Why Healthcare Security Matters

guest · Aug 15, 2019

NCH Healthcare System faces email phishing attack; hires investigator
August 15, 2019
https://eu.naplesnews.com/story/new...email-phishing-attack-warns-staff/2012539001/

The NCH Healthcare System is investigating a data security breach in which an unauthorized entity gained access to some employees’ email accounts, according to hospital officials.
NCH became aware June 14 of suspicious activity related to its payroll system and launched an investigation.

An outside forensic investigation team was hired and determined in early July that some employees fell victim to an email phishing scheme. It enabled an “unauthorized actor” to gain access to certain NCH employee email accounts, according to a notice NCH posted to its website.
The forensic team found the unauthorized entity could have accessed data in email accounts at the time of the incident.
Click to expand...

guest · Aug 15, 2019

Cleaning Up After Ransomware Attacks Isn't Easy
August 15, 2019
https://www.inforisktoday.com/cleaning-up-after-ransomware-attacks-isnt-easy-a-12921

The experiences of two healthcare organizations that are still recovering from recent ransomware attacks after they refused to pay a ransom illustrate the challenges these incidents pose long after the initial attack.
Difficult 'Clean Ups'
Organizations that refuse to pay a ransom and choose instead to recover from a ransomware attack by using backups and other methods need to be prepared for difficulties, some security experts note.

"Recovery from a ransomware attack is not trivial," says former healthcare CIO David Finn, executive vice president at security consultancy CynergisTek.
Treating patients during the period when data in systems is inaccessible can prove difficult, he notes.
Restoration Work
"Large amounts of data requiring restoration from backups can take days to restore, based on the method and age of technology used to do the backups," he adds.
When it comes to recovery plans, "don't make assumptions that your backup plans or operational plans are foolproof - try them out and then know, even if they work, unexpected things will happen during the ransom or any event," Finn adds.
Click to expand...

Krusty · Aug 15, 2019

mood said: ↑

Cleaning Up After Ransomware Attacks Isn't Easy
Click to expand...

Really? Doesn't restoring from a recent image solve that problem?

guest · Aug 16, 2019

Stolen Medical Records Lead to Patient Identity Theft
AARP's fraud expert shares how to secure your personal health data
August 15, 2019
https://www.aarp.org/money/scams-fraud/info-2019/medical-records-identity-theft.html

The mail pile was predictably large when the Karpinsky family returned home from vacation in July 2018.

"I wondered why there were so many advertisements addressed to him, but I ripped them up and tossed them and didn't think much about it,” recalls Heather, Gavin's mother. The next day, Gavin received two more envelopes in the mail, and she did the same thing.
Then the bombshell: The following day's deliveries included a collection notice addressed to Gavin, seeking payment for $200 in health and nutrition products ordered through a television infomercial [...] “I told the representative that Gavin was only 5 years old and could not even dial a phone!” she says. Shocked and frightened, she contacted the police.

Four days after she received that notice, the ugly truth came out. In May, Gavin's doctor's computer had been hacked, compromising the names, dates of birth, Social Security numbers (SSNs) and insurance information of 14 underage patients, including Gavin. Crooks had already used his information to open credit cards in his name and to make purchases.
Click to expand...

guest · Aug 16, 2019

Michigan Medicine notifies patients of health information breach
August 16, 2019
https://www.uofmhealth.org/news/arc...medicine-notifies-patients-health-information

Michigan Medicine is notifying approximately 5,500 patients about a phishing email campaign that may have exposed some of their health information.

During the campaign, emails containing a malicious link were sent to over 3,200 Michigan Medicine employees. If the link was clicked, employees were directed to a webpage that looked like a legitimate site requesting the username and password for their email account.
In July 2019, three employees clicked into this email, resulting in the perpetrator gaining access to the employees’ email accounts. The accounts were then used to continue to send additional phishing emails. Michigan Medicine discovered the compromised accounts on July 9 and July 12.
Click to expand...

guest · Aug 16, 2019

Virginia Gay Hospital notifies patients after discovering compromised employee email account
August 15, 2019
https://myvgh.org/important-information-regarding-vgh-data-security/

Virginia Gay Hospital has become aware of a data security incident that may have resulted in the disclosure of the personal information of its patients. Virginia Gay Hospital immediately investigated the incident and has sent letters to potentially affected patients to notify them and to provide information on steps they can take to protect themselves.

On June 18, 2019, Virginia Gay Hospital determined that patient information contained in an email account may have been accessed by an unknown third party. Virginia Gay Hospital engaged computer forensic experts to help investigate and determine what information may have been impacted. It was determined that the potentially compromised information included patient names, dates of birth, social security numbers, and medical information.
Click to expand...

guest · Aug 16, 2019

Pen Testing Stories: Exploiting SQL Injection Vulns in Healthcare Portal
This One Time on a Pen Test: How I Compromised a Healthcare Portal Before My Hot Cocoa Went Cold
August 16, 2019
https://blog.rapid7.com/2019/08/16/...lthcare-portal-before-my-hot-cocoa-went-cold/

This week, I was assigned to test the website of a company that handled medical records. Healthcare providers and patients could access records through the web portal. It was super important that the site be secure, since medical records provide a wealth of information that makes identity theft easy and are highly prized in the internet underground.

When I finally got a hold of myself, I tried a simple authentication bypass, which worked. I was now authenticated as the site administrator without even knowing the password. I owned the site, practically by accident [...]
The client ended up shutting down the website completely for emergency maintenance, and we spent the next couple days working with the site developers to get the problems fixed before putting it back into production.
Click to expand...

guest · Aug 17, 2019

NHS healthcare facilities given fresh set of cybersecurity tools
August 16, 2019
https://portswigger.net/daily-swig/nhs-healthcare-facilities-given-fresh-set-of-cybersecurity-tools

The UK’s National Health Service (NHS) has been given a fresh set of security tools to help streamline its digital transformation while stemming the increasing threat of cyber-attacks on its infrastructure.

“This is great news for NHS organisations,” said Rob Shaw, deputy chief executive of NHS Digital, in a statement published on Monday.
The free toolkit includes network intrusion detection and prevention capabilities, secure Domain Name Server (DNS) services, web content filtering, data loss prevention, and a “next-generation” firewall.

“This means that we will be able to monitor for threats more effectively, supporting the NHS to increase data security and helping to provide safer care for patients,” Shaw said.
Click to expand...

guest · Aug 17, 2019

Ransomware and medical devices: How behavior analytics can protect patients
August 16, 2019
https://www.healthcareitnews.com/bl...s-how-behavior-analytics-can-protect-patients

From a cybersecurity perspective, I believe the healthcare industry is in a growing medical device crisis. The emerging trend of ransomware attacks on medical devices has created serious vulnerabilities in healthcare security.
Medical devices and easily compromised operating systems
The trend in medical device manufacturing is changing. Manufacturers are building cheaper and more scalable medical devices running Windows (and the like). The benefit of using a standard operating system is that it’s generally easy for the IT group to apply the latest patches, whereas before, they couldn’t really do that.
With the proliferation of standard OSs, the healthcare industry has begun to observe ransomware attacks on medical devices that were previously only seen on servers and desktops.

To keep these devices secure it’s necessary to profile the behavior of medical devices and to understand their standard behavior patterns.
Once you know these standard behaviors, it’s possible to identify unusual trends that could indicate the device has been compromised and the IT group needs to intervene to prevent damage.
Click to expand...

guest · Aug 19, 2019

WCHN in Danbury Warns of Possible Medical Records Breach
Western Connecticut Health Network is warning patients that some of their medical records may have been compromised
August 19, 2019
https://patch.com/connecticut/danbury/wchn-danbury-warns-possible-medical-records-breach

Nuvance Health, which operates the Western Connecticut Health Network, is warning patients that some of their medical records may have been compromised.
On Monday, Nuvance released a statement that read in part:

"On June 21, 2019, WCHN learned that a box containing medical records that it had sent via the United States Postal Service to the Connecticut State Department of Public Health ("DPH") had broken open during shipping and its contents were damaged. [...] On July 9, 2019, the box was returned by the USPS to WCHN. WCHN has no indication that the box of medical records ever left USPS custody until it was returned to WCHN.

WCHN regrets any inconvenience or concern this may cause. To help prevent an incident like this from happening in the future, WCHN is changing its procedures regarding the transmission of patient information to the DPH. We encourage you to regularly review your insurance statements and explanations of benefits to ensure that they are accurate."
Click to expand...

guest · Aug 19, 2019

Data breach: ASU accidentally reveals email addresses of 4,000 students
August 19, 2019
https://www.azfamily.com/news/data-...cle_11cbf8de-c2ca-11e9-9c32-2bf264d0f9ca.html

Arizona State University has notified 4,000 students that their email addresses "were accidentally revealed" in a large data breach.

ASU told the students on Aug. 16 it happened in late July when a university office sent bulk emails about renewing health insurance coverage without masking the identities of the recipients.
This unintended action is considered a data breach under the Health Insurance Portability and Accountability Act (HIPAA).

"The only items of protected health information (PHI) released were the students' email addresses. No other PHI was released," stated the school.
The university was able to limit the release of information by deleting more than 2,540 of the messages from ASU email inboxes.
Click to expand...

guest · Aug 20, 2019

Almost a third of healthcare workers haven't had cybersecurity training
August 20, 2019
https://betanews.com/2019/08/20/healthcare-workers-lack-security-training/

So it's a little concerning that a new survey of healthcare staff from Kaspersky shows 32 percent of respondents in North America say that they have never received cybersecurity training from their workplace.

The report also shows a lack of awareness of the federal regulations, in both the US and Canada, in place to keep patient information safe and secure. According to the report, nearly a fifth of US respondents (18 percent) report they don't not know what the HIPAA security rule means. In Canada, nearly half of respondents (49 percent) say they don't know if Canadian PHI needed to stay in Canada.

Nearly one in five respondents (19 percent) say there needs to be more cybersecurity training by their organization. When comparing the results by region, over 24 percent of respondents in the US say they have never received cybersecurity training but should have, compared to 41 percent of respondents in Canada when asked the same question.
Click to expand...

Kaspersky: Keeping a Pulse on Cybersecurity in Healthcare

guest · Aug 20, 2019

Medical device cybersecurity will be rubbish for 20 more years
Good cybersecurity guidelines are being published, but slow development and approval processes, and long service lives, will guarantee chronic problems
August 21, 2019
https://www.zdnet.com/article/medical-device-cybersecurity-will-be-rubbish-for-20-more-years/

"Everything with a power point is probably connected, or will be shortly," says Christopher Neal, chief information security officer (CISO) of Ramsay Health Care.
"Increasingly that connectivity is critical to patient care," he told the Gartner Security and Risk Management Summit in Sydney on Monday.

Even if those connected devices aren't transmitting patient medical data, increasingly they're conveying information about their own health.
Yet those medical devices can be incredibly vulnerable.

"There's good guidance, but any systems built with that guidance are probably three to four years away from market, and most of this gear's built to last 10 to 15 years," Neal said.
Click to expand...

guest · Aug 21, 2019

30K Integrated Regional Laboratories Patients Impacted by AMCA Breach
August 20, 2019
https://www.hipaajournal.com/30k-integrated-regional-laboratories-patients-impacted-by-amca-breach/

Integrated Regional Laboratories (IRL) in Florida is notifying approximately 30,000 patients that their protected health information (PHI) was potentially compromised in the American Medical Collection Agency (AMCA) data breach discovered on March 20, 2019.
On June 3, 2019, AMCA notified IRL about its security breach and confirmed on June 13, 2019 that the PHI of IRL patients had been exposed.

IRL posted a breach notice on its website on July 30, and patients are being notified. IRL stopped sending patient information to AMCA when the breach was discovered, and the company is no longer using AMCA’s services. AMCA has been instructed to securely destroy all copies any IRL patients’ PHI.
According to the breach summary on the HHS’ Office for Civil Rights website, 29,644 patients were affected by the breach.
Click to expand...

guest · Aug 21, 2019

Medical centre receptionist dismissed after sharing patient history
August 21, 2019
https://www.stuff.co.nz/business/11...onist-dismissed-after-sharing-patient-history

A medical centre receptionist has lost her job after telling a family gathering about a couple's sexual health tests.

The patients complained to the Privacy Commissioner when they discovered the woman had shared sensitive medical information about them.

"The receptionist had been at a family gathering with a number of extended family members," the commission said in its case note.
They said that the disclosure of their personal information to people they knew had caused them extreme humiliation and emotional distress.

The Health Information Privacy Code requires health agencies to ensure health information is protected by reasonable security safeguards to protect against unauthorised access or disclosure.
The medical centre admitted a breach, but said it did not believe it was responsible for the employee's disclosure.

"We suggested the medical centre make changes to its electronic records system to ensure its security safeguards were more robust," the Privacy Commissioner said.
Click to expand...

ronjor · Aug 21, 2019

FTC Refunds Consumers Who Bought Deceptively Marketed and Advertised “Nobetes” Diabetes Treatment Supplement August 21, 2019

The Federal Trade Commission is mailing 398 checks totaling $60,791 to refund consumers nationwide who bought “Nobetes,” a dietary supplement pill deceptively advertised as an effective diabetes treatment. The average amount per check is $152.74, and consumers are getting back all of the money they spent on the product.
According to the Commission’s December 2018 complaint, between 2015 and 2018, Nobetes Corporation, along with its two officers Marvin Silver and Jeffrey Fleitman, advertised and sold Nobetes, a pill containing a concoction of vitamins, minerals, and plant extracts, as an effective treatment for consumers with diabetes.
Click to expand...

guest · Aug 21, 2019

Hackers steal California hospital's website domain, email addresses
August 21, 2019
https://www.beckershospitalreview.c...ospital-s-website-domain-email-addresses.html

Valley Hospital was forced to change the name of its website URL and email addresses after its domain, svh.com, was hijacked Aug. 6, Sonoma Index-Tribune reports.

It's not unusual for three letter domain names, such as svh.com, to be hijacked since they are "hard to come by," said Blaine Transue, co-founder of web design and development company WildFireWeb, according to the report.

"Any other organization that uses that acronym – in the world – would pay handsomely to get their hands on it, probably to the tune of thousands of dollars if not much more," Mr. Transue said. "So it will likely be resold at some point."
Click to expand...

Minimalist · Aug 22, 2019

Nation-State Attacks Target Medical Research

Nation-state attackers from Russia, Vietnam, and China are increasingly targeting hospitals, pharmaceutical companies, and research universities in search of healthcare data, intellectual property, and medical research, FireEye said.
Click to expand...

https://duo.com/decipher/nation-state-attacks-target-medical-research

ronjor · Aug 22, 2019

FTC Refunds Consumers Who Bought FlexiPrin Joint Pain Supplement August 22, 2019

The Federal Trade Commission is mailing 2,897 checks totaling more than $113,000 to fully refund consumers who bought FlexiPrin, a deceptively marketed joint pain supplement. The average check amount is $39.18.
Click to expand...

Minimalist · Aug 22, 2019

VA’s Health Records Digitization Backlog Is 5 Miles High

Staff at Veterans Affairs medical facilities aren’t keeping up with the backlog of paper records that need to be digitized, with some outstanding documents dating back to 2016.
Click to expand...

https://www.nextgov.com/it-moderniz...rds-digitization-backlog-5-miles-high/159383/

guest · Aug 22, 2019

Call for formal probe into Barwon Health privacy breach
August 23, 2019
https://www.bay939.com.au/news/loca...ormal-probe-into-barwon-health-privacy-breach

There are calls for an independent investigation after sensitive medical records were found on a Geelong street.
Barwon Health has apologised to residents and families involved in the breach.

