Summary of the Electronic Patient Record (EPR) Security Analysis
0:00:18 Introduction: The talk discusses vulnerabilities in the electronic patient record system in Germany, focusing on the "opt-out" EPR for all citizens, scheduled to launch on January 15th.
0:02:21 EPR for All: Version 3.0 of the EPR will be rolled out to all citizens, with an option to opt-out. It includes e-prescriptions, doctor's letters, findings (initially as PDFs), image data, and coverage data from health insurance companies.
0:04:55 Access and Authorization: Patients can access their EPR via a health card or an app. Inserting the health card into a reader at a healthcare institution grants that institution 90-day access to the EPR. This includes both reading and writing privileges.
0:06:49 Data Export: All data flowing into the EPR, including billing and e-prescription data, is automatically forwarded to a research data center.
0:07:30 Trust Space: The telematics infrastructure involves multiple stakeholders, including health insurance companies, card issuers, and service providers, creating a complex trust space.
0:09:28 Previously Identified Vulnerabilities: The speakers highlight past vulnerabilities discovered in the system, such as the ability to obtain practice identities and health cards through social engineering and exploiting misconfigured connectors.
0:13:32 Video Identification Weakness: The video identification process, used by many health insurance companies for identity verification, was found to be vulnerable, allowing unauthorized access to EPRs.
0:16:53 SQL Injection Vulnerability: A new vulnerability was discovered in a card issuer portal, allowing SQL injection attacks to access and manipulate member data, including passwords (stored as MD5 hashes). This could potentially enable unauthorized access to practice identities.
0:20:49 Insured Master Data Service Vulnerability: A critical vulnerability in the insured master data service allows attackers to potentially access a large number of EPRs by exploiting the way health cards are authenticated. The attack involves manipulating the card's ID number (ICCSN).
0:28:32 Obtaining Health Cards: Attackers can obtain health cards by exploiting weaknesses in the ordering process, which often requires minimal effort (e.g., phone calls).
0:33:34 Obtaining Practice Identities (SMCBs): Attackers can also obtain practice identities by purchasing used card terminals (e.g., Orga 6141) on online marketplaces like eBay, which often come with valid SMCB cards.
0:34:39 Remote Access to Health Institutions: Attackers can gain remote access to health institutions' IT systems by exploiting vulnerabilities in practice management software or by offering "support" to institutions experiencing technical difficulties.
0:36:33 Summary of Vulnerabilities: The speakers summarize the various vulnerabilities, allowing attackers to access individual files, all files released for a practice, and potentially all 70 million EPRs.
0:39:38 Demands for Improvement: The speakers demand an independent and reliable assessment of security risks, transparent communication of risks to those affected, and an open development process for the EPR system.
0:42:51 Opt-Out Recommendation: The speakers suggest that individuals with high-security needs consider opting out of the EPR until the identified vulnerabilities are addressed.
0:46:17 Health Insurance Companies' Role: The speakers discuss the role of health insurance companies, which can use certain data for evaluation purposes (with an opt-out option). They also highlight the vulnerability of the health card issuance process.
0:49:22 Historical Context: The use of the ICCSN instead of signed certificates for authentication is a historical artifact and a known deficiency.
0:50:16 Communication with Stakeholders: The speakers describe their communication with stakeholders as generally positive on a working level but point out the influence of political pressures and timelines.
0:51:53 Further Deficiencies: The speakers acknowledge that their analysis is not exhaustive and that further security deficiencies likely exist.
0:53:32 Transparent Risk Communication: The speakers emphasize the need for transparent communication of risks to the public, using clear and understandable language.
0:54:55 Limited Granularity of Access Control: The current system lacks granular access control, meaning that healthcare providers either have full access to an EPR or no access at all.
0:56:58 Ombudsman's Office: A possibility for restricting service provider access via an ombudsman's office is mentioned but not yet implemented.
0:57:38 Using EPR as an Inbox: The suggestion to use the EPR as a secure inbox by downloading and then deleting documents is discussed, but limitations regarding document authenticity and specific functionalities (e.g., electronic medication list) are highlighted.
0:59:03 Conclusion: The talk concludes by emphasizing the need for a trustworthy development process and expressing concern about the loss of trust in the digital healthcare system. The speakers reiterate their demands for improvement and express hope that their concerns will be addressed.