Why Healthcare Security Matters

guest · Nov 26, 2019

UPMC Susquehanna admits employee snooped in co-worker’s medical records
November 25, 2019
https://www.pennlive.com/news/2019/...ee-snooped-in-co-workers-medical-records.html

UMPC Susquehanna admits that one of its employees improperly looked at the protected health information of a co-worker who had missed work following a brutal assault.

The admission is contained in a letter attached to the Lycoming County court complaint of Taylor Fausnaught, who is suing the health system and employee Tasha Klock for invasion of privacy and negligence.
Her actions violated UPMC policy and federal privacy laws, and she was disciplined by required to undergo additional training and increased monitoring, the letter states.
Click to expand...

guest · Nov 27, 2019

Misconfigured Staff Calendars Exposed Information of Children’s Minnesota Patients for Up to 9.5 Years
November 26, 2019
https://www.hipaajournal.com/miscon...drens-minnesota-patients-for-up-to-9-5-years/

Children’s Minnesota has started notifying 37,942 patients that information related to their appointments has been exposed and could have been accessed by unauthorized individuals.

The internal, electronic calendars used by certain staff members had been configured in a way that allowed them to be viewed by individuals outside of Children’s Minnesota’s system. The misconfiguration was detected on August 26, 2019 and was immediately corrected to prevent unauthorized access.
It was not possible to determine whether the calendars had been accessed by unauthorized individuals during the time they were accessible.

Children’s Minnesota will be reviewing its security policies and will provide additional training to staff to prevent similar incidents of this nature from occurring in the future.
Click to expand...

Children’s Minnesota: Notice of Privacy Incident

guest · Nov 27, 2019

OCR Secures $2.175 Million HIPAA Settlement after Hospitals Failed to Properly Notify HHS of a Breach of Unsecured Protected Health Information
November 27, 2019
https://www.hhs.gov/about/news/2019...nt-breach-notification-and-privacy-rules.html

In an agreement with the Office for Civil Rights (OCR) at the U.S Department of Health and Human Services (HHS), Sentara Hospitals (Sentara) have agreed to take corrective actions and pay $2.175 million to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Breach Notification and Privacy Rules. Sentara is comprised of 12 acute care hospitals with more than 300 sites of care throughout Virginia and North Carolina.

[...] OCR’s investigation determined that Sentara mailed 577 patients’ PHI to wrong addresses that included patient names, account numbers, and dates of services. Sentara reported this incident as a breach affecting 8 individuals [...] Sentara persisted in its refusal to properly report the breach even after being explicitly advised of their duty to do so by OCR.

“HIPAA compliance depends on accurate and timely self-reporting of breaches because patients and the public have a right to know when sensitive information has been exposed.” said Roger Severino, OCR Director. “When health care providers blatantly fail to report breaches as required by law, they should expect vigorous enforcement action by OCR.”
Click to expand...

ronjor · Nov 28, 2019

ThreatList: Healthcare Breaches Spike in October

Tara Seals November 28, 2019
38 million consumer health records have been exposed so far in 2019.
October experienced a 44.44 percent month-over-month increase in healthcare data breaches, resulting in 661,830 healthcare records exposed or stolen during the month.
Click to expand...

guest · Nov 28, 2019

IvyRehab reports data security breach; has 3 locations in Central Illinois
November 27, 2019
https://herald-review.com/business/...cle_914045b4-c714-57e8-b2e2-ece2c640abde.html

Ivy Rehab Physical Therapy, which has locations in Bloomington, Decatur and Clinton, has reported a data security breach and offering free credit monitoring to concerned patients.
No attempt or actual misuse of patient information has been reported.

Ivy Rehab also is providing more security training for staff and requiring more frequent password changes.
Click to expand...

guest · Nov 29, 2019

Magellan Rx Management Statement Regarding Security Incident
November 27, 2019
https://www.marketwatch.com/press-r...tement-regarding-security-incident-2019-11-27

Magellan Health, Inc. [...] today announced that its subsidiary, Magellan Rx Management, discovered that an anonymous, unauthorized third party accessed the email account of one employee who handles health plan member data.

