Why Healthcare Security Matters

guest · Jul 18, 2019

The biggest medical data breaches in history
July 18, 2019
https://www.comparitech.com/blog/vpn-privacy/biggest-medical-data-breaches/

In April 2019, healthcare data breaches reached a record high. And for the past four years, the healthcare field has had the second highest number of breaches as compared to other industries. In total, almost 10 million records were exposed in US healthcare breaches in 2018 alone.
The prevalence and size of medical data breaches is highly concerning, especially when you consider that much of the breached information can be valuable to criminals.

The effects of medical insurance fraud on victims include large financial losses, poor credit rating, and limited access to urgent healthcare. What’s more, medical data often comes packaged with personal information, including Social Security numbers (SSNs), as well as financial information.

In this post, we reveal the biggest medical data breaches in history. Breaches in which 1.5 million records or more were exposed made it to the list. We’ve listed the incidents in chronological order, starting with the most recent. [...]
Click to expand...

ronjor · Jul 19, 2019

Amazon threatens to sue major pharmacy player if it prevents PillPack from accessing patient drug data

Christina Farr@chrissyfarr 19 July 2019
Amazon’s PillPack is considering legal action against Surescripts and other drug supply-chain players in a dispute over patient health data.
PillPack was informed this week that it will soon be cut off from patient medication data, a move that would seriously complicate its business, according to people familiar with the matter.
It’s Amazon’s biggest dispute with the pharmacy industry since it bought PillPack in June 2018.
Click to expand...

guest · Jul 20, 2019

Phishing Attack Aimed at Stealing Payroll Deposits
Healthcare System's Procedures Helped Prevent the Crime
July 19, 2019
https://www.databreachtoday.com/phishing-attack-aimed-at-stealing-payroll-deposits-a-12804

A Texas-based healthcare system says hackers unsuccessfully tried to divert employee payroll direct deposits through a phishing attack that also potentially exposed patient data. The incident illustrates how business processes can help avert theft.

Decatur, Texas-based Wise Health System, which employs 1,900 and includes a medical center, several clinics and specialty care facilities, says an email phishing campaign was launched against its staff on March 14.

"Unfortunately, a few of Wise Health System's employees provided their usernames and passwords in response to this phishing email," the organization says in a statement. "Once these usernames and passwords were obtained, the intruders used the information to access the employee kiosk in an attempt to divert payroll direct deposits."
Safeguards Play Important Role
"Treat an employee portal or kiosk like an ATM machine at the bank," he advises. "Require multifactor authentication as the authorization for handling sensitive transactions."
Click to expand...

guest · Jul 22, 2019

AMCA Breach: Many More Impacted Healthcare Firms Come Forward
July 22, 2019
https://www.securityweek.com/amca-breach-many-more-impacted-healthcare-firms-come-forward

All of the organizations used the same press release template, with the only difference being the number of impacted patients and the phone number that people can call for more details.
For some patients, the attackers gained access to their name, address, phone number, date of birth, dates of service, balance information, payment card or banking information, and treatment provider information. Others had the same information compromised, but without the payment card and banking information.

The breach at AMCA, which is also known as Retrieval-Masters Creditors Bureau, came to light in early June when two of its biggest customers, Quest Diagnostics and LabCorp, filed 8-K forms with the U.S. Securities and Exchange Commission (SEC).
Click to expand...

The list of affected firms that came forward last week includes American Esoteric Laboratories (534,500 impacted and another 7,400 with financial data), Sunrise Medical Laboratories (412,000 impacted and 15,000 with financial data), CBLPath (145,100 impacted and 3,800 with financial data), Laboratory Medicine Consultants (143,400 impacted and 4,200 with financial data), Austin Pathology Associates (44,700 impacted and 1,800 with financial data), South Texas Dermatopathology (14,900 impacted and another 1,200 with financial data), Pathology Solutions (12,700 impacted and 600 with financial data).

The list of companies that had less than 10,000 impacted patients includes Laboratory of Dermatopathology ADX (4,000 patients impacted and another 240 with financial data compromised), Seacoast Pathology (9,200 impacted and 800 with financial data), Western Pathology Consultants (4,200 impacted and 350 with financial data), Arizona Dermatopathology (6,500 impacted and 500 with financial data), and Natera (unknown number of impacted patients).

