Pennsylvania reveals cyber intrusion in birth, death records
Pennsylvania officials disclosed on Friday that they recently had to shut down the state's online system for requesting birth and death records for about a week after someone with apparent inside knowledge made unauthorized changes.
State officials told The Associated Press the changes were "cosmetic modifications" but the intrusion triggered an extensive cyber investigation.
Office of Administration spokesman Dan Egan said the agency "confirmed that no breach of data occurred."
"No records were viewed, altered, created or deleted," he said. "We are working with law enforcement on the matter."
As a result, the Department of Health's computer system for vital records was offline from June 20 until June 26. Officials have not provided any more detail on the reported modifications to the site.
In response to AP questions about potential hacking of the website, Egan said on Thursday the "system was taken offline for emergency maintenance due to performance issues." After follow-up inquiries, he disclosed on Friday the cosmetic modifications and police involvement.
The state's pace of issuing birth and death records has been criticized for being too slow, and the recently enacted state budget included $2.3 million to hire several dozen people to speed up the process.
The state currently estimates it takes up to three weeks to fill online requests for birth certificates for those born since 1967 but 15 to 30 weeks for records that are older than that. Death records currently take nine to 36 weeks.
The Department of Health said the volume of requests and insufficient manpower has created a chronic backlog of requests, particularly for the older records, which have been digitized but are not electronically searchable.
"This has been something that's been going on for years, not just several months," Department of Health spokeswoman April Hutcheson said.
Pressure on the system is expected to increase with the rollout of the REAL ID Act , a 2005 federal law that mandates security enhancements for state driver's licenses and identification cards.
Prompted by constituent complaints, lawmakers took up the issue of birth and death certificate processing this spring, including a Feb. 6 House Health Committee meeting at which Health Secretary Rachel Levine testified about steps that have been taken or were in the works to address the problem. The agency is revamping its forms and changing when and how it rejects requests.
It also has bolstered training and is working to educate people about the best ways to request the records.
State Rep. John Lawrence, R-Chester, sponsored a related bill that overwhelmingly passed the House two days before the cyber intrusion caused the site's shutdown.
"I think many legislators would agree with me — we've been having a lot of folks in our offices, a lot of constituents on our offices who have had trouble getting birth certificates," Lawrence said.
Lawrence's bill would study problems with access to vital records, direct part of the fee to run the request system and expand who may issue birth certificates. The proposal is pending in the Senate.