Why Healthcare Security Matters

guest · Sep 14, 2019

Are Patients the Next Cyberattack Targets?
September 13, 2019
https://www.medscape.com/viewarticle/918385

While healthcare systems have focused on warding off threats from malware and ransomware, a more insidious way to create havoc is gaining attention: hackers targeting patients by changing or disabling network-connected medical devices and diagnostic test results. Earlier this week, the US Food and Drug Administration (FDA) held a meeting to highlight the potential dangers.
Such concerns have a history. In April 2018, the FDA recalled 465,000 pacemakers because of security vulnerabilities and insisted the manufacturer issue software fixes.

To date, there have been no reports of patients being harmed by hacked cardiac or insulin devices. But the number of lives that depend on such devices continues to grow, as does the interconnectedness of such devices with other systems, such as physician and hospital networks that collect and analyze patient data. A typical hospital bed has 10 to 15 wirelessly connected medical devices.
Click to expand...

guest · Sep 14, 2019

Little Rock Plastic Surgery releases statement after internal HIPAA breach
September 13, 2019
https://katv.com/news/local/little-...eleases-statement-after-internal-hipaa-breach

A Little Rock plastic surgery clinic released a statement on Friday about a HIPAA breach that happened in July.
According to a statement from Little Rock Plastic Surgery, it was discovered on or about July 15, 2019, that a nurse downloaded reports, photos, and other information that contained Protected Health Information of several patients.

The nurse also accessed the clinic's vendor accounts to get access to information related to treatments and appointment dates of patients.
According to the release from the clinic, the incident occurred "without the knowledge or consent" of Little Rock Plastic Surgery, its patients, and was in violation of company policies.
Click to expand...

guest · Sep 16, 2019

Camera Containing Autopsy Photos Stolen From Loyola University Medical Center Pathology Lab
September 13, 2019
https://chicago.cbslocal.com/2019/09/13/loyola-university-medical-center-autopsy-photos-stolen/

Loyola University Medical Center confirmed that a camera containing the autopsy photos of several patients over a period of more than a year was stolen from the hospital’s pathology lab, and the personal health information of those patients has not been recovered.
Clark’s family tells CBS 2 they weren’t notified about the breach for two months, and they still have questions about how and when it was reported.

“It’s sickening to think that those photos are just out there,” said Tanya Washington, Clark’s daughter. “And that the hospital system didn’t have the decency to tell us until now.”

“The hospital believes the camera was the target of the theft, and at this point we have no indication that the images have been used or further disclosed,” a Loyola medicine spokesperson said in a statement [...] A spokesperson said the hospital has introduced new safety measures to prevent this from happening in the future.
Click to expand...

guest · Sep 16, 2019

Carle Foundation Hospital Suffers Data Breach Due to Phishing Attack
September 14, 2019
https://www.securitymagazine.com/ar...al-suffers-data-breach-due-to-phishing-attack

Carle Foundation Hospital (“Carle”), three Urbana, Illinois-based hospitals, suffered a data breach due to a phishing incident.

They immediately secured the accounts, opened an investigation, and a leading cyber security firm was engaged to help identify what information may have been impacted. The investigation determined some patient information was contained in the email accounts, which may have included patient names, medical record numbers, dates of birth, and clinical information such as diagnosis and treatment plan.
This incident affected "only certain patients that received cardiology or surgery services at Carle," says the press release.
Click to expand...

guest · Sep 16, 2019

Texas Hospital Administrator Sentenced to 10 Years in Prison for Role in $16 Million Health Care Fraud Scheme
September 16, 2019
https://www.justice.gov/opa/pr/texa...ears-prison-role-16-million-health-care-fraud

Houston, Texas-area hospital administrator was sentenced today for his role in a $16 million Medicare fraud scheme involving partial hospitalization programs.

Starsky Bomer, 46, of Houston, Texas, was sentenced by U.S. District Judge Vanessa Gilmore of the Southern District of Texas to 10 years in prison for his role in the scheme, and ordered the defendant to pay $6,277,575.77 in restitution and to forfeit $158,260. On Oct. 5, 2018, following a five-day trial before Judge Gilmore, Bomer was convicted of one count of conspiracy to receive health care kickbacks, two counts of violating the Anti-Kickback Statute, and one count of conspiracy to commit healthcare fraud from a November 2017 superseding indictment.
Click to expand...

guest · Sep 17, 2019

Compliancy Group Confirms Integration Link LLC is in Compliance with HIPAA and the HITECH Act
September 17, 2019
https://www.hipaajournal.com/compli...-in-compliance-with-hipaa-and-the-hitech-act/

Integration Link, LLC, a provider of cybersecurity consultancy services and virtual Chief Information Security Officers to small to large enterprises, has completed Compliancy Group’s 6-Stage HIPAA Risk Analysis and remediation process and has demonstrated full compliance with all provisions of the HIPAA Privacy, Security, Breach Notification, and Omnibus Rules and the HITECH Act.

“Integration Link is committed to ensure our healthcare provider, health plan, healthcare clearinghouse, and HIPAA business associate customers implement multiple safeguards to protect sensitive personal and health information,” explained Integration Link. “That breeds a vast amount of accountability and responsibility for us all.”

The successful completion of Compliancy Group’s HIPAA program has seen Integration Link awarded Compliancy Group’s ‘HIPAA Seal of Compliance.’ The Seal of Compliance demonstrates Integration Link has implemented an effective HIPAA compliance program and is committed to ensuring the privacy and security of all HIPAA-covered data stored on systems accessible to its staff.
Click to expand...

ronjor · Sep 17, 2019

Millions of Americans’ Medical Images and Data Are Available on the Internet. Anyone Can Take a Peek.

by Jack Gillum, Jeff Kao and Jeff Larson Sept. 17, 2019
Hundreds of computer servers worldwide that store patient X-rays and MRIs are so insecure that anyone with a web browser or a few lines of computer code can view patient records. One expert warned about it for years.
Click to expand...

guest · Sep 17, 2019

NIST Issues Draft Guidance for Securing PACS
Tips on Keeping Picture Archiving and Communications Systems Secure
September 17, 2019
https://www.govinfosecurity.com/nist-issues-draft-guidance-for-securing-pacs-a-13098

New draft guidance from the National Institute of Standards and Technology aims to help healthcare organizations improve the security of picture archiving and communications systems, or PACS.

NIST's National Cybersecurity Center of Excellence, or NCCoE, on Monday issued the preliminary guidance for PACS - systems that centrally manage medical imaging data.
NIST says the practice guide "demonstrates how an organization may implement a solution to mitigate identified risks." The reference architecture includes technical and process controls to implement: [...]
"This project focuses on providing increased security benefits while minimizing the impact and availability to PACS and other components," NIST writes.
Medical Device Risks
"Anything that is designed to help the healthcare industry protect medical devices is a good thing, and a reference architecture is a very good starting point," says former healthcare CISO Mark Johnson of the consulting firm LBMC Information Security.
Click to expand...

guest · Sep 18, 2019

Healthcare industry needs treatment to improve data security
September 18, 2019
https://betanews.com/2019/09/18/healthcare-data-security-2/

The healthcare sector collects a lot of detailed information about its clients and that makes it a prime target for cybercriminals.
A new report from SecurityScorecard confirms this, aggregating data from a number of different sources it reveals that healthcare remains the most breached industry.

"Electronic Personal Health Information (ePHI) and Electronic Medical Records (EMR) contain all the most valuable information that a malicious actor can sell on the dark web," say the report's authors. "Name, birth date, social security number are only the tip of the iceberg -- even low skilled fraud actors are able to easily monetize such information. [...]"
Malicious actors increasingly target small networks in order to stay under the radar, as larger enterprises may be more security aware and are on the look out for malicious activity.

You can find out more on the SecurityScorecard site.
Click to expand...

ronjor · Sep 18, 2019

Texas Health Care Fraud and Opioid Takedown Results in Charges Against 58 Individuals
Wednesday, September 18, 2019

The Justice Department announced today a coordinated health care fraud enforcement operation across the state of Texas, involving charges against a total of 58 individuals across all four federal districts in Texas for their alleged involvement in Medicare fraud schemes and networks of “pill mill” clinics resulting in $66 million in losses and 6.2 million pills. Of those charged, 16 were doctors or medical professionals, and 20 were charged for their role in diverting opioids.
Click to expand...

guest · Sep 18, 2019

mood said: ↑

DeepMind hands off role as health app provider to parent Google
November 13, 2018
https://techcrunch.com/2018/11/13/deepmind-hands-off-role-as-health-app-provider-to-parent-google/
Click to expand...

Google swallows DeepMind Health
September 18, 2019
https://www.bbc.co.uk/news/technology-49740095

Last November the pioneering London AI firm DeepMind announced that its health division was being transferred to its parent company Google.
Now, 10 months later, the move is finally happening, the delay a measure of how controversial and painful this process has been.

Google said the transfer to its global health division would give DeepMind's Streams app, which helps doctors and nurses to monitor patients with a severe kidney condition, the resources it needed to expand internationally.
The Streams app had caused quite a stir when it was revealed that it used the data of about 1.6 million patients, without asking permission.

In a blogpost, Dr Dominic King, who is taking a team of about a hundred from DeepMind to Google Health, explained why the transition had taken so long: "Health data is sensitive, and we gave proper time and care to make sure that we had the full consent and co-operation of our partners.
Click to expand...

Google influence
"This included giving them the time to ask questions and fully understand our plans and to choose whether to continue our partnerships. As has always been the case, our partners are in full control of all patient data and we will only use patient data to help improve care, under their oversight and instructions."
But as of now there are no plans to replace the ethics panel, so there is little clarity on who will oversee the work Google does with the data of NHS patients.

Also unclear is where this leaves DeepMind and its co-founder Mustafa Suleyman.
But insiders doubt he will have much influence over Google's health research when he returns from his extended break later this year.
Click to expand...

Google: DeepMind’s health team joins Google Health

guest · Sep 19, 2019

Ramsey County Expands 2018 Phishing Attack Victim Count from 599 to 117,905
September 19, 2019
https://www.hipaajournal.com/ramsey...shing-attack-victim-count-from-599-to-117905/

Ramsey County has discovered an August 2018 phishing attack has impacted far more individuals than initially thought. The victim count has been increased from 599 to 117,905.
The initial breach report stated the email accounts of 26 employees were compromised in a phishing attack on or around August 9.

The information contained in those accounts includes names, addresses, dates of birth, patient identifiers, appointment dates, appointment types, patient master index numbers, household identification numbers, and the names of patients’ representatives.
Ramsey County had issued an update about the breach on July 1, 2019 stating a further 4,638 individuals had been affected and 3,272 additional notifications were sent. Ramsey County has said that in total, 116,255 breach notification letters have now been sent.

Breach investigations can take some time to complete, as the extent of a cyberattack may not initially be apparent. Investigations can take several months to complete.
Click to expand...

guest · Sep 19, 2019

Health Ministry investigating leak of patient records
September 19, 2019
https://www.thestar.com.my/news/nat...inistry-investigating-leak-of-patient-records

The Health Ministry is investigating reports of a data leak involving the patient records of nearly 20,000 Malaysians.

Health Minister Datuk Seri Dr Dzulkefly Ahmad said his Ministry views the breach seriously and has called for a special meeting with the Malaysian Communications and Multimedia Commission (MCMC) and National Cyber Security Agency (Nacsa) to identify the source of the leak, revealed by Germany-based security firm Greenbone Networks.
The risk of information exposure exists at all healthcare facilities, including private hospitals and medical learning institutions, he said.
Click to expand...

guest · Sep 19, 2019

Charges Brought Against 34 Individuals for Alleged West Coast Medicare and Medicaid Fraud Schemes Totaling $258 Million
September 18, 2019
https://www.justice.gov/opa/pr/char...est-coast-medicare-and-medicaid-fraud-schemes

Assistant Attorney General Brian A. Benczkowski of the Justice Department’s Criminal Division announced today a health care fraud enforcement action in the state of California, involving charges brought against a total of 26 individuals in the Central District of California for their alleged involvement in Medicare and Medicaid fraud schemes resulting in $257 million in billings.

Of those charged, 14 were doctors or medical professionals. In addition, in the states of Arizona and Oregon, eight defendants, including three licensed medical professionals, have been charged with defrauding the Medicaid program out of over $1 million. These cases were investigated by each state’s respective Medicaid Fraud Control Units
The charges announced today aggressively target schemes billing Medicare and Medicaid for services, testing and prescriptions that were not medically necessary or not actually provided to beneficiaries.
Click to expand...

guest · Sep 19, 2019

2 Phishing Attacks Affect Presbyterian Health Plan Members
Apparently Unrelated Attacks Potentially Expose Member Data
September 19, 2019
https://www.inforisktoday.com/2-phishing-attacks-affect-presbyterian-health-plan-members-a-13125

Phishing incidents have had a big impact on members of Albuquerque, New Mexico-based Presbyterian Health Plan in recent weeks.

A phishing attack revealed this week by two subsidiaries of the managed care company Magellan Health potentially exposed data of members of the health plan. Earlier, Presbyterian reported it had been directly targeted by a larger phishing incident (see: Health Data Breach Tally: Latest Additions)
Although the two phishing campaigns both apparently occurred in May, the attacks apparently were not related, according to spokeswomen for Magellan Health and Presbyterian Health Plan.
Click to expand...

guest · Sep 21, 2019

Wyoming hospital curtails services amid hacker attack
September 21, 2019
https://www.charlotteobserver.com/news/article235344062.html

An attack by hackers on a Wyoming health organization's computer systems has forced a hospital to cancel some surgeries, stop admitting patients and transfer some patients to other facilities, a spokeswoman said Saturday.
FBI officials and local authorities were working to restore Campbell County Health's access to its systems after the ransomware attack took its computers hostage on Friday, officials said.

"We are evaluating patients and evaluating appropriate care," Clarke said.
She declined to elaborate on what kind of medical services were affected by the attack.

On Friday, the attack shut down the outpatient lab, inpatient admissions and canceled some surgeries. On Saturday, Campbell County Health officials posted an update that said its emergency services and walk-in clinic were operational and that patients in the hospital and other facilities were safe.
Click to expand...

guest · Sep 21, 2019

Criminal probe after data breach at Wigan hospital
September 17, 2019
https://www.wigantoday.net/health/criminal-probe-after-data-breach-at-wigan-hospital-1-10001329

The Wrightington, Wigan and Leigh (WWL) NHS Foundation Trust has sent out letters to victims of the data breach, who number more than 2,000, explaining that personal information was viewed on multiple occasions by an employee who had no legitimate reason to access the files and were not permitted to do so.
As a result the Information Commissioner’s Office has launched a criminal investigation.

It is possible that clinical documentation such as blood results, care pathways, medication, secretary letters and discharge letters have been accessed.
The trust has told those affected: “Unfortunately during this investigation poor computer etiquette was also identified and therefore we are unable to validate the specific individual concerned.
Click to expand...

guest · Sep 21, 2019

'Detailed and graphic': Clinic faxes patients' highly sensitive medical histories to wrong number
September 18, 2019
https://www.theage.com.au/national/...istories-to-wrong-number-20190916-p52rsy.html

A Melbourne medical clinic has been inadvertently faxing highly sensitive patient details including mental health and family medical histories to a Greenvale man for at least two years.

The man said he has been sporadically faxed at least 10 medical referrals for specialist consultations from the Harding Street Medical Centre in Coburg.
Faxed documents seen by The Age include patients' highly detailed and sensitive medical histories along with the medical backgrounds of their family members, including their children.

The perils of faxing a patient's medical details have come under intense scrutiny in recent years.
Click to expand...

guest · Sep 21, 2019

Thousands of abandoned medical records found in deceased Indiana doctor's abortion clinics
September 21, 2019
https://edition.cnn.com/2019/09/21/us/indiana-abortion-doctor-abandoned-records/index.html

First, authorities discovered a spine-chilling 2,246 fetal remains in the Illinois garage of an abortion doctor after his death. Then, investigators found "thousands" of abandoned medical records across his abortion clinics in Indiana, the Indiana attorney general announced on Friday.
Indiana Attorney General Curtis Hill called Dr. Ulrich Klopfer one "of the more notorious abortionists in the history of Indiana."

The doctor had "a record of deplorable conditions and violations of regulatory controls that are placed on these clinics," Hill said. "He certainly was problematic in life and as it turns out continues to present problems in his death."
The remains found in his home date back to abortions he performed between 2000 and 2002, when he operated clinics in Indiana, authorities said.

"Folks who use these clinics have a high degree of expectations of privacy and confidentiality and these records have been abandoned," Hill said.
Click to expand...

guest · Sep 23, 2019

NHS staff issued with fresh cyber security guidance
September 23, 2019
https://www.itpro.co.uk/security/34475/nhs-staff-issued-with-fresh-cyber-security-guidance

NHS Digital has launched an organisation-wide cyber security campaign to provide staff with the most up-to-date guidance on how to avoid and mitigate potential cyber threats and data breaches.

With the NHS being one of the biggest direct and indirect targets for cyber criminals, NHS Digital's 'Keep I.T. Confidential' campaign is hoping to educate the workforce on the impact of cyber security on patient safety and care.
As part of the programme run by NHS Digital's Data Security Centre (DSC), staff will be reminded of a host of key cyber security threats that could compromise the NHS' defences. There will also be information on what actions staff can take to reduce the risk of attack.
Click to expand...

guest · Sep 23, 2019

NHS Trust Says Systems Restored After “Critical” IT Failure: Was it Ransomware?
September 23, 2019
https://www.cbronline.com/news/nhs-trust-critical-it-systems-failure

An NHS trust that oversees six hospitals says it has restored systems after a critical IT systems failure that forced it to cancel operations over the weekend.
Torbay and South Devon NHS Foundation Trust employs approximately 6,000 staff and serves a resident population of approximately 286,000 people.

In a short Facebook post today it said it had been forced to declare a critical incident following the IT systems failure, telling patients: “Our IT staff have been working overnight to try to resolve the issues and restore IT resilience, but we have had to cancel all routine surgery and outpatients appointments today.”
By around 16:30 today the trust said systems had been restored.

The NHS Trust said in an update this afternoon: “While all systems are now back up and running, we are in a period of recovery. We will provide a further update later this afternoon about any potential impact on appointments over the coming days.”
Click to expand...

Security experts speculated that the issue may have been a ransomware attack, which remain rampant, with malware typically delivered via phishing emails, which can be obvious or sophisticated, depending on the type of attack.

The NHS remains rife with legacy and unpatched systems. NHS Digital continues to try and get greater visibility over the NHS’s infrastructure in the wake of the Wannacry ransomware attack in May 2017, which hit 80 hospital trusts and 595 GP practices.
Last month NHS Digital, which oversees the NHS’s cyber security work, said it had signed Accenture up as a partner in a £40 million deal to help provide firewall, secure DNS and network intrusion solutions to hospitals and regional trusts.
Click to expand...

guest · Sep 23, 2019

August 2019 Healthcare Data Breach Report
September 23, 2019
https://www.hipaajournal.com/august-2019-healthcare-data-breach-report/

In August, healthcare data breaches continued to be reported at a rate of more than 1.5 per day, which is around twice the average monthly breaches in 2018 (29.5 per month). This is the second successive month when breaches have been reported at such an elevated level. While the number of breaches has not changed much since last month (49 compared to 50), there has been a substantial reduction in the number of exposed records.

August saw 729,975 healthcare records breached compared to 25,375,729 records in July, 3,452,442 records in June, and 1,988,376 records in May. The exceptionally high breach total for July was mostly due to the massive data breach at American Medical Collection Agency (See below for an update on the AMCA breach total). [...]
Click to expand...

ronjor · Sep 23, 2019

Here's the kind of data hackers get about you from hospitals September 23, 2019

by Michigan State University
The findings, published in Annals of Internal Medicine, encompass 1,461 breaches that happened between Oct. 2009 and July 2019.
Click to expand...

guest · Sep 23, 2019

mood said: ↑

Wyoming hospital curtails services amid hacker attack
September 21, 2019
https://www.charlotteobserver.com/news/article235344062.html
Click to expand...

Ransomware attack still causing problems at Wyoming hospital
September 23, 2019
https://www.miamiherald.com/news/article235390757.html

A computer attack by hackers demanding payment in exchange for removing the ransomware has caused serious problems at a Wyoming hospital for three days.

Campbell County Memorial Hospital in Gillette has received patients since Friday's attack but some were still being sent to hospitals elsewhere, including Sheridan, Buffalo, Douglas, Casper and Rapid City, South Dakota, county Emergency Management Coordinator David King said.
Some 1,500 computers and servers were being kept offline to both contain the ransomware and treat the machines like a crime scene that could help determine who was responsible, King said.

It isn't known when the computer problems might be resolved, hospital information technology director Matt Sabus said at a livestreamed news conference Monday in Gillette.
Hospital officials couldn't discuss the hackers' demands because the attack was under investigation, hospital spokeswoman Dane Joslyn said.
Click to expand...

guest · Sep 24, 2019

Healthcare Cyberattack Trends in 2019
September 24, 2019
https://www.fortinet.com/blog/industry-trends/healthcare-cyberattack-trends-2019.html

This is a summary of an article written for Inside Digital Health by Fortinet’s National Healthcare Lead, Sonia Arista. The article appeared on August 22, 2019, and can be accessed here.

During the first five months of 2019, healthcare organizations were under nearly constant cyberattack attempts ranging from targeted phishing and customized ransomware incidents to more common exploits such as malware and botnets. The examples below serve as a takeaway so that we can learn from what has come before.
Traditional Healthcare Network Threats
In networks where healthcare providers rely on their mobile devices to provide real-time patient information, compromised phones can become a conduit for introducing additional malware into the network and gaining unauthorized access to patient information.
Targeted Attacks
We have also seen a spike in targeted attacks against healthcare networks. Incidences of an older trojan called Kwampirs, that targets the systems of MRI and X-ray machines and siphons their configuration data, have been documented being actively deployed inside specific networks.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

Useful Searches