Clinical Pathology Laboratories (CPL) also reported last week that 2.2 million of its patients had personal information stolen and another 34,500 had financial information compromised.

guest · Jul 24, 2019

Maitland dentist office threatened with $20,000 ransomware
Accounting records encrypted, locked
July 23, 2019
https://www.clickorlando.com/news/maitland-dentist-office-threatened-with-20000-ransomware

Dr. Carl Bilancione said all of his Quickbooks accounting files were encrypted and a pop-up screen instructed him to pay $10,000. Every 48 hours, the ransom would double, according to the message.

"What the IT people ascertained is that these are not the most brilliant hackers in the world, they buy a kit and send out this information and hack your computer and when they see somebody has Quickbooks they know it's a business," Bilancione said. "That's the key."
Although five months-worth of accounting files were taken during the hacking, Bilancione assured that all patient records are safe and untouched, stored separately on a secure system.

Lemma said 19 businesses across Seminole County have reported ransomware attacks since 2018. Nine this year.

"You could be out of business, how do you operate without your accounting files," Bilancione said.
Bilancione believes hackers got into his system when someone in his dental office opened an unknown attachment.
Click to expand...

guest · Jul 24, 2019

June 2019 Healthcare Data Breach Report
July 24, 2019
https://www.hipaajournal.com/june-2019-healthcare-data-breach-report/

For the past two months, healthcare data breaches have been reported at a rate of 1.5 per day – Well above the typical rate of one per day. In June, data breaches returned to more normal levels with 30 breaches of more than 500 healthcare records reported in June – 31.8% fewer than May 2019.

While the number of reported data breaches fell, June saw a 73.6% increase in the number of health records exposed in data breaches. 3,452,442 healthcare records were exposed in the 30 healthcare data breaches reported in June.
Largest Healthcare Data Breaches in June 2019
The increase in exposed records is due to a major breach at the dental health plan provider Dominion Dental Services (Dominion National Insurance Company). Dominion discovered an unauthorized individual had access to its systems and patient data for 9 years.

9 of the ten largest healthcare data breaches in June were hacking/IT incidents and the top six breaches involved network servers. Three email security breaches and one improper disposal incident round out the top ten. [...]
Click to expand...

guest · Jul 25, 2019

Computer issues continue at Springhill Medical Center
July 23, 2019
https://mynbc15.com/news/local/springhill-medical-center-allegedly-hacked-again

Springhill Medical Center employees tell NBC 15 their system has allegedly been hacked again.
This comes a week after the hospital released a statement confirming their IT department found a virus.

"Now there is a ransom this is what I have been hearing from people in high places at the hospital there is ransom in return for money then they will leave the hospital alone," says our source.
"It's effected everything in the hospital, payroll, nothing works, no computers work everything is confusing. It's terrible. Everything is haywire," says our source.

Two weeks ago NBC 15 learned of the first alleged cyber hack. Last week, they installed a new system. It was immediately hacked again," they say.
Click to expand...

Springhill Medical Center victim of ransomware attack
July 24, 2019
https://mynbc15.com/news/local/mobile-police-springhill-medical-center-was-victim-of-cyber-attack

Mobile Police have confirmed to NBC 15 that Springhill Medical Center has been the victim of a cyber-attack.
Investigators say the attack is the form of a ransomware and was possibly introduced into the computer system through an email.
Click to expand...

guest · Jul 25, 2019

Hospital still mum on ransomware attack
July 24, 2019
https://www.thedailyworld.com/news/hospital-still-mum-on-ransomware-attack/

Grays Harbor Community Hospital officials are still unwilling to give out any details about the computer hack that has left the hospital and its clinics unable to access some of the district’s stored information for at least a month.
In a ransomware attack, hackers encrypt information so that the targeted organization can’t access it without paying for the encryption codes.

Bruce said they’ve been advised not to talk about it while an investigation continues.
Hospital CEO Tom Jensen said the hospital has insurance, but has been advised not to say anything for now.

