Medical IT Contractor Folds After Breaches

Medical IT Contractor Folds After Breaches
Medical IT Contractor Folds After Breaches 

By Tim Wilson
Site Editor, Dark Reading 
AUGUST 15, 2007

Verus Inc., the IT contractor that has been implicated in security 
breaches at at least five different hospitals across the country, has 
gone out of business.

The Bellevue, Wash., company, which built and maintained Websites and 
services on behalf of some 40 to 60 hospitals nationwide, was disbanded 
"eight to 10 weeks ago" when investors pulled the plug following a 
massive blunder that exposed many of its clients' data to the outside 
world, according to an executive at MedSeek, an IT contractor that is 
now handling many of Verus' clients.

While reports of the breaches have been issued in dribs and drabs, all 
of the data losses can now be attributed to a single incident, in which 
Verus employees left a firewall down following the transfer of data from 
one server to another, according to David Levin, vice president of 
marketing at MedSeek.

"All of the breaches were the result of an IT error, as opposed to any 
problems with the software," Levin says. "They made a huge mistake, and 
it literally shut the company down. It's really a cautionary tale." 
Verus's Website has been pulled down, and calls to the company's offices 
are referred to MedSeek customer service. No announcement of the 
shutdown, nor any explanation of the reasons behind it, appear to have 
been issued to the media or to Verus partners.

"We're not sure if the breaches were the only reason why they closed 
down -- there might have been other issues as well," Levin says. "But we 
know we got the call to support the [Verus] customers very soon after 
the breach was supposed to have happened."

Reports of the breaches range from mid-April to late May, but Verus has 
been implicated in at least five disclosures since the beginning of 

    * On June 4, Stevens Hospital in Edmonds, Wash., reported the 
      exposure of 550 patients' data through a failure in the online 
      bill payment service operated by Verus.

    * On June 6, Keenewick General Hospital in Washington reported a 
      similar breach affecting 1,000 patients, and attributed it to the 
      Verus online bill payment service.

    * On June 7, Concord Hospital in New Hampshire disclosed the loss of 
      9,000 names because Verus had "turned off a firewall for 
      maintenance purposes" and failed to turn it back on again. The 
      breach was not disclosed publicly until late July (See Third 
      Parties Fumble Data Handoffs.)

    * On July 24, St. Vincent's Hospital in Indiana reported a security 
      breach that exposed data on some 51,000 patients. The hospital 
      blamed Verus, which exposed the data while transferring data 
      between servers.

    * Earlier today, Sky Lakes Medical Center in Oregon revealed that 
      30,000 patients' names had been inadvertently exposed in late May, 
      when Verus didn't take sufficient precautions while transferring 
      data from one server to another.

All of the hospitals said they immediately terminated their contracts 
with Verus following the breach. All of the hospitals said they have yet 
to see any reports of hackers or criminals using the data.

According to Levin, the breaches all affected hospitals using Verus's 
VPAC online billing system, which MedSeek does not use. Verus's hospital 
customers will be given a choice as to whether they want to migrate to 
the MedSeek platform and services, or move to some other vendor.

Attend HITBSecConf2007 - Malaysia 
Taking place September 3-6 2007 featuring seven tracks of technical 
training and a dual-track security conference with keynote speakers 
Lance Spitzner and Mikko Hypponen!  -  Book your seats today! 

Site design & layout copyright © 1986-2014 CodeGods