HL7 Patient Merge Unauthenticated Reassignment Vulnerability

Executive Summary

This vulnerability allows a remote attacker to merge patient identities in a medical imaging archive system without authentication. The HL7 listener accepts patient-merge messages and reassigns studies and workflow records from one patient to another, which cannot be reversed by the archive's unmerge function.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring HL7 ADT^A40 patient-merge messages on your network. Check for unauthenticated messages from unexpected sources. Inspect HL7 listener logs for merge operations without proper authentication. Verify if archive unmerge functions correctly to reverse unauthorized merges.

Useful 0 Not Useful 0

Impact Analysis

An attacker could manipulate patient records, causing incorrect data associations in medical studies or workflows. This may lead to misdiagnosis, improper treatment, or loss of critical medical history integrity for affected patients.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates patient data integrity and access control requirements under HIPAA and GDPR. It enables unauthorized modification of patient records, compromising compliance with data accuracy and security provisions in these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable or restrict ADT^A40 patient-merge message handling in the HL7 listener configuration. Implement authentication for HL7 message senders to prevent unauthorized access. Review and audit patient identity assignments to detect unauthorized changes.

Useful 0 Not Useful 0