Hacking of prescription database may lead to headaches

The possible breach of a state electronic prescription drug database could have an ironic effect: promotion of prescription drug fraud and abuse, the very thing the system was set up to deter.

That suggestion came from outside experts Thursday as the FBI and State Police continued investigating last week's unauthorized intrusion on the Web site of the Virginia Prescription Monitoring Program.

According to WikiLeaks, an open-government Web site, the intruder was a hacker claiming to have gained access to more than 35 million prescription records and demanding a $10 million ransom.

The statewide database was established in 2006 to combat prescription drug abuse, which is increasingly recognized as a national public health issue. Overdose deaths from prescription drugs now exceed those from illegal drugs.

The database contains records of every prescription dispensed by Virginia pharmacies of certain drugs with a high potential for abuse, such as OxyContin, Vicodin and Ambien. Until it was shut down in the wake of the hacker attack, the system allowed doctors and pharmacists to track those prescriptions and watch for patterns of abuse.

If the database is now in the hands of a hacker, Virginians whose prescription records were stolen are "at risk of medical identity theft," said Rob Douglas, editor of the Web site www.IdentityTheft.info.

The records include the patient's name, address and date of birth, the name and quantity of the drug prescribed, and identifying numbers for the prescriber and dispenser.

"With that information, it is plausible that a medical identity thief could contact the pharmacist and initiate a refill of that medication," Douglas said. "These are highly sought-after drugs, easily converted to cash on the street in sales to addicts.

"If I were the state, I would be very concerned that their system has now been compromised."

In addition, he said, individual Virginians have reason for concern. If their records are used for illicit refills, he said, it could make it difficult for them to get legitimate refills.

Douglas advised people who suspect their records are vulnerable to contact their doctor, pharmacist and insurance carrier and ask them to note in their records that there is a potential for prescription fraud.

Kathy Siddall, a spokeswoman for the state Department of Health Professions, which maintains the prescription database, declined to speculate on the scenario laid out by Douglas, noting that the state doesn't yet know for sure that the database was breached.

If the investigation determines that there was a breach, Gov. Timothy M. Kaine said Wednesday, then all Virginians affected will be notified.

On Wednesday, when state officials made their first official statement about the incident, they said it is unlikely the information in the database could be used to commit identity theft for financial purposes, because it doesn't contain Social Security numbers. However, they suggested that people covered by the database "remain vigilant" for the next year or two, checking their bank accounts and credit reports for signs of trouble.

Brian Wolfinger, vice president of LDiscovery, a digital forensics consulting firm, said Virginians should view the hacking incident as a wake-up call to the potential for identity theft.

Noting that everyone is entitled to one free credit report every year from one of the national credit reporting bureaus, Wolfinger said, "This is a great time to exercise that right and take stock of your current level of exposure."

Electronic prescription monitoring programs have been established in 38 states. The Virginia program had a $452,000 budget last year, funded primarily by a federal grant and a $20 million share of a 2007 court settlement by Purdue Pharma, the maker of OxyContin, for misleading the public about the painkiller's risk of addiction.

Siddall said she knows of no assessment of the program's effectiveness in curbing drug abuse.

The hacking incident has had repercussions beyond Virginia. Last week the Florida legislature passed a bill authorizing a prescription monitoring program similar to Virginia's.

A group of legislators sent a letter Thursday to Gov. Charlie Crist urging him to veto it, citing the Virginia incident.

During floor debate on the bill, proponents "assured us that there had never been a breach," state Rep. Carl Domino, one of the dissenters, said in an interview.

"We certainly don't want to subject the citizens of Florida to the agony that I'm sure some people in Virginia are feeling tonight."

Bill Sizemore, (757) 446-2276, bill.sizemore@pilotonline.com