you can unlink your clean funds in less (or equally) restrictive ways for other reasons and privacy, but its clean enough to pay taxes on and be free and clear
- 0cf8612b2e1e 1y agoCybersecurity Researcher, Jeremiah Fowler, discovered and reported to Website Planet about an unencrypted and non-password-protected database that contained 957,434 records. The database belongs to an Ohio-based organization that helps individuals obtain physician‑certified medical marijuana cards. The database held PII, drivers licenses, medical records, documents containing SSNs, and other internal potentially sensitive information. So, the absolute bare minimum was not followed. Just wide open database containing medical information.
- firefax 1y agoMore evidence cannabis needs to be recreational. We can let people use their FSA money for it and/or give a steep discount to people who "really" need it, like cancer patients... but I think a lot of people who bounce between Anyways, there are a LOT of little fly by night outfits that "help" you get a medical card in many states. It's a joke, and all it does is empower the same type of person who used to be a pill doctor to rent seek, and it's not at all a surprise one had poor data practices.
- reactordev 1y agoI could get behind this so long as there’s still limits on your person and in public places. Colorado has a great system. However, legalization has only created weed monopolies by abuse of the law language. Essentially making it illegal for smaller shops to compete. Those same people are the ones contracting out these systems with local governments.
- kjkjadksj 1y agoThe limits don’t really make sense either. Plenty of people grow for personal use and all of them will be in violation considering the yield from a single outdoor plant could be well over a pound dry.
- reactordev 1y agoIf you grow for personal use, why are you transporting it? I’m fine with storing as much as you like as home. If it’s legal across the US then this doesn’t really matter at all. I’m talking about limits on your person, for personal use, when not at home, in public. I don’t want to smell like a Rastafarian when I go to work.
- sailfast 1y agoOne more thing to note here: anybody in this database that is also part of the OPM leaks or holds a federal job (or is a trucker or other non-drug requirement) will now be compromised and subject to blackmail. If the dots are connected they will lose their jobs. Full stop.
- hardwaresofton 1y agoWhy is the database not named?
- hobs 1y agoBecause they want you to click one more time to the other article that names it. https://www.websiteplanet.com/news/ohio-medical-alliance-breach-report/ https://www.websiteplanet.com/news/ohio-medical-alliance-bre...
- hardwaresofton 1y agoI did click that -- it didn't have it listed either... I think I wasn't clear, I wanted to know which database system people were using (i.e. Postgres, Mongo, etc). You can't even run Postgres in a container without a password these days, how could someone do a whole production deployment without a password.
- neilv 1y ago> As legal cannabis has expanded around the United States for both recreational and medical use, companies have amassed troves of data about customers and their transactions. And that should be treated as a massive liability, where one breach wipes out your company with lawsuits. And the wronged parties can go after the assets of executives and maybe even investors, due to willful criminal negligence. If there's any justice, the "greed is good" techbro industry will finally be told that the sociopathic combination of systemic surveillance/stalking and gross indifference about even basic security is over.
- sublinear 1y agoWhat if like... man... what if it was all vibe coded? huhuhuh!
- nope1000 1y agoPublicly accessible, not password protected, not encrypted. That is insanity.