Why Healthcare Security Matters

guest · Aug 23, 2019

Hospital Not Liable for Facebook Post of Patient Medical Records
August 20, 2019
https://news.bloomberglaw.com/priva...-for-facebook-post-of-patient-medical-records

An Indiana hospital isn’t liable for an employee’s unauthorized actions that allegedly led to the posting of a patient’s medical records on Facebook, a state appeals court said.

Brooke Collins wasn’t acting within the scope of her employment at a Franciscan Alliance Inc. hospital when she allegedly accessed and distributed the confidential health information of Leslie Hayden, someone with whom she wasn’t on good terms with personally, the Indiana Court of Appeals said. The court affirmed pretrial judgment for Franciscan.
Click to expand...

guest · Aug 23, 2019

Hospice of San Joaquin discloses ransomware attack
https://www.hospicesj.org/breach-notification

We value your business and respect the privacy of your information, which is why, as a precautionary measure, we want to inform you about a data security breach that may involve your personal information. We sincerely apologize for any inconvenience or concern this may cause you.

On 7/2/2019 at about 12:50pm Hospice of San Joaquin experienced a cyber ransomware attack on its network. The data accessed may have included personal information such as full name, patient ID number, diagnoses, home address and other sensitive information. Though the malicious software accessed our servers, we do not believe, or have any indication patient or staff information has been utilized, disseminated or disclosed to unauthorized parties. It is pertinent to note all vendor and donor information is housed off of our servers and was entirely unaffected.

Hospice of San Joaquin has implemented additional security measures designed to prevent a recurrence of such an attack, and to protect the privacy of Hospice of San Joaquin’s valued customers.
Click to expand...

guest · Aug 25, 2019

Lyons Companies Provides Notice of Data Event
August 23, 2019
https://www.prnewswire.com/news-rel...-provides-notice-of-data-event-300906582.html

What Happened? On March 12, 2019, Lyons learned of unusual activity in an employee email account. Lyonsimmediately took steps to respond and commenced an investigation, which included working with third-party forensic experts.
Lyons determined through the investigation that two Lyons employee email accounts were accessed without authorization. One email account was subject to unauthorized access between February 4 and March 12, 2019, and the second account was accessed for a few hours on March 12, 2019.

What Information Was Involved? While the data present in the affected emails varies by individual, it may include: name, contact information, driver's license information, bank account or other financial information, date of birth, medical record number, patient identification number, medical and/or clinical information including diagnosis and treatment information, Medicare or Medicaid identification number, and health insurance and claims information.

In addition to conducting a diligent investigation, Lyons has enhanced the security of its systems to mitigate the risk of future incidents.
Click to expand...

guest · Aug 25, 2019

Does Amazon have answers for the future of the NHS?
The technology behemoth is preparing a move into the healthcare market, but critics fear profit will come before patients and privacy
August 24, 2019
https://www.theguardian.com/technol...ure-amazon-artificial-intelligence-healthcare

Reactions to news last month that Amazon’s voice-controlled digital assistant Alexa was to begin using NHS website information to answer health queries were many and varied.
US-based healthcare tech analysts say the deal is just the latest of a series of recent moves that together reveal an audacious, long-term strategy on the part of Amazon.

Crucially, it says it has created ways for Alexa-enabled devices to handle patient information that conform to US privacy laws.
Amazon consistently refuses to discuss its healthcare plans. Neither it nor Haven responded to multiple requests for comment for this article.

Others, however, believe the commercial imperatives of the tech giants conflict with the public service values of the NHS.
“The incentives of companies like Amazon are to increase market share, share prices and profits, which puts them at odds with the underlying goals of a public health system like the NHS.”
Click to expand...

Can I trust Amazon with my health data?
Amazon has promised that UK patients who asked Alexa for health advice would have their data encrypted, but critics demand more specifics on how patient data is protected.
It’s not just Amazon
Jeff Bezos’s firm is far from alone in looking to disrupt healthcare with data and technology. Apple is rolling out its Health Records feature designed to make it easier fo users to visualise, use and store medical data on their iPhones.
Click to expand...

guest · Aug 26, 2019

July 2019 Healthcare Data Breach Report
August 26, 2019
https://www.hipaajournal.com/july-2019-healthcare-data-breach-report/

May 2019 was the worst ever month for healthcare data breaches with 46 reported breaches of more than 500 records. More breaches were reported in May than any other month since the HHS’ Office for Civil Rights started publishing breach summaries on its website in 2009. That record of 44 breaches was broken in July.

July saw 50 healthcare data breaches of more than 500 records reported to the Department of Health and Human Services’ Office for Civil Rights, which is 13 more breaches than the monthly average for 2019 and 20.5 more breaches than the monthly average for 2018.
The main reason for the increase in reported data breaches in July is the colossal data breach at American Medical Collection Agency (AMCA). [...]
Click to expand...

ronjor · Aug 26, 2019

Recent HIPAA settlements highlight the weaknesses in healthcare security

By Forrester Research for Forrester | August 26, 2019
As fines reach into the millions, it's time for healthcare to move beyond minimal compliance efforts.
Click to expand...

guest · Aug 27, 2019

Cyber security challenges for medical device makers — managing the escalating risks
August 26, 2019
https://www.ajg.com/us/news-and-ins...ecurity-challenges-for-medical-device-makers/

Anxiety over a possible breach of this device system is evident in the FDA’s action, which was essentially a preventative measure.
The FDA’s concern is understandable when you look at the risk. Insulin pump settings can be hacked, with insulin levels raised or lowered to a dangerous degree. Not only that, any medical device connected to a network, either through WiFi or the Internet, is vulnerable to theft of Personally Identifiable Information (PII) and Protected Health Information (PHI).

Compounding the problem is the lack of qualified security professionals. There are over 7,000 device manufacturers challenged with finding security workers, and approximately 80% of device manufacturers have fewer than 50 employees. They are in need of guidelines and support for cybersecurity.
Today’s complex connected medical devices and future advances
In 2019, the JSP reported a 62% increase in the number of connected medical devices over the last 5 years, and this increase is expected to accelerate.
Click to expand...

guest · Aug 27, 2019

Medical Data in the Cloud: What Are the Risks?
August 27, 2019
https://cloudtweaks.com/2019/08/medical-data-what-are-the-risks/

Executive-level healthcare leaders must have a thorough understanding of cloud-based security risks.
While some information is more valuable to hackers than others, you need to understand and be prepared to deal with any security breaches that may arise in your facility.

There are myriad benefits and challenges that come with doctors and other healthcare professionals using electronic medical records. Protected health information is often stored in the data cloud and connects multiple organizations and providers to the patient when they need to make care decisions
UNDERSTANDING THE ISSUE
If you’re in charge of healthcare data or clinicians who create, document, and save this vital information, you need to understand the real value of a patient’s medical record. Hackers are everywhere and continually search for new ways to gain access to personal information.
Click to expand...

guest · Aug 27, 2019

Capital & Coast DHB caught out by email phishing scam - but no privacy breach
August 27, 2019
https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12262502

An email scam has caught out a staff member at Capital & Coast District Health Board, leading to thousands of fake emails being sent from their address.
The DHB said no private or patient information had been compromised as a result of the scam.

Their email was locked down, and the source of the phishing email had been blocked by the DHB's systems, a spokesperson said.
The DHB said online scams were becoming more common, and more sophisticated. It blocked around 12,500 scam or malicious emails to its 6000 staff every day.
Click to expand...

guest · Aug 27, 2019

Ministry of Health sets minimum standards for data safety
Cloud remains to the fore as ministry sets baseline data standards
August 27, 2019
https://www.reseller.co.nz/article/665750/ministry-health-sets-minimum-standards-data-safety/

The Ministry of Health is encouraging health organisations to ensure the digital services they use are safe, secure, integrated and reliable.
The Ministry published its minimum requirements for digital, data and technology services for health organisations over night.

The requirements specify that organisations must govern the data they hold in line with data protection and use, privacy, social license and Māori data sovereignty guidelines.

"We know many individual health agencies will use a wide range of technology from many different suppliers," said Shayne Hunter, deputy director-general data and digital.
The baseline requirements specify cloud delivery should be considered for all digital services in preference to locally hosted and configured technology, and that an assessment of risk be undertaken before their use.
Click to expand...

guest · Aug 28, 2019

AMCA Data Breach Total Nears 25M as Wisconsin Diagnostic Laboratories Confirms 115K Record Breach
August 28, 2019
https://www.hipaajournal.com/amca-d...tic-laboratories-confirms-115k-record-breach/

The victim count from the American Medical Collection Agency (AMCA) data breach has risen to almost 25 million as yet another healthcare organization has announced it has been impacted by the breach.

