State Police and the FBI are investigating last week's posting on the state's Prescription Monitoring Program Web site of a note demanding $10 million for the return of information covering 35.6 million prescriptions for 8.3 million patients (click here).
The department, in a statement issued May 6, does not confirm a data breach, calling the incident a "potential breach of security." Director Sandra Whitley Ryals does acknowledge an unauthorized message was posted on the Web site.
In an accompanying Questions/Answers document, the department recommends that consumers using controlled substances remain vigilant for the next one to two years when reviewing financial accounts. The department is not at this time offering free credit monitoring services to affected patients. Instead, it lists Web site addresses and a phone number to receive a free copy of a credit report from the major credit ranking firms every 12 months.
The Department of Health Professions operates the computer system to monitor prescriptions for controlled substances. Physicians and pharmacies submit prescription data, and can query the system to find out if a patient is receiving the same prescription or prescriptions from other physicians.
The department also announced that it has backup copies of the database, contrary to the hacker's claims. Information in the system includes patient name, address and date of birth; name, quantity and date of the dispensed substance; the prescriber and dispenser identification numbers; and a prescription number. Optional data elements include the dispenser's customer identification number, which may be a Social Security number, and the number of authorized refills.
More information is available at dhp.virginia.gov.
--Joseph Goedert
Be the first to comment on this post using the section below.