The Company first learned on July 5, 2019, of a May 28, 2019, incident of unauthorized access to the employee’s email account. The Company immediately secured that email account and conducted a thorough investigation of all email accounts and all other Magellan systems.
The Company believes the employee may have been the target of a phishing scam and that the purpose of the unauthorized access to the email account was to send out email spam.

The affected email account included Moda member information such as name, date of birth, health plan member ID number, health plan name, provider, diagnosis, drug name, and benefit authorization determination and/or number.
Click to expand...

ronjor · Dec 1, 2019

Doctors and techies are clashing at digital health companies, and one start-up exec is seeking a fix

Christina Farr@chrissyfarr Sun, Dec 1 2019
Digital health companies are struggling in part because the clinical teams and the product teams are at odds.
Omada Health’s chief medical officer is working on solutions to bridge the gap.
Start-ups in the industry raised $8 billion last year, and exits are just starting to produce returns.
Click to expand...

guest · Dec 1, 2019

mood said: ↑

French Hospital Crippled by Ransomware
November 21, 2019
https://www.infosecurity-magazine.com/news/french-hospital-crippled-by/
Click to expand...

Rouen hospital confirms 90% of IT services have been resumed after cyberattack rendered computers unusable
November 26, 2019
https://www.healthcareitnews.com/ne...-have-been-resumed-after-cyberattack-rendered

University Hospital Centre (CHU) de Rouen in France has confirmed that 90% of normal IT services are now operational, following a ransomware attack which forced staff to abandon computers last week.

The large-scale cyberattack, which took place around 7pm on 15 November, had “a strong impact on the information system and therefore the activity of the establishment”, according to a statement posted by the hospital on Facebook.
CHU de Rouen’s director of communications, Rémi Heym, told Healthcare IT News: “Our level of security was very high already but to prevent further cyberattacks, we have checked our processes and applications with the help of the National Agency for Security of Information Systems (ANSSI).”

The majority of services were resumed around midnight and the hospital said there had been no direct impact on patient care.
Click to expand...

ronjor · Dec 2, 2019

Amazon debuts automatic speech recognition service, Amazon Transcribe Medical

Sarah Perez@sarahintampa December 2, 2019
Amazon is expanding its automatic transcription service for AWS, Amazon Transcribe, to include support for medical speech, the company announced this morning at its AWS re:Invent conference. The new machine learning-powered service, Amazon Transcribe Medical, will allow physicians to quickly dictate their clinical notes and speech into accurate text in real time, without any human intervention, Amazon claims.
Click to expand...

ronjor · Dec 2, 2019

Dexcom glitch kept parents of children with diabetes in the dark over their conditions this weekend

Christina Farr@chrissyfarr Dec 2 2019
Dexcom has experienced technical issues since Saturday morning, keeping parents from learning when a child with diabetes is experiencing dangerous blood sugar swings.
Dexcom blamed the problem on a “server overload,” which “generated a massive backlog.”
As of Monday, the service was still intermittent for some users.
Click to expand...

guest · Dec 3, 2019

Fears over patient data breach after cyberattack on Monash IVF
December 3, 2019
https://www.theage.com.au/national/...ber-attack-on-monash-ivf-20191203-p53gj0.html

One of Australia's largest IVF providers has warned patients that it could not rule out the possibility their personal information may have been breached following a widespread cyberattack on staff emails last month.

Monash IVF Group, which is attached to clinics in six Australian states and territories, said scammers accessed emails, email addresses and address books belonging to a number of staff members in the targeted phishing attack.
Chief executive Michael Knaap confirmed on November 6 that the company's staff email system was targeted by a “malicious cyberattack”.

While the investigation found confidential patient databases were untouched, the national fertility business said in an email to patients on Tuesday afternoon that staff emails containing sensitive patient information, including medical histories, may have been hacked.
Click to expand...

guest · Dec 3, 2019

ronjor said: ↑

Ford is taking its GoRide patient transport service nationwide
Click to expand...

Ford to shut down GoRide Health service and pivot to AV research
December 3, 2019
https://techcrunch.com/2019/12/03/ford-to-shut-down-goride-health-service-and-pivot-to-av-research/

Six months ago, Ford laid out an ambitious plan to expand its GoRide Health transportation service with an aim at delivering thousands of rides every day to hospitals, doctor offices and other health care facilities by the end of the year. In a few weeks, the service, which provided transportation for non-emergency care, will no longer exist — at least in its current form.

