This Article Full Text Full Text (PDF) All Versions of this Article: M2352v1 14/4/397    most recent Submit a response Alert me when this article is cited Alert me when eLetters are posted Alert me if a correction is posted Services Similar articles in this journal Similar articles in PubMed Alert me to new issues of the journal Download to citation manager Citing Articles Citing Articles via Google Scholar Google Scholar Articles by Wright, A. Articles by Sittig, D. F. Search for Related Content PubMed PubMed Citation Articles by Wright, A. Articles by Sittig, D. F.

Encryption Characteristics of Two USB-based Personal Health Record Devices

^a Department of Medical Informatics and Clinical Epidemiology, Oregon Health & Science University, Portland, OR
^b Department of Medical Informatics, Northwest Permanente, PC, Portland, OR.

^_* Correspondence and reprints: Adam Wright, Department of Medical Informatics and Clinical Epidemiology, Oregon Health & Science University, 3181 Sam Jackson Park Rd., Portland, OR 97239 (Email: wrightad{at}ohsu.edu).

Received for publication: 12/15/06; accepted for publication: 04/13/07.

Personal health records (PHRs) hold great promise for empowering patients and increasing the accuracy and completeness of health information. We reviewed two small USB-based PHR devices that allow a patient to easily store and transport their personal health information. Both devices offer password protection and encryption features. Analysis of the devices shows that they store their data in a Microsoft Access database. Due to a flaw in the encryption of this database, recovering the user’s password can be accomplished with minimal effort. Our analysis also showed that, rather than encrypting health information with the password chosen by the user, the devices stored the user’s password as a string in the database and then encrypted that database with a common password set by the manufacturer. This is another serious vulnerability. This article describes the weaknesses we discovered, outlines three critical flaws with the security model used by the devices, and recommends four guidelines for improving the security of similar devices.