Fax hackers can access patient info

Hey there, time traveller!
This article was published 16/08/2018 (2071 days ago), so information in it may no longer be current.

Hacking of fax machines might seem as unlikely as sightings of dodo birds, but it’s a dangerous reality.

Doctors and pharmacists still rely on fax machines, meaning successful hackers could have access to patients’ sensitive personal information.

Research this week demonstrated the popular multi-office copiers that offer email and fax options are vulnerable to hackers, says the software company that identified the threat.

Check Point Software Technologies, a NASDAQ firm that enjoyed a mild uptick after the report, saw its warning reported in mainstream American media including the Washington Post and the NBC network.

“The Check Point research demonstrated the vulnerabilities in the popular HP Officejet Pro All-in-One fax printers. The same protocols are also used by many other vendor’s faxes and multi-function printers and in online fax services such as fax2email, so it is likely that these are also vulnerable to attack by the same method,” the Israeli-based global tech security firm said in its statements posted online.

The statement then added the clincher for anyone who thought fax machines were all but obsolete in a high-tech world:

“Not often perceived as modern-day technology, there are over 45 million fax machines in business globally,” CheckPoint observed.

That’s 17 billion faxes a year, by their count.

“Fax machines are used in several industry sectors such as health care, legal, banking and real estate, where organizations store and process vast amounts of highly sensitive personal data,” CheckPoint said.

Manitoba’s remote and rural areas also still rely on faxes as a substitute for electronic communications they’re unable to access.

It turns out health-care sites, including hospitals, doctors’ offices and pharmacies throughout Canada and the U.S also depend on faxes.

Across the border, faxes are identified as an acceptable way to transmit patient information under health-care laws passed by Congress as late as 1996.

The online news site Slate concluded in a recent fax fixation overview that more doctors are shifting to encrypted email, but they have to keep the fax machines going for those who haven’t.

In Manitoba, the whirl and beep of fax machines are background noise in hospitals, pharmacies and doctors’ offices. Out of 30 personal health information complaints in 2017, no one has complained about hacked faxes, the province’s ombudsman said.

Fax transmissions are written into the policies that regulate pharmacists, provincially and nationally, the College of Pharmacists of Manitoba said.

“The use of facsimile machines for prescriptions is something we speak to in our joint statements from regulatory bodies,” wrote college spokesman Gus Gottfred in an email about the practice. “I did a quick check of the past three years and found no complaints (about faxes) nor did anyone I spoke to recall hearing of any.”

Manitoba Pharmacists is the business-related voice for the province’s nearly 900 pharmacists.

A spokeswoman indicated pharmacists would like nothing better than to be a full partner of the province’s encrypted medical records database and ditch their fax machines.

“Community pharmacists in Manitoba have limited access to the province’s electronic medical records system. As a result, they must rely on faxing to communicate with physicians, nurse practitioners, and other medical professions,” Manitoba Pharmacists spokeswoman Lauren Darroch said in an email.

The College of Physicians and Surgeons, which licenses doctors, said faxes may be old-fashioned but as long as they comply with the profession’s security requirements, they’re accepted.

Change might be forthcoming. The province started moving on more secure ways to protect patient records, long before this week’s report blew the whistle on fax hacking.

It cloaks patient record-sharing under a secure electronic web shared with regional health authorities and plans to extend coverage to community pharmacists that work with its clinics.

Faxes are still considered safer than emails in unsecured contexts, Winnipeg Regional Health Authority spokeswoman Amy McGuinness said in an email.

“There is no capacity to ensure secure transmission outside of the secure environment (used by regional health authorities),” McGuinness said.

“In those instances when PHI (personal health information) must be disclosed electronically and outside of the secure environment, fax is considered the more secure option. Fax transmission runs through telephone transmission infrastructure, which is not subject to interception in the same way as email is.”

In practice, that means balancing real-world challenges with the province’s strict patient confidentiality laws.“There are a number of solutions in use for electronic sharing of information that might otherwise be faxed, such as email within secure networks, within system messaging and across-system messaging — including electronic delivery of lab results.

The eChart Manitoba solution is also a well-utilized repository of key health information that does not replace the need for direct provider-to-provider messaging, but does reduce the need for this in some cases. This tool is being extended to community pharmacies and implementation plans are underway,” McGuinness said.

alexandra.paul@freepress.mb.ca