A major question will be whether or not patient information is no longer secure. Another question is whether the local medical community will be able to regain access to all the records they need for continued treatment.
One person in the audience said she just wants to know what’s going on with the hack and what information is compromised. “As a public entity, you’re required to give information to the public,” she said.
Click to expand...

guest · Jul 26, 2019

Park DuValle health center pays $70,000 ransom for patient records in cyberattack
July 25, 2019
https://www.wdrb.com/in-depth/park-...cle_68416546-af0b-11e9-ba4d-0bd49b023c3e.html

Park DuValle Community Health Center, a nonprofit that runs medical clinics for low-income and uninsured patients in western Louisville and other areas, has paid hackers nearly $70,000 in hopes of unlocking the medical records of some 20,000 patients that have been held hostage for nearly two months.

For the last seven weeks, Park DuValle’s four clinics have been unable to make appointments and have had to rely on patients’ memories about previous treatments and medications. They’re writing it all down on paper and storing files in boxes.
She stressed, however, that the hackers did not obtain the patients’ information, even though they succeeded in walling off the records from Park DuValle’s own personnel.

Park DuValle suffered an earlier ransomware attack on April 2, losing access to its records for about three weeks, she said.
After the first attack, the organization rebuilt the records system using data that had been “backed up,” or stored elsewhere, and declined to pay the hackers.
But that option was not available when hackers struck again in June, Hagan-Grigsby said.
Click to expand...

guest · Jul 26, 2019

mood said: ↑

Maitland dentist office threatened with $20,000 ransomware
Accounting records encrypted, locked
July 23, 2019
https://www.clickorlando.com/news/maitland-dentist-office-threatened-with-20000-ransomware
Click to expand...

'Survivor' Lessons from an Attack on Dental Practice
Florida Dentist Describes Recovering from Ransomware Attack
July 26, 2019
https://www.inforisktoday.com/blogs/survivor-lessons-from-attack-on-dental-practice-p-2779

Dentist Carl Bilancione is a survivor in more ways than one, including surviving a recent ransomware attack.

So instead of paying the ransom, the practice is having its accountant restore the last five months of lost data. Not great, but much better than shelling out thousands of dollars to cybercriminals, he says.

"These attackers buy kits that target QuickBooks," he says. "We have firewalls, back up and other security precautions, and we were still hit," he says.
Lessons to Learn
One of the lessons he hopes other smaller healthcare practices - and for that matter, all small businesses, including those run out of homes - is to realize that they too are in the crosshairs of attackers, and must be ready to defend against the threats, he says.

"Make sure your data is being backed up daily, not once a week or once a month," he says. Maitland Dentistry is also setting up new policies, including having any online purchasing done only on a dedicated computer that's segregated from the rest of the office's network, he says.
Click to expand...

guest · Jul 29, 2019

Two Hospitals in Puerto Rico Suffer Ransomware Attack
press release

As a precautionary measure, Bayamón Medical Center y Puerto Rico Women And Children’s Hospital (collectively, the “Hospitals”) would like to notify the community that the Hospitals faced a recent security incident which potentially involves personal information of the Hospitals’ patients.

As a result of of our investigation, the Hospitals believe that the records were simply encrypted and there is currently no indication that the information itself has otherwise been used by any unauthorized individual.
[...] we have updated certain technical, administrative and physical safeguards to ensure the security and confidentiality of your data in the future".
Click to expand...

guest · Jul 29, 2019

Surescripts Cuts Off Vendor to Amazon Unit, Citing Misuse
July 29, 2019
https://www.bloomberg.com/news/arti...pact-with-vendor-to-amazon-unit-citing-misuse

Surescripts, which is partially owned by two of the largest pharmacy-benefit managers, said in a statement Monday it has alerted the FBI and stopped its vendor, ReMy Health, from accessing its network.
Surescripts accused ReMy of breaking the terms of their contract by providing information about patients’ medication history improperly. That information, which resides in Surescripts’ systems, is supposed to be shared only with medical providers when delivering care or planning a patient’s discharge, Surescripts said.

The contract termination is the latest twist in an ongoing fight between established players in the pharmacy supply chain and Amazon, which threatens to disrupt it.
Click to expand...

guest · Jul 29, 2019

mood said: ↑

Two Hospitals in Puerto Rico Suffer Ransomware Attack
press release
Click to expand...

A little bit more info about the attack:
Ransomware Attack Impacts 522,000 Patients in Puerto Rico
July 29, 2019
https://www.inforisktoday.com/ransomware-attack-impacts-522000-patients-in-puerto-rico-a-12848

A Puerto Rico-based medical center and a related women and children's hospital are victims of a recent ransomware attack impacting the data of more than 522,000 individuals. The combined incident is currently the largest health data breach reported to federal regulators this year involving ransomware.

Bayamón Medical Center reported the incident as impacting nearly 422,500 individuals and Puerto Rico Women and Children's Hospital reported the breach as affecting nearly 100,000 individuals.
Among Largest Breaches
To date, the incident reported alone by Bayamon Medical Center is the largest breach involving ransomware posted on the federal tally so far this year. The Bayamón incident report is also the fourth largest health data breach of any type posted on the HHS website so far in 2019.
Click to expand...

ronjor · Jul 30, 2019

These aging-in-place apps empower seniors to be safe, save money and get medical care

By Rae Hodge July 30, 2019
Roughly two-thirds of Americans 55 and older want to age in their homes -- and home care among seniors 68 and up accounted for 1.6 million houses held back from the market through 2018, according to Freddie Mac. The number of households in the 80-and-over age group will more than double by 2037, Harvard's Joint Center for Housing Studies says. The trends are clear: Boomers are aging in place, and technology can help them do it. And that means not moving to expensive care facilities.
Click to expand...

guest · Jul 30, 2019

How 4 IT technicians saved an Arizona hospital from hacker ransomware
July 30, 2019
https://eu.azcentral.com/story/news...are-wickenburg-community-hospital/1842572001/

A team of four IT professionals saved Wickenburg Community Hospital from paying a ransom to hackers.
Nelson, an information-technology technician for Wickenburg Community Hospital, found it glowing on a computer screen in the emergency department.

Nelson immediately sounded the alarm: The small non-profit Wickenburg Community Hospital, in a community of just under 8,000 residents, had been hit by a ransomware attack, and Nelson was having trouble accessing the hospital’s files.
So instead of seeing what the hackers wanted, Beckham said that Wickenburg’s IT staff, a total of four people, including himself, began rebuilding the hospital’s computer systems from scratch. [...]
Click to expand...

ronjor · Jul 30, 2019

Microsoft, Amazon, other tech giants forge ahead on healthcare data sharing pledge

by James Thorne on July 30, 2019 at 10:00 am
This past August, executives from Microsoft, Amazon, Google, IBM, Oracle, and Salesforce banded together to promote data sharing in healthcare. Nearly a year later, the world’s largest tech companies aren’t showing any signs of slowing.
Today, the tech giants renewed their commitment to healthcare data sharing standards with a new joint statement that highlighted the past year’s progress. They also put their weight behind a regulatory effort to update rules governing health data by the Office of the National Coordinator for Health Information Technology and the Centers for Medicare and Medicaid Services.
Click to expand...

guest · Jul 30, 2019

DirectTrust Launches Effort for Secure Instant Messaging
New Initiative Focused on Developing IM Standard for Healthcare
July 30, 2019
https://www.inforisktoday.com/directtrust-launches-effort-for-secure-instant-messaging-a-12857

DirectTrust, best known for creating and maintaining the Direct protocol-based security and trust framework for secure email messaging in healthcare, has kicked off a new initiative to develop industry standards for secure real-time instant messaging.

The goal of DirectTrust's Trusted Instant Messaging+, or TIM+ initiative, is to create a secure instant messaging standard for diverse healthcare providers to communicate with each other, as well as with patients, DirectTrust says in a statement on Tuesday.

A healthcare industry specific secure instant messaging standard "is critical to eliminating the risk of violating HIPAA and other privacy regulations, and for the storing and sharing of protected health information," says Scott Stuewe, DirectTrust president and CEO in the statement.
Click to expand...

guest · Jul 31, 2019

32 Million Breached Patient Records in First Half of 2019 Double Total for All of 2018
July 31, 2019
https://www.prnewswire.com/news-rel...9-double-total-for-all-of-2018-300894237.html

31,611,235 patient records were breached between January and June 2019, according to new data released today in the Protenus Breach Barometer.
Published by Protenus, an AI-powered healthcare compliance analytics platform that protects patient data for the nation's leading health systems, the Breach Barometer is the industry's definitive source for health data breach reporting.

There has been an increase in the number of disclosed incidents in the first half of 2019, with 285 incidents. Alarmingly, the number of affected patient records has doubled from 15M in the entirety of 2018 to 32M between January and June 2019. As first reported in 2016, a trend of at least one health data breach per day remains in 2019.
To download the full report, or for more information, please visit:
https://pages.protenus.com/2019-mid-year-breach-barometer-report
Click to expand...

guest · Jul 31, 2019

ronjor said: ↑

$74 Million Settlement of Premera Breach Lawsuits Proposed
Click to expand...

Judge Gives Go-Ahead for Settlement of Premera Breach Case
Health Insurer Must Spend $42 Million on Security Enhancements
July 31, 2019
https://www.inforisktoday.com/judge-gives-go-ahead-for-settlement-premera-breach-case-a-12865

A federal judge in Oregon has granted preliminary approval for a $74 million settlement of a consolidated class action lawsuit against health insurer Premera Blue Cross stemming from a 2014 data breach that affected 11 million individuals. More money will go to security enhancements than to victim reimbursement.

Under the settlement, Premera agrees to spend $42 million between 2019 and 2022 to bolster its data security. "Improved data security benefits all class members, even if they are no longer insured by Premera or a related Blue Cross entity, because sensitive information remains stored on Premera's servers," U.S. District Judge Michael Simon notes.

The judge also notes: "Plaintiffs have several strong arguments regarding the level of data security implemented by Premera, particularly in light of the internal and external audits that occurred before the data breach and the fact that the breach was able to go on for so long without being detected."
Click to expand...

guest · Jul 31, 2019

Healthcare Cybersecurity Tips to Help Protect Your Data
July 31, 2019
https://readwrite.com/2019/07/31/healthcare-cybersecurity-tips-to-help-protect-your-data/

Cybercrime is on the rise, and healthcare is becoming a primary target as per recent news. What is accounted as cybercrime at a medical practice? Anything from a hacker stealing protected health information for medical identity theft to a staff member viewing patient records without prior authorization. You’ll need healthcare cybersecurity tips to help protect your data.

To curb cybercrime and other security threats to the centralized database, there are nationwide legislations like HITECH (Health Information Technology for Economic and Clinical Health Act) and HIPAA (Health Insurance Portability and Accountability Act).
Patients and practice continuity are both vulnerable if precautions and necessary steps are not taken to protect data by practitioners. Leave no stone unturned for your own protection and reputation.

Here’s what can be done by a certain practice to avoid lawsuit/security breach: [...]
Click to expand...

guest · Aug 1, 2019

Healthcare Organizations, Is Your Patient Portal Secure?
July 31, 2019
https://www.workplaceprivacyreport....ures-are-insufficient-against-todays-attacks/

While healthcare organizations are embracing new technologies such as patient portals, a recent report shows that organizations’ cybersecurity measures for these technologies are behind the times.
With this increased access for patients comes the risk that someone other than the patient will gain unauthorized access to the portal, and to the patient’s electronic protected health information (ePHI).

In this environment where hackers find patient records a valuable commodity on the black market, healthcare organizations are must balance patients’ desire for ease of use with the duty to prevent unauthorized access to patient records.
Healthcare organizations are not required to adopt any one cybersecurity framework or authentication method under HIPAA, however increasing cybersecurity and implementing multifactor authentication for access to patient portals certainly helps with compliance under the HIPAA Security Rule.
Click to expand...

LexisNexis® Risk Solutions in collaboration with the Information Security Media Group conducted a survey in spring 2019 asking healthcare organizations about their cybersecurity strategies and patient identity management practices.
The results of the survey, which included responses from more than 100 healthcare organizations, including hospitals and physician group practices, were recently published in a report, “The State of Patient Identity Management” (the “report”).

The report concluded that healthcare organizations had a high level of confidence in the security of their patient portals, but this confidence may be misplaced based upon the security measures respondents reported they had in place.
Click to expand...

guest · Aug 2, 2019

Imperial Health Ransomware Attack Impacts More Than 111,000 Patients
August 2, 2019
https://www.hipaajournal.com/imperial-health-ransomware-attack-impacts-more-than-111000-patients/

Imperial Health, a physicians’ network serving patients in Southwest Louisiana, is alerting more than 111,000 patients that some of their protected health information has potentially been compromised in a recent ransomware attack.

The database contained the protected health information of 116,262 patients. While no evidence of data access or data theft was uncovered during the investigation, it was not possible to rule out a breach of PHI. The decision was therefore taken to issue notifications to affected patients to allow them to take step to eliminate any risk of harm.
The information stored in the database related to patients who had previously received medical services at CFO.
Click to expand...

guest · Aug 2, 2019

Patient horrified after medical information left at curb outside London walk-in clinic
Doctor admits it was a mistake as staff from Ontario's privacy commissioner investigate
July 31, 2019
https://www.cbc.ca/news/canada/london/doctor-patient-records-1.5225532

Ontario's information and privacy commissioner is investigating after a clear plastic bag containing documents with patient names and medication information was left at the curb outside a London walk-in clinic.
"I'm upset that they've done this," Jennifer Ebel told CBC News. "You put responsibility on the medical profession to ensure your privacy is upheld and there are laws to state that they must be upheld. I would love to know why this happened."

The bag was discovered by a staff member from MyCare pharmacy, which is located next door to Clinicare in the small shopping plaza.
"They just tore the script in half and left my medical records visible," said Ebel. "I want to know what they can do to ensure that no one can steal my identity."

"This should not have happened," Muhammad said. "I talked to my staff this morning and we have started implementing that no paper with patients' name should go out without going through the shredder."
Click to expand...

guest · Aug 2, 2019

mood said: ↑

DirectTrust Launches Effort for Secure Instant Messaging
New Initiative Focused on Developing IM Standard for Healthcare
July 30, 2019
https://www.inforisktoday.com/directtrust-launches-effort-for-secure-instant-messaging-a-12857
Click to expand...

Standard Would Enable Instant Messaging Among EHR Platforms
DirectTrust CEO Scott Stuewe Describes ANSI-Accredited Standard Development Effort
August 2, 2019
https://www.inforisktoday.com/inter...-instant-messaging-among-ehr-platforms-i-4408

DirectTrust's new effort to develop a standard for instant messaging in healthcare could potentially help providers securely communicate in real time over multiple platforms, says Scott Stuewe, the nonprofit alliance's president and CEO.

"We've been involved in this conversation for some time," he says. "What's different today is that we have an ANSI-accredited standards development organization that can be a place to take this process forward."
IM for EHRs
Once it's developed, the new TIM+ standard would enable that communication among EHRs "as well as to the independent platforms, like Skype or commercial products that are available in different settings," he says. Such communication could support timely treatment decisions.

DirectTrust hopes to take advantage of the same basic security components that are part of Direct email messaging as it develops the new secure instant messaging standard, Stuewe explains.
Click to expand...

guest · Aug 3, 2019

Presbyterian data breach affects some 183,000 patients
August 2, 2019
https://www.abqjournal.com/1348856/...fo-but-do-not-seem-to-have-used-anything.html

Presbyterian Healthcare Services reported a data breach that allowed unauthorized access to personal information belonging to around 183,000 patients and health plan members.

Melanie Mozes, spokeswoman for Presbyterian, said the breach allowed access to names, dates of birth, Social Security numbers and other types of information after a Presbyterian employee responded to a “phishing” scam designed to gain access to private information. Mozes added that most of the victims were New Mexico residents.
She said the health care provider doesn’t believe any of the information has been used in any way.

Mozes said Presbyterian became aware of the incident on June 6, and responded by securing and reviewing the affected email accounts and letting federal law enforcement know about the data breach.
[\quote]
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches