Clinical Trial Database Exposes 1.6M Records to Web

An unencrypted, non-password-protected database containing 2 terabytes of data allegedly exposed more than 1.6 million clinical trial research records to the internet, including sensitive personal and medical information of patients, said the security researcher who discovered the lapse.

See Also: Enterprise Browser Supporting Healthcare, Cyber Resilience

The researcher, Jeremiah Fowler of security services firm Security Discovery, said the exposed database contained patient surveys in a PDF format and included the individuals’ names, dates of birth, phone numbers, email addresses, vaccination statuses – including types of vaccines received, current medications and other health conditions.

The database and its records indicated that they belonged to Houston-based DM Clinical Research, a multi-therapeutic network of clinical trial sites. Fowler said it is unclear whether DM Clinical Research directly managed and owned the database or used a third-party contractor or cloud vendor.

The database was finally secured and restricted from public access within 24 hours after Fowler notified DM Clinical Research of his finding.

But he added that he doesn’t know how long the database was exposed before he discovered it – or if anyone else also gained access to it. “Only an internal forensic audit could identify additional access or potentially suspicious activity,” he wrote.

DM Clinical Research’s website says the firm conducts clinical trials in 30 sites embedded in research centers and physician practices in several states nationwide. That includes research involving vaccines for illnesses such as COVID-19, and therapeutic treatments for pediatric patients, psychiatry, neurology and women’s health issues.

The exposed DM Clinical Research records did not include full medical histories, yet the submitted patient survey responses still contained information that identifies sensitive health data, Fowler told Information Security Media Group.

“In a limited sample, the surveys appeared to be unique with no duplicates,” Fowler said. “It is possible that the same person enrolled in separate individual surveys or some individuals had the same name, but even if that accounted for 20% of the files, that is a large number of individuals potentially affected,” he told ISMG.

“Surveys and research are an important tool to gather statistics and data but they can also contain information that should not be public and could cause serious privacy concerns to the affected individuals,” he said.

Breach Concerns

The exposure of individuals’ personal and health information in the clinical research database raises an array of concerns, experts said.

“At the very least, an event like this will likely qualify as a reportable breach under the respective state’s law that addresses breaches of personally identifiable information and, we must remember that protected health information is a subset of PII,” said Joe Gillespie, senior privacy and security consultant at tw-Security.

The state law that would apply is based upon the state of residence of the research subject and not necessarily the company, he said. “All 50 states have such laws and 19 of the states also have ‘comprehensive consumer data privacy laws’ that may have additional reporting requirements and possible fines,” he said.

As for the exposure being reportable under the HIPAA Breach Notification Rule, that would depend on whether the clinical trial firm is a covered entity under HIPAA, he said. In most cases, however, clinical trial companies are not covered entities as they do not use HIPAA standard electronic transactions to obtain third-party reimbursement for this research, he said.

“As I understand it, their work is entirely paid for by the pharmaceutical manufacturers. Their contracts with the manufacturers may have strict penalties for insufficiently safeguarding this sensitive data.”

Besides questions involving HIPAA, because DM Clinical Research is involved in clinical trials for new drugs and treatments, the company also potentially ran afoul of Title 21CFR Part 11, “which dictates the controls required for clinical testing,” said Mike Hamilton, field CISO at security firm Lumifi Cyber.

The exposure involving DM Clinical Research’s records is not the first time Fowler has discovered unsecured databases leaking a trove of sensitive health and other personal information on the web.

Last fall, Fowler reported finding an unsecured database of a virtual mental health provider, Confidant Health, allegedly exposing thousands of patient records on the web (see: Mental Health Records Database Found Exposed on Web).

So what can other organizations do to avoid similar security mishaps involving databases exposed to the internet?

“Databases typically have stricter security measures and protections in place,” said Wendell Bobst, partner and principal consultant at tw-Security.

Organizations can use at least three strategies to detect and protect their databases, he said. “First, with modern vulnerability scanning tools, open databases, especially those exposed to the internet, can be easily identified and flagged for follow-up,” he said.

Second, during user access provisioning, it’s important to ask whether a VPN is required to access the database, he said. “If it’s not, there should be a clear reason why.”

Lastly, well-established organizations should have data and application governance practices in place, including inventories that specify data sensitivity levels and access procedures, he said.

“Services like cloud security posture management are useful for identifying exposed databases, and if not conducted by the organization itself, it should be contracted,” Hamilton added. “Cloud data storage is useful as it can be accessed from anywhere, and dangerous because it can be accessed from anywhere.”

“Access control can be difficult to administer and adds an extra layer of complexity to the development process,” he said.

“In short, organizations are not using tools like checklists to ensure that access control is appropriate and commensurate with the value of the information being stored, and continuously managed, nor are they using security posture management to the extent that. They should,” Hamilton said.

Fowler said his takeaway from his latest discovery is that far too often, many organizations are still not encrypting or password-protecting their data.

“If a healthcare organization uses third-party vendors for various technology services, it is important to assess and monitor the security practices of those partners to ensure they meet the organization’s security standards,” Fowler said.

DM Clinical Research did not immediately respond to ISMG’s request for comment about Fowler’s findings.