Wisconsin Diagnostic Laboratories (WDL), a network of 13 medical testing facilities in and around Milwaukee, is notifying 114,985 patients that some of their protected health information was compromised in the AMCA data breach.
On June 3, 2019, AMCA informed WDL that some of its patients’ data had been compromised as a result of the hacking of a web payment portal. The hacker gained access to the payment page on August 1, 2018. The breach was detected on March 30, 2019 and unauthorized access was terminated.
Click to expand...

ronjor · Aug 28, 2019

Why ‘one app to rule them all’ is not the future of digital health

Chris Hogg@cwhogg
But “one app to rule them all” is flawed. Not only does it ignore the way people use technology, it puts the patient experience second. Forcing patients to use one app for every healthcare interaction disregards the complexity and specificity of individual diseases and patient profiles.
Click to expand...

ronjor · Aug 28, 2019

Americans largely don't trust payers, providers to secure their health data

Ron Shinkman
Since the U.S. Department of Health and Human Services began requiring healthcare providers and their business associates to publicly disclose data breaches involving 500 or more individuals about a decade ago, such incidents have received significant media attention. And it seems those and other breaches are eroding trust among individual Americans regarding their payers and providers, according to this survey of over 1,000 adults conducted last month.
Click to expand...

guest · Aug 28, 2019

Blockchain in Healthcare: Perfect Formula for Patient Data Security
August 28, 2019
https://www.cioapplications.com/new...rmula-for-patient-data-security-nid-5023.html

Digital healthcare trends are fundamentally driven by the requirement for better patient care, more durable, accurate analysis, and on-demand access to medical data. The emerging novel technologies have been playing a vital role in every sector so far. Blockchain is one such technology having the potential to transform healthcare for better.

With a continuous increase in patient numbers, healthcare providers have to manage more massive health data regularly. As the data volume progresses each year, it becomes more difficult for hospitals and clinics to process and store data. Patient health information, data collected from IoT devices or monitoring systems, medical claims, and electronic health records are the data recorded by pharmaceutical organizations.

As healthcare deals with classified patient information and requires expeditious access to information, blockchain can streamline these medical records and securely enable its sharing.
Blockchain technology is being leveraged to improve the collaborative exchange of necessary research and use healthcare data.
Click to expand...

guest · Aug 29, 2019

How a Hacking Case Could Shape Protections For Abortion Clinics
August 28, 2019
https://www.pbs.org/wgbh/frontline/...could-shape-protections-for-abortion-clinics/

But there are other looming threats to clinics that can’t be stopped by physical barriers: online hacking.

“We’re connected in ways that we haven’t been before,” Connon said. “That has implications in the ways that people access reproductive health services or use anti-abortion harassment violence and other tactics in these spaces that didn’t exist or weren’t conceptualized previously.”
According to the 2018 statistics gathered by the National Abortion Federation, there were almost 5,500 more reported cases of anti-abortion internet harassment from the previous year. Overall, these numbers have been on the rise since 2015.

There have been a number of successful attempts to hack abortion care providers’ online services since 2014, including incidents at Whole Woman’s Health and Planned Parenthood, according to Wired. The NNAF is the first organization to seek legal action against their alleged hackers, which Goldberg, the lawyer, said she hopes will act as a deterrent.
Click to expand...

guest · Aug 29, 2019

33,370 Mount Sinai Hospital Patients Impacted by AMCA Breach
August 29, 2019
https://www.hipaajournal.com/33370-mount-sinai-hospital-patients-impacted-by-amca-breach/

Mount Sinai Hospital has discovered the protected health information (PHI) of 33,730 patients was compromised in the cyberattack on American Medical Collection Agency (AMCA). The hospital is the 24th known victim of the massive AMCA breach, which has affected almost 25 million patients.

