Social Engineering in Hospital Records

When security testing involves more than just software patches and firewall rules, the most vulnerable point often remains the human element. A recent report detailing a physical security engagement at a hospital demonstrates that even robust electronic access control systems can be bypassed through targeted social engineering and effective situational improvisation.

The Psychology of Access

Red teamer Dahvid Schloss, tasked with retrieving a specific physical file from a secure hospital records room, opted to bypass technical controls like electronic locks and badges entirely. Instead of attempting to replicate access credentials, he utilized a calculated approach involving professional attire and a pre-planned narrative designed to establish immediate rapport with the staff member guarding the entrance.

By adopting the persona of a frustrated staff member, Schloss exploited common interpersonal dynamics to gain entry without valid authorization. His strategy relied on researching the facility's staff to identify a specific physician whose reputation for being difficult allowed him to foster a sense of solidarity with the attending nurse.

I'm doing fine, hon. How you doing. Look, I'm gonna save you the details. But Dr Johnson's being an absolute asshole right now; he didn't pull out his patient records that he was supposed to pull out for trauma. We need these records, and they sent me down here. I'm brand new. I just started yesterday.

— Dahvid Schloss, red teamer

The nurse, familiar with the doctor's reputation, validated the claim and provided access to the restricted area. Schloss maintained his cover for an additional 10 minutes, further solidifying the interaction before successfully departing with the target file.

Medical Network Exposure

Beyond physical access, the assessment identified critical failures in internal network segmentation. During testing at another facility, the guest network provided an entry point into the hospital's internal infrastructure, revealing a flat network architecture that lacked appropriate isolation for sensitive medical equipment.

• VLAN 1 contained both guest traffic and critical hospital devices.
• Medical data from MRI machines was transmitted unencrypted over the network.
• Sensitive PII including Social Security numbers and birth dates were accessible to anyone on the guest Wi-Fi.

Infrastructure Priorities

The findings suggest that hospitals often prioritize system uptime and the rapid distribution of medical data over security hygiene. In environments where technical delays could potentially affect patient outcomes, security measures that impede the rapid access to data or devices are frequently bypassed or ignored by institutional policies.

Implications for Institutional Security

This incident underscores the reality that technical safeguards are incomplete without rigorous physical access procedures. Organizations that rely on the assumption that personnel will correctly enforce entry policies based on visual cues or badge checks may be ignoring the efficacy of social engineering. For the healthcare sector, the challenge remains in balancing the critical need for immediate data availability with the necessity of ensuring that only authorized individuals can interact with sensitive physical and digital assets.