Medical Identity Theft

Architecture and Background

Eric Smith & Dr. Shana Dardan: Medical Identity Theft In less than an hour, during a scheduled pentest, our team was able to retrieve 3.2 million patient insurance records from a HIPAA-compliant medical facility. Using these records, we could have generated counterfeit insurance and prescription cards which would pass muster at any doctor's office or pharmacy counter. If you are one of the 47 million Americans with no health insurance or happen to have a medical condition you wished to hide from employers or insurers, would you consider purchasing falsified medical documents? Thousands of Americans have already said yes, without thinking twice about the victim of their victimless crime.

Vulnerability Analysis

What happens to you if your medical identity is stolen? You may find yourself liable for thousands of dollars of co-pays, deductibles, and denied claims. Is this because you forgot to shred an important document? Did you fall for a phishing scheme online? Of course not -- it was entirely outside of your control, and it happened because the current HIPAA regulations are insufficient to protect your medical identity.

Exploitation and Demonstrations

In this talk, we'll review the current state of HIPAA and other laws covering the security of your medical records, and discuss what changes need to be made, both in policy in practice, to shore up the security of our medical records. Eric Smith is Assistant Director of Information Security and Networking at Bucknell University, located in Lewisburg, Pennsylvania. He has over 15 years of field experience in information security, networking, and systems administration. He has provided consultation services in places such as Research Triangle Park and New York City. Eric is a founding member of PreSet Kill Limit, the security research group which has won the Defcon Wardriving Contest the past several years.

Remediation and Defensive Strategies

Shana Dardan holds a PhD from the University of North Carolina at Charlotte in Information Technology. Currently, she is conducting research in the area of IT Investment Valuations and Digital Healthcare for hospitals nationwide. Shana has been an invited member of the WiSac and Pennsylvania Broadband task forces. Previous corporate research includes notable companies such as Intel Corp, where she conducted research for Doug Busch, VP and CIO on IT investment analysis. She speaks at industry events on investment strategies, IT security, and outsourcing and has contributed to numerous books. Shana joined Susquehanna University in 2006, where she teaches Systems Analysis and Design as well as IT Strategy. For copies of the slides and additional materials please see the DEF CON 16 Archive here: