Practice by Numbers, the developer of a patient management software used in thousands of dentist’s offices, has fixed a security flaw that exposed the private health records of patients on a portal that comes bundled with the software, TechCrunch has learned.
One patient, Joseph R. Cox, reported the bug to TechCrunch after he encountered the issue while looking at his own dental records on the portal, which was offered by his dentist’s office.
This patient portal is part of a dental office management software made by Practice by Numbers, which claims its products are used in over 5,000 dental practices across the United States.
Cox said the bug allowed any user of the portal, which houses patients’ medical documents and health records, to access documents belonging to other patients. He said he was able to access other patients’ documents from his account, including their personal information, medical histories, photo identification, and other files. The bug also meant that Cox’s records were just as exposed to other patients.
Cox said he attempted to alert the company about the issue via email, but did not hear back. He then notified TechCrunch as a last resort to ask the company to patch the bug.
The bug was remarkably easy to exploit by anyone with a login to the Practice by Numbers’ patient portal. Cox said changing the document number in the web address while loading one of his documents in the portal allowed users to access other patients’ files.
Worse, Cox said the document numbers in the web address appear to be sequentially incremental, so it could be possible to easily guess the document numbers of other people’s medical files.
Cox told TechCrunch that he faced difficulties in alerting Practice by Numbers to the issue, as the company offered no discernible avenue to report security problems. The company’s email address on its website was broken, with emails returned …