by Stacy Case Tuesday, August 17th 2021
 

NASHVILLE, Tenn. (WZTV) — You may talk openly with your friends about your Covid-19 vaccination status, but would you want just anybody having access to your private medical information?

FOX 17 News uncovers a potential security hole on the Tennessee Department of Health's website that you'll probably agree needs to be plugged pronto.

When AJ Depriest hopped on the Tennessee Department of Health website, the Wilson County woman says she couldn’t believe her eyes, “I was shocked. I was very disturbed by this.”

A web portal, designed to make it easy to get your private vaccination records also makes it pretty easy for anyone else to get them too. Depriest adds, “Somebody can sit there and literally access the private immunization records for anyone they want as many as they want.”

Depriest at first didn’t believe it could be so easy explaining how she discovered this potential vulnerability, “I got an email from a woman I know who works for one of the county health departments and all she said was, people are using this to access private immunization records.”

With permission from three of her family members, Depriest tested the vulnerability of the vaccination records site, accessing immunization records for all three by putting “self” in the relationship to the requestee section and putting in her own email address.

“All you need is the person's first and last name, you need an address and a phone number and you can even put in your own phone number, male or female, date of birth and these are things you can find on anybody anywhere,” says Depriest.

The Tennessee Department of Health doesn’t require any other verifying identification beyond the basics. “I was shocked, utterly shocked that the state of Tennessee would have such lax security over there medical records in the state health department. Amateur hour at the Apollo. It feels like clown world.”

In a department with a $685 million budget, Depriest wants to know why this is happening saying, “You would think they'd be able to afford a good cyber security system or a system to maintain medical records.”

FOX 17 News' Stacy Case asked Tennessee Health Commissioner Dr. Lisa Piercey about the potential breach of privacy, “Are there any plans to require more secure verification like a driver's license number or social security?” Dr. Piercey answers in part, “Patient privacy is our utmost concern so any type of vaccine record patient portals any of that we are putting in all of the layers of verification. So, only the people who are due those records are getting those records and that is only at the patient's request.”

That was Monday. By Wednesday, Case checked again to see if the state health department put more safeguards in place. With a family member’s permission, I requested their vaccination records by simply typing self in the box that asks for relationship to the requestee and putting my own email in the email box. I got receipt confirmation emailed to me that says they’re experiencing high volume and it may take 5-10 business days. I’ll let you know if I’m successful getting my family member’s vaccine records like AJ.

She says, “Ultimately, this responsibility rests on the Commissioner of the Health Department Dr. Lisa Piercey. The buck has to stop with her and since she answers to the legislature, the legislature is going to have to do something. Call a special session to implement a study, an investigation to find out how long this has been happening.”

Her biggest concern is potential employers, schools or anyone else abusing someone’s private vaccination information to discriminate, segregate or even bully. “I feel there are probably a lot of people out there who are going to file probably breach of privacy lawsuits against the department of health. There really needs to be an investigation.”

FOX 17 News checked the vaccine records request site one more time just before closing time Wednesday to see if it's still operating status quo.

We found the state health department has just put up a message late Tuesday saying "the record request process is under review" essentially shutting down this portal on the Tennessee Department of Health website for now.

We will keep you updated on how the state fixes these security issues that we have brought to light.

FOR MORE INFORMATION AND ADDITIONAL ARTICLES

https://fox17.com/fox-17-investigates/fox-17-news-investigates-are-your-vaccine-records-private-on-tdhs-website