How To Prevent Data Breaches: The Confidant Health Breach

Imagine a world where mental health support is instantly available—where therapy, guidance, and a listening ear are easily accessible through a secure app. That’s what Confidant Health promises. Known for its innovative approach to mental health and addiction treatment, the platform prides itself on blending human connection with AI-driven technology. But when security is unimposed, even the most well-intentioned services can leave users vulnerable. This is precisely what happened when Confidant Health became the latest company to deal with a cybersecurity breach.

Who Is Confidant Health?

Confidant Health is a virtual health clinic that was founded to make mental health and addiction recovery services more accessible. They offer services like psychiatric evaluation, online therapy, prescriptions for certain medications, and treatment for alcohol and drug addiction. 

Confidant Health serves more than 6000 clients, with 5 states (Texas, Virginia, Florida, New Hampshire, and Connecticut) in their service network. Confidant Health has found notable success as a small company, but with great power comes great responsibility. With the trust and confidence that Confidant Health’s clients put in them, they are responsible for safeguarding their clients’ privacy to the highest standards. 

The Breach: What Happened?

In early September, a significant security breach was uncovered when Jeremiah Fowler, a cybersecurity researcher, discovered an unsecured database belonging to Confidant Health. This vulnerability was the result of a misconfigured server—a misstep that occurs when server configurations are improperly set up, leading to severe security risks.

The breach revealed a staggering 5.3 terabytes of personal information accessible online without any login credentials. Approximately 126,000 files were available for public viewing, including sensitive data such as names, addresses, social security numbers, and medical treatment records. Alarmingly, these files included highly sensitive audio and video recordings of therapy sessions, along with driver’s licenses and government IDs used for identity verification. This exposure affected not only patients but also therapists and healthcare professionals associated with Confidant Health.

Upon notification of this significant security lapse, Confidant Health acted swiftly to restrict access to the database. However, it remains unclear how long the data was exposed or how many individuals accessed it during that time. 

The implications of this incident are particularly concerning, given that Confidant Health serves a vulnerable population—individuals struggling with addiction and mental health issues. By exposing their data, Confidant Health jeopardizes not just their privacy but also their mental well-being. In the wrong hands, this sensitive information could lead to blackmail or identity theft, posing a severe threat to the affected individuals’ overall welfare.

At its core, the Confidant Health breach reveals a vulnerability that plagues many tech platforms today: the rush to innovate often outpaces the time spent securing these innovations. An industry like the medical field that deals with data of this sensitivity should have every precaution possible in effect to protect it. 

If Confidant Health had balanced its focus on user engagement with equal attention to data security, this breach might have been avoided. Fundamental measures like regular software updates, encrypted file storage, and multi-factor authentication could have mitigated the risk of such breaches. Hindsight is always 20/20, but patient privacy should take the forefront when it comes to anything involving confidential data. 

How To Best Prevent a Breach

Though many precautions exist to deter breaches, only redaction fully prevents them. Redaction hides sensitive information by blurring, blacking out, or muting it, successfully preventing unauthorized access to the confidential data.

While this doesn’t change the fact that people could access these records, it could change how much of the records the people accessing them could see. With Personal Identifiable Information (PII) like names, addresses, phone numbers, or pictures redacted, it wouldn’t matter who accessed the system because all identifiable or sensitive data would be covered up.

Many redaction tools today use AI to detect and hide information based on predefined rules. If Confidant Health had employed such tools, it’s likely the damage could have been minimized—limiting the exposure of their users’ sensitive mental health data.

Breach After Breach: A Broader Pattern in Healthcare

The Confidant Health breach, while shocking, is unfortunately not an isolated incident. Healthcare data breaches have been on the rise for years. The healthcare sector is one of the most targeted by cybercriminals, with high-profile breaches hitting companies like UCLA Health, Anthem, and LabCorp over the past few years.

In 2023 alone, healthcare breaches accounted for 20% of all reported data breaches. The reason is clear: healthcare data is valuable. It includes not only PII but also health insurance details, medical histories, and prescription information—making it highly desirable for identity theft, insurance fraud, and blackmail.

In some cases, the impact of healthcare breaches goes beyond the digital realm. For instance, in 2019, a cyberattack on Universal Health Services forced the hospital chain to revert to manual record-keeping for weeks, delaying patient care and causing widespread disruption.

Looking Forward: What’s Next for Digital Healthcare?

The Confidant Health breach is a wake-up call—a reminder that as we digitize healthcare, we must also fortify it. As healthcare inevitably becomes digital, securing these platforms is crucial for the safety of the people utilizing them.

Organizations must invest in robust cybersecurity frameworks, including regular software updates, encryption, redaction tools, and multi-factor authentication. Additionally, transparency with users is crucial; individuals must be made aware of how their data is stored, protected, and used.

While Confidant Health will likely recover from this breach, the incident highlights the importance of trust in digital healthcare. It’s a trust that takes years to build but can be swiftly undone. For the sake of users’ mental health, their privacy, and the future of digital care, we must all learn from these breaches—and do better.

The Confidant Health breach serves as both a cautionary tale and a challenge. It reminds us of the vulnerabilities lurking in our digital age, especially in sectors as sensitive as mental health. It challenges companies to rethink their approach to data security, emphasizing that convenience should never come at the cost of user protection.