Recordings
Therapy notes in a database without a password
In September 2024 a US mental health and addiction treatment provider that markets itself as AI-powered turned out to have left a database open without a password, holding therapy notes and identity documents.
Texas-based Confidant Health presents itself as an AI-powered online service for mental health and addiction treatment, operating in five US states. On 6 September 2024 an independent security researcher reported on vpnMentor that one of the company's databases had been reachable on the internet by anyone, without a password.
The database held 126,276 files totalling 5.3 TB, and a separate folder held 1,755,571 log records. The researcher saw psychotherapy intake notes and psychosocial assessments covering mental health, substance use, family circumstances and trauma. Alongside them were images of driving licences, ID cards and health insurance cards, letters listing prescribed medication, and drug test results bearing patients' names. The researcher also found references to audio and video recordings of sessions and to transcripts, and thought these large files were the likely reason for the database's size.
The researcher notified the company immediately, and public access was restricted within hours. How long the data had been exposed, the researcher wrote, only the company's own investigation could establish; whether anyone else had accessed it is not known. The company's co-founder told Wired the problem had been fixed in less than an hour, and also said that less than 1 per cent of the files had been exposed, including faxes and synthetic training data, and that an audit with outside experts had found no malicious access to patient records.
What can we learn from it?
A therapy note, recording or transcript, gathered with many others in a provider's system, is both valuable and vulnerable, and its safety depends on how the provider configures its storage. Digital notes and transcription can still serve us well; it is worth knowing where they happen. In Confiella the audio never leaves the computer, the transcript is made locally, and cases stay in an encrypted database on your own machine. With a cloud service, four questions help: where the material is kept, for how long, who can access it, and when it is deleted.
Sources
- vpnMentor: Online AI Mental Health and Addiction Treatment Provider Exposed Patient Data
- Bitdefender: Confidant Health Data Breach: Thousands of Patient Therapy Sessions and Patient's PII Exposed in an Unsecured Database Online
- HIPAA Journal: Researcher Identifies Exposed Database Containing Mental Health and Substance Abuse Treatment Information
This article is based on the public sources listed. If you find a mistake, write to us: [email protected]