Summary of Activities and Projec

Summary of Activities and Projects in 2008

January 29, 2008 - In my capacity as a volunteer data entry operator, I received an email forwarded by the Director of the Senior Outreach Program from the Nutrition Specialist mandating that effective March 1, 2008, the Social Assistance Management System (SAMS) be used to track client information from the new "Nutrition Screening Form" that all programs had been required to implement by January 1, 2008.

Data entry instructions were located at: http://dhfsbadr.org/docs/sams/nutritioncheck/. That Website appeared to me to be an official site of Department of Health and Family Services (DHFS) Bureau of Aging and Developmental Resources (BADR), but as I was to find out, was actually a site privately owned by the SAMS' system administrator. The intended use of the tracking system was to show nutrition "outcomes" at both the local and state levels.

January 31, 2008 - I sent an email to the Nutrition Specialist and SAMS system administrator telling of the visceral reaction I experienced that the SAMS' tracking process violated my rights to privacy. I attached a DHFS form that followed proper protocol as to specifying the law underlying the form and the consequences that would follow if the form was not completed.

February 18, 2008 - While working as a volunteer data entry operator, I inadvertently gained access and control of the Web programs and host computers at Harmony Inc.’s data centers. Security holes had already been identified by the current systems administrator and–as I recently found–by a systems installer, as recorded in his service order notes, dated 3/24/2004. In a list of the top ten security flaws in Web programs, the security hole I inadvertently found is described as, “Broken access control – in which restrictions on authorized users are not enforced.” Cyber thieves are well aware of semantic technologies and crawl the Web looking for such vulnerabilities.

The following letters and documents will form the basis for a case study (which I hope to complete by January 2010) concerning the failure of the federal Administration on Aging (AoA) to take the lead in defining a minimum data set (MDS) and in setting security requirements for Older American Act Programs. AoA’s failure has resulted in Wisconsin’s State Unit on Aging (SUA) and Dane County’s Area Agency on Aging (AAA) in configuring a software-as-a-service (SaaS) system in such a way as to systematically deprive the elderly and disabled of their constitutional rights to privacy. Both Wisconsin’s SUA and Dane County’s AAA are currently implementing an electronic record tracking system that ignores and violates both state and federal privacy laws.

Letter to: Rea Holmes, Executive Assistant, DHFS and Tonya Harmon, CEO, Harmony Inc.

BADR's Privacy Statement - 071508

Attachments:

1-ScreenShotsRemoteAccess.pdf

2-HolmesHarmonLetters.pdf

3-FairfaxCountyAudit2006.pdf

4-OpenRecordsRequest.pdf

Open Records:

5-Nutrition Committee Minutes.pdf

6-BADR’s Contract for the Social Assistance Management System (SAMS).pdf

7-Minutes of DHFS Data Stewardship Council.pdf

Other Records: