Several federal lawsuits filed in Cleveland claim a company that connects patients in Ohio to providers of medical marijuana cards exposed nearly one million patient records online. The six lawsuits allege Ohio Medical Card, also known as Ohio Medical Alliance, revealed social security numbers, medical records and mental health evaluations. Jeremiah Fowler, a cyber security researcher, stated in a blogpost that he informed the company about the accessibility of the database. Records he provided appear to show one patient's weight, body mass index, medications, anxiety diagnosis and other diagnoses, as well as her address.
Fowler blurred and redacted the images to protect the person's identity before sharing the screenshots. The state's Division of Cannabis Control confirmed Tuesday it referred a complaint to the State Medical Board of Ohio.
Attorney Marc Dann represents a Columbus woman who filed suit after Fowler found the information and notified people. He said the issue is particularly worrisome because it also revealed people as cannabis users.
"Look, any private data people don't want to share with everybody in the world. But certainly people who use marijuana, there's still some controversy about that," Dann said. "And there are health issues that are associated with that that are protected under HIPAA. And so it makes these data breaches particularly more worrisome."
Read more at WOSU Public Media