The breach only affected patients with outstanding medical bills that had been passed to AMCA for collection. The breach involved names, name of lab or medical service provider, dates of service, referring physician’s name, health insurance information, and other medical information related to the services provided by Mount Sinai.
Some patients also had financial information exposed. Those individuals were notified directly by AMCA and offered credit monitoring services. All other individuals are being notified by Mount Sinai Hospital.
Click to expand...

guest · Aug 29, 2019

Ransomware hits hundreds of dentist offices in the US
Ransomware group gains access to dental software backend, deploys ransomware on customers' systems
August 29, 2019
https://www.zdnet.com/article/ransomware-hits-hundreds-of-dentist-offices-in-the-us/

Hundreds of dental practice offices in the US have had their computers infected with ransomware this week, ZDNet has learned from a source.
The incident is another case of a ransomware gang compromising a software provider and using its product to deploy ransomware on customers' systems.

In this case, the software providers are The Digital Dental Record and PerCSoft, two Wisconsin-based companies who collaborated on DDS Safe, a medical records retention and backup solution advertised to dental practice offices in the US.
COMPANY PAID RANSOM DEMAND
Over the last weekend, a hacker group breached the infrastructure behind this software, and used it to deploy the REvil (Sodinokibi) ransomware on computers at hundreds of dentist offices across the US.
A source impacted by the ransomware tells ZDNet that the two companies opted to pay the ransom demand. The Digital Dental Record and PerCSoft have been sharing a decrypter with impacted dental offices since Monday, helping companies recover encrypted files.
Click to expand...

guest · Aug 29, 2019

mood said: ↑

Google and University of Chicago sued over patient records
June 26, 2019
https://www.cnet.com/news/google-and-university-of-chicago-sued-over-patient-records/
Click to expand...

Google, Medical Center Ask Court to Dismiss Privacy Lawsuit
Legal Experts Analyze the Key Issues in Complex Case
August 29, 2019
https://www.inforisktoday.com/google-medical-center-ask-court-to-dismiss-privacy-lawsuit-a-12999

Google and the University of Chicago Medical Center have filed motions to dismiss a class action lawsuit that alleges patients' electronic health records were not properly de-identified by the hospital before they were shared with Google to support the company's predictive medical data analytics technology development efforts.
The hospital and Google argue that they used a secure process in compliance with HIPAA and that the plaintiff has shown no evidence of harm caused by the data sharing.

The collaboration between Google and the University, the complaint contends, is to "pull off what is likely the greatest heist of consumer medical records in history."
Expert Analysis
Legal experts are weighing in on the dispute, seeing merits in the arguments on both sides
Click to expand...

guest · Aug 29, 2019

14 healthcare privacy incidents in August
August 29, 2019
https://www.beckershospitalreview.com/cybersecurity/14-healthcare-privacy-incidents-in-august.html

Numerous privacy incidents at hospitals, IT suppliers and other healthcare organizations captured public attention last month.

While some security incidents only affected a few thousand individuals, others were said to have affected close to 200,000.
Fourtine healthcare privacy incidents reported by Becker's Hospital Review in August: [...]
Click to expand...

guest · Aug 31, 2019

OCR Offers Advice on Managing Malicious Insider Threats
August 30, 2019
https://www.hipaajournal.com/ocr-offers-advice-on-managing-malicious-insider-threats/

Healthcare organizations can implement robust defenses to prevent hackers from gaining access to sensitive data, but not all threats come from outside the organization. It is also important to implement policies, procedures, and technical solutions to detect and prevent attacks from within.

Many of those breaches were due to mistakes made by healthcare employees, but a significant percentage were caused by malicious insiders who stole patient information for financial gain. Common malicious insider attacks include accessing the medical records of celebrities for financial gain and stealing patient data to commit identity theft and fraud.
In its 2019 Summer Cybersecurity Newsletter, OCR offers tips on overcoming the challenges associated with protecting patient data from attacks from within and explains how risk can be managed to comply with HIPAA Rules.
Click to expand...

OCR: Managing Malicious Insider Threats

guest · Aug 31, 2019

122,000 Providence Health Plan customers may be affected by data breach
August 30, 2019
https://www.oregonlive.com/news/201...customers-may-be-affected-by-data-breach.html

The personal information of as many as 122,000 customers of Providence Health Plan’s dental program in Oregon may have been compromised in a security breach at the program’s administrator, Virginia-based Dominion National.
The timing of the breach? Dominion doesn’t really know, but said it may have started up to nine years ago.

The security problem did not occur on Providence servers, but could affect some 2.9 million individuals nationwide whose insurance plans use Dominion as an administrator. Dominion said the unauthorized access may have occurred as early as April 2010.
While Dominion discovered the potential breach in late April, it took nearly four months to notify customers. Dominion said the unauthorized parties may or may not have accessed customers’ personal information, including names, addresses, dates of birth, social security numbers, and insurance information.
Click to expand...

guest · Sep 1, 2019

mood said: ↑

Virginia Gay Hospital notifies patients after discovering compromised employee email account
August 15, 2019
https://myvgh.org/important-information-regarding-vgh-data-security/
Click to expand...

Virginia Gay Hospital data breach impacts about 5,000; initiates security changes, upgrades
August 30, 2019
http://www.communitynewspapergroup....cle_27757e12-0645-5bdd-8fb7-19a558d5e2a7.html

The breach was announced Aug. 16. Hospital officials became aware of a “data security incident” on June 18.

Schoonover said phishing can be targeted against organizations and industries of all sizes. Email fraud in health care has risen 473 percent in the last two years. In July of 2019, three major breaches happened with big companies.
[...] several factors make health care a target for phishing. Health care has aging IT infrastructure. The staff is overworked and there is a lot of identifiable information available, both personal and health related.

“Software is one thing that we can upgrade,” said Schoonover.
In addition to passwords and emails, the hackers had access to about 120,000 other documents. Financial information was found in about 5,000 documents.
Schoonover said most of the information was not in patient records, but billing and insurance information.
Click to expand...

guest · Sep 2, 2019

Keep patient information safe as data breaches rise
September 2, 2019
https://www.digitalcommerce360.com/2019/09/02/keep-patient-information-safe-as-data-breaches-rise/

In the last decade, there have been over 2,550 healthcare data breaches, including 46 in April 2019 alone, the highest monthly tally in a decade. With each data breach, medical records are released on the dark web, exposing patients’ date of birth, place of birth, credit card details, Social Security number, addresses and emails.

With each data breach, criminals gain access to endless patient login credentials and personal information, equipping them with everything they need to perpetrate account takeover and act as the patient online.
By relying on passwords and knowledge-based authentication, it is impossible to know whether the person logging in to a patient portal is actually the real-world patient or a fraudster. Because these traditional authentication methods can be easily bypassed with information found on the dark web, healthcare agencies need to properly vet and verify their patients to ensure that they are who they claim to be.

But, how do healthcare agencies implement these stronger authentication processes?
Click to expand...

guest · Sep 3, 2019

Ransomware attacks on several hospitals reported
September 1, 2019
http://www.taipeitimes.com/News/taiwan/archives/2019/09/01/2003721498

More than a dozen computer system servers at hospitals have been attacked by ransomware, the Ministry of Health and Welfare said yesterday.
The ministry issued the statement after Chinese-language reports said that about 56 hospitals nationwide have been targeted by ransomware since Thursday, including ministry-affiliated hospitals, large regional hospitals and clinics.

However, the hospital restored the system within two hours and no medical records were leaked, Parng said.
About a dozen other hospitals reported ransomware attacks that were initiated early on Friday, he said, adding that the issues were resolved in one to two hours, no ransoms were paid and no patient information was compromised.

The hospitals had password management problems that could be improved, so the ministry has asked them to bolster their information security, he said.
Click to expand...

guest · Sep 3, 2019

Unauthorized Accesses of Health Information Lead to Eleventh Conviction
August 29, 2019
https://www.oipc.ab.ca/news-and-eve...-information-lead-to-eleventh-conviction.aspx

A former billing clerk with Alberta Health Services (AHS) pleaded guilty in Red Deer Provincial Court to illegally accessing health information under the Health Information Act (HIA) on August 21, 2019.

Rosario Aldave was found to have accessed the health records of 52 Albertans without authorization. She received a $5,000 fine and was ordered not to access health information for one year. The unauthorized accesses occurred in Red Deer.
AHS discovered the breaches of health information after it began an internal audit of an electronic health records system. AHS started the audit after being alerted to allegations that Ms. Aldave had accessed health information without authorization. AHS reported the breaches to the Office of the Information and Privacy Commissioner (OIPC) in June 2018.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches