Archive — US — techcrunch
Dental practice software maker fixes bug that exposed patients’ medical records
Practice by Numbers fixed a security vulnerability in its dental practice software that exposed patients' health records. Reported by patient Joseph R. Cox, the flaw allowed any user to access other patients' documents via the patient portal. The company acknowledged the issue and has since implemented fixes while promising to establish better channels for security reports.
Key points
- Joseph R. Cox discovered a bug in Practice by Numbers' portal that let users access others' health records.
- The bug was easy to exploit; changing document numbers in the URL allowed access to different patients' files.
- Cox struggled to report the issue due to broken communication channels at the company.
- TechCrunch intervened on April 13, leading the company to fix the flaw and take down the portal temporarily.
- Practice by Numbers notified fewer than 10 affected patients and is exploring a formal security reporting process.
Why it matters
- This incident reflects a growing trend where consumers find and report security flaws due to insufficient company response channels.
- Similar cases include fashion retailer Express and Home Depot, which faced backlash for ignoring security vulnerability reports.
- By 2025, the IT landscape continues to highlight the necessity for robust cybersecurity measures, particularly in health tech, where personal data is sensitive.
The incident underscores the critical need for companies in sensitive sectors to establish clear communication channels for security issues and conduct thorough security audits before product deployment.