Health Now Networks Exposes 321,920 Medical Records Due to Unsecured Database
What Happened — In March 2017 the telemarketing firm Health Now Networks left a cloud‑hosted database publicly accessible. The store contained over 900 k records, including 321 920 unique accounts with names, dates of birth, health insurance details, medical conditions, IP addresses, and security‑question answers.
Why It Matters for Trust & Control Assurance
- Unprotected data stores violate the control objective of “secure configuration and continuous monitoring of data repositories.”
- Lack of logging and access‑control evidence makes it difficult to demonstrate due‑diligence during audits.
- Continuous control‑assurance programs would flag the misconfiguration early, providing defensible evidence that the organization enforces proper data‑handling policies.
Who Is Affected — Healthcare providers, insurers, and any organization that contracts with Health Now Networks for patient outreach.
Recommended Actions
- Conduct an immediate inventory of all data repositories and verify access permissions.
- Deploy automated configuration‑monitoring tools to detect publicly exposed assets.
- Enable comprehensive logging and retain evidence to satisfy audit requirements.
- Map the discovered gap to your control‑assurance framework and remediate the configuration.
Technical Notes — The exposure resulted from a misconfiguration that left the database reachable without authentication. No specific CVE is associated; the issue is a classic “open database” scenario. Data types exposed include personally identifiable information (PII) and protected health information (PHI).