Shadow Health Minister Georgie Crozier said it was vital for the Victorian government toget involved.

"This is a shocking breach of patient's details and sensitive information about their health requirements and needs being found on the street.
Click to expand...

guest · Aug 22, 2019

AHS warns 7,000 patients their personal health information compromised in email hack
August 22, 2019
https://www.cbc.ca/news/canada/calgary/ahs-privacy-breach-email-richmond-diagnostic-centre-1.5256031

Alberta Health Services is notifying about 7,000 patients that their health information may have been compromised when a physician's Gmail account was hacked.
The doctor working at the Richmond Road Diagnostic Centre in Calgary improperly used a private account to transmit health information, AHS said in a release on Thursday.

Under AHS policy, doctors and staff are required to use AHS secure email when communicating personally identifiable health information and to use encryption when the recipient does not have an AHS account.

"Unfortunately, these policies were not followed in this instance, which underscores the need for AHS to do further work to educate physicians and staff about this vitally important practice," said Dr. Francois Belanger, chief medical officer.
Click to expand...

guest · Aug 22, 2019

Privacy Incident at Massachusetts General Hospital's Neurology Department
August 22, 2019
https://www.massgeneral.org/about/pressrelease.aspx?id=2439

Massachusetts General Hospital (“MGH”) is notifying approximately 9,900 individuals of a privacy incident involving MGH’s Department of Neurology in connection with some of its research programs.

On June 24, 2019, MGH learned that an unauthorized third party had access to databases related to two computer applications used by researchers in the Department of Neurology for specific Neurology research studies. MGH immediately began an investigation into the matter. The investigation revealed that between June 10 and June 16, 2019 this unauthorized third party had access to databases containing research data used by certain Neurology researchers.

The research data varied according to the specific research study and may have included a participant’s first and last name, certain demographic information (such as marital status, sex, race, ethnicity), date of birth, dates of study visits and tests, medical record number, type of study and research study identification numbers, diagnosis and medical history, biomarkers and genetic information, types of assessments and results, and other research information.
MGH is in the process of notifying affected individuals.
Click to expand...

guest · Aug 22, 2019

Feds: PainMD's abandoned medical records at risk of being burned, shredded
August 22, 2019
https://eu.tennessean.com/story/new...s-may-be-burned-shredded-feds-say/2058030001/

Federal and state prosecutors have asked a judge to halt the destruction of thousands of medical records abandoned by PainMD, a Nashville-area pain clinic company that shut down earlier this year in the midst of a fraud investigation.
The medical records, which could be evidence against PainMD or important to former patients, are currently stuck in storage units spread across Tennessee, Virginia and South Carolina.

PainMD filed for bankruptcy in June, then admitted in bankruptcy records that it lost access to medical records kept in 23 storage units. PainMD said it can't open the units because “everyone with access is no longer employed with the company.”
According to the company, more recent medical records were stored electronically and the records in storage all predate 2014.
The company is still required to turn over these records as part of the discovery process in the ongoing fraud investigation.
Click to expand...

guest · Aug 22, 2019

Rhode Island Healthcare Provider Hacked: 3,000 Records Potentially Compromised
August 22, 2019
https://www.hipaajournal.com/rhode-...-hacked-3000-records-potentially-compromised/

Rhode Island Ear, Nose and Throat Physicians Inc. (RIENT) is notifying 2,943 patients that some of their health information was stored on a server which was subjected to unauthorized access on June 19, 2019 when a hacker gained access to its network.
The breach was detected the same day and the network was secured. A third-party computer forensics firm was hired to assist with the investigation and help determine the nature and extent of the breach.

The compromised servers did not contain the medical records of all patients, only records of patients who received medical services between May 1, 2019 and June 12, 2019.
For the majority of affected patients, the breach was limited to names, dates of birth, and clinical information. A small subset of patients also had their Social Security number exposed.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

Krusty Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

Minimalist Registered Member

ronjor Global Moderator

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

Krusty Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

Minimalist Registered Member

ronjor Global Moderator

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches