GoKawiilPractice by Numbers, the developer of a patient management software used in thousands of dentist’s offices, has fixed a security flaw that exposed the private health records of patients on a portal that comes bundled with the software, TechCrunch has learned.
One patient, Joseph R. Cox, reported the bug to TechCrunch after he encountered the issue while looking at his own dental records on the portal, which was offered by his dentist’s office.
This patient portal is part of a dental office management software made by Practice by Numbers, which claims its products are used in over 5,000 dental practices across the United States.
Cox said the bug allowed any user of the portal, which houses patients’ medical documents and health records, to access documents belonging to other patients. He said he was able to access other patients’ documents from his account, including their personal information, medical histories, photo identification, and other files. The bug also meant that Cox’s records were just as exposed to other patients.
Cox said he attempted to alert the company about the issue via email, but did not hear back. He then notified TechCrunch as a last resort to ask the company to patch the bug.
The bug was remarkably easy to exploit by anyone with a login to the Practice by Numbers’ patient portal. Cox said changing the document number in the web address while loading one of his documents in the portal allowed users to access other patients’ files.
Worse, Cox said the document numbers in the web address appear to be sequentially incremental, so it could be possible to easily guess the document numbers of other people’s medical files.
Cox told TechCrunch that he faced difficulties in alerting Practice by Numbers to the issue, as the company offered no discernible avenue to report security problems. The company’s email address on its website was broken, with emails returned as undeliverable. Instead, Cox sent a message to one of the company’s founders on LinkedIn, but heard nothing back after sending a subsequent email.
The issue, now fixed, highlights a recent trend in which regular consumers are finding security flaws in companies’ products or websites, but have no clear way to report the issue to the developers.
Earlier in April, fashion retailer Express fixed a website bug that allowed anyone to access the order details and personal information of other customers, after a user identified the bug, but found no way to alert the company. A similar incident involved Home Depot in December: A security researcher tried to privately alert the company about a security lapse that was exposing access to its internal systems for almost a year, but their reports were ignored until TechCrunch contacted the company.
... continue reading