OpenEMR flaws left millions of health records exposed

Clinician's computer meltdown

Critical security flaws in the widely-used OpenEMR health records storage system left millions of patient records vulnerable, researchers have revealed.

A host of flaws in version 5.0.1.3 of the open source system used by organisations across the world - including a portal authentication bypass, instances of SQL injection, as well as remote code execution - left the records of more than 90 million patients vulnerable.

The 23 issues - many described as 'high risk' - outlined in a vulnerability report were discovered by a team of seven cyber security experts from Project Insecurity who manually reviewed OpenEMR's source code without the use of any automated analytical tools.

The researchers brought these vulnerabilities to the developer's attention last month, before the vendor released an update fixing the vulnerabilities less than two weeks later on 20 July. Full disclosure of the vulnerabilities were made yesterday as per an agreement between OpenEMR and Project Insecurity.

"We've seen a lot of medical-related breaches in the media lately and it made us think about the entire transition from regular handling of medical records to them being dealt with electronically and the security implications of that," said Project Insecurity's CEO Matt Telfer, speaking with databreaches.net.

"After some googling we found that OpenEMR was the most widely-deployed open-source electronic medical record application on the internet. And the fact that it's open source meant that we could test it without any negative legal implications."

The research team also issued a number of recommendations the developers could deploy to prevent further exploitation in future, including PHP modifications to prevent SQL injection attacks, and blacklisting malicious extensions to mitigate the risk of unrestricted file uploads.

Project Insecurity's chief financial officer Brian Hyde told IT Pro the team wasn't able to say whether malicious actors had already taken advantage of the frailties, but added a dedicated hacker would have been able to find them "in a rather trivial manner".

He added some of the exploits "could have potentially been there since the very first release of OpenEMR".

OpenEMR is one of the world's most widely-used systems for storing medical records and managing medical practices, and boasts thousands of downloads each month.

The open source system is predominantly used in the US, and on Windows devices, but is also popular in a host of other countries including India, and Honduras. OpenEMR does have a presence in the UK - but it is not as widely-used; only 19th in most downloads by country in the last five years.

Concerns over the security of patient data have never been higher - particularly as health records across the NHS are increasingly being stored digitally. Speaking with IT Pro in June, experts highlighted the risks of migrating patient data to the public cloud, claiming patients would be put at risk if cloud migration is done purely as a cost-saving exercise.

NHS Digital told IT Pro OpenEMR is not used from a national perspective, but local organisations are able to procure their own systems from a variety of suppliers.

It is unlikely OpenEMR is used in the NHS, the spokesperson added, due to its exclusion from the main channels through which Primary and Secondary Care organisations procure their services.

Keumars Afifi-Sabet
Features Editor

Keumars Afifi-Sabet is a writer and editor that specialises in public sector, cyber security, and cloud computing. He first joined ITPro as a staff writer in April 2018 and eventually became its Features Editor. Although a regular contributor to other tech sites in the past, these days you will find Keumars on LiveScience, where he runs its Technology section.