GoRide Health is pivoting. The automaker will shut down GoRide Health services in five cities in which it currently operates, including Detroit as well as Toledo, Dayton, Cleveland and Cincinnati, Ohio.

“Our learnings from GoRide Health have led to a shift in strategy,” Ford said in an emailed response to TechCrunch. “We are moving to test the potential for AV technology to help improve access to transportation for those with limited mobility.”
The decision to end the services and change its strategy was made recently and timed with supplier contract extensions. It’s being shuttered despite Ford’s contention that the service was well-received and achieved high on-time rates thanks to its dynamic routing technology that automatically dispatches and pools rides.
Click to expand...

ronjor · Dec 3, 2019

A Tale of Two Breach Lawsuits

Marianne Kolbasuk McGee (HealthInfoSec) December 3, 2019
Nuance Sued Following NotPetya Attack; Solara Medical Supplies Sued for Exposing Patient Data
Click to expand...

guest · Dec 4, 2019

mood said: ↑

Presbyterian data breach affects some 183,000 patients
August 2, 2019
https://www.abqjournal.com/1348856/...fo-but-do-not-seem-to-have-used-anything.html
Click to expand...

Presbyterian Healthcare Services said data stolen in May breach appears to have not been misused
December 3, 2019
https://www.santafenewmexican.com/n...cle_7d59dfa7-3a4f-5350-aac9-e52144bd4941.html

Nearly four months after Presbyterian Healthcare Services reported a data breach that allowed unauthorized access to personal information belonging to over 180,000 patients and health plan members, the provider sent out a notification letter telling its members the company does not believe anyone has improperly used that data.

Dale Maxwell, president and chief executive officer of Presbyterian Healthcare Services, said in an email Tuesday that “while the investigation is ongoing, we want to stress that we have no evidence indicating that any patient or member data has been used in any way and there was no access to our electronic health record or billing systems.”
Maxwell said Tuesday that Presbyterian takes” the responsibility of protecting the privacy of our patients and members very seriously. We deeply regret that this event occurred and are committed to taking steps to help prevent this type of incident from happening again.”
Click to expand...

guest · Dec 4, 2019

Nebraska Medical Center is warning patients about data breach
December 4, 2019
https://siouxlandnews.com/news/local/nebraska-medical-center-is-warning-patients-about-data-breach

Officials with the Nebraska Medical Center says someone who shouldn't have had access to patient information did gain access. Information like names, addresses, dates of birth, social security numbers, medical test results and more were all stored in the breached database.

They say if you received a letter from the hospital, you're one of those people. Officials say they were running an audit of their medical record system and found an employee got into those records sometime between July and October.
Hospital officials were not able say just how many patients' had their data accessed, but did say they don't think the information was or will be misused.
The employee was fired the day after officials found out.
Click to expand...

guest · Dec 4, 2019

Healthcare Threat Detections Up 45% in Q3 and 60% Higher Than 2018
December 3, 2019
https://www.hipaajournal.com/healthcare-threat-detections-up-45-in-q3-2019-and-60-higher-than-2018/

Cyberattacks on healthcare organizations have increased in frequency and severity in the past year, according to recently published research from Malwarebytes.

In its latest report – Cybercrime Tactics and Techniques: The 2019 State of Healthcare – Malwarebytes offers insights into the main threats that have plagued the healthcare industry over the past year and explains how hackers are penetrating the defenses of healthcare organizations to gain access to sensitive healthcare data.
Cyberattacks on healthcare organizations can have severe consequences. As we have seen on several occasions this year, attacks can cause severe disruption to day to day operations at hospitals often resulting in delays in healthcare provision.

Malwarebytes data shows the healthcare industry was the seventh most targeted industry sector from October 2018 to September 2019, but if the current attack trends continue, it is likely to be placed even higher next year.
Click to expand...

Malwarebytes: "Cybercrime tactics and techniques: the 2019 state of healthcare"
(PDF - 3.56 MB): https://resources.malwarebytes.com/files/2019/11/191028-MWB-CTNT_2019_Healthcare_FINAL.pdf

guest · Dec 4, 2019

Nebraska Medicine 'aware' of data breach, records accessed by former employee
December 3, 2019
https://www.ketv.com/article/nebras...-records-accessed-by-former-employee/30107687

Nebraska Medicine has issued a statement, saying it is aware of a data breach.
KETV NewsWatch 7 obtained a copy of a letter apparently sent to affected patients, informing them of an "incident involving" patient information confidentiality.

"On Oct. 1, 2019, during an audit of our electronic medical record system, Nebraska Medicine discovered that an employee accessed patient records outside of the employee's job responsibility."
The employee's access was reportedly terminated the next day. The individual is no longer employed at Nebraska Medicine.

Casillas moved from Texas to be treated at Nebraska Medicine. She still is getting treatment there.

"I feel trapped. I have to continue my care here, but I don't trust them with my information at all," Casillas said.
The letter by Nebraska Medicine privacy officer Debra Bishop says: "To help prevent something like this from happening again, we are continuing to regularly audit our electronic medical record system for potential unauthorized activity, and are retraining staff about appropriate access of patient information."
Click to expand...

guest · Dec 5, 2019

mood said: ↑

Data Breach at KRH May Have Affected 129,000 Patients’ Personal Information
October 22, 2019
https://flatheadbeacon.com/2019/10/...ffected-129000-patients-personal-information/
Click to expand...

Kalispell hospital sued over data breach
December 4, 2019
https://www.abcfoxmontana.com/news/...cle_ca2c2c4a-0869-50fe-8b31-cbeeb646267f.html

Kalispell Regional Healthcare, northwest Montana's largest healthcare provider, was sued late last month by one of the 130,000 patients whose information was possibly compromised in a data breach announced by the hospital in October.

William Henderson, represented by Billings attorney John Heenan, filed the civil complaint in Cascade County District Court on Nov. 25. The suit alleges Kalispell Regional Healthcare failed to take the necessary steps to protect patients' private information before the breach. The complaint seeks to certify more plaintiffs into a class action lawsuit.

"This has been a way that criminals have tried to gain access to peoples' private information and specifically their private healthcare information," Heenan said in a phone interview Wednesday. "It's our contention by filing this lawsuit that they should have done a lot better by their patients in protecting that information."
Henderson's lawsuit alleges the data breach was "caused by KRH's failure to abide by best practices and industry standards" in securing patient data.
Click to expand...

guest · Dec 6, 2019

Southeastern Minnesota Oral & Maxillofacial Surgery Ransomware Attack Impacts 80,000 Patients
December 6, 2019
https://www.hipaajournal.com/southe...ery-ransomware-attack-impacts-80000-patients/

Southeastern Minnesota Oral & Maxillofacial Surgery (SEMOMS) has announced it has been attacked with ransomware and that the protected health information of up to 80,000 patients was potentially compromised in the attack.

The attack was detected on September 23, 2019. The IT team responded and isolated the affected server and took steps to restore the encrypted data. It is unclear whether the ransom was paid or if the IT team was able to restore the server from backups.
Assisted by computer forensics experts, SEMOMS determined that the affected server contained names and X-ray images and that the server had been accessed by an unauthorized individual.
Click to expand...

Healthcare Administrative Partners Phishing Attack Impacts 17,693 Patients
Healthcare Administrative Partners (HAP), a Media, PA-based provider of medical billing and coding services to healthcare organizations, has discovered the email account of one of its employees was accessed by an unauthorized individual following a response to a phishing email.
The phishing attack was detected on June 26, 2019 when suspicious activity was identified in the employee’s email account. On September 26, 2019, HAP determined that the protected health information of certain clients was present in the email account.

Steps have now been taken to improve email security.
Click to expand...

Elizabeth Family Health Notifies 28,375 Patients About Data Exposure
The Elizabeth, CO-based healthcare provider, Elizabeth Family Health, is notifying 28,375 patients that some of their protected health information has been exposed.
On September 23, 2019, Elizabeth Family Health suffered a break-in and its facilities were vandalized. The perpetrator removed several items from its facilities, including server backup tape cartridges.
Click to expand...

guest · Dec 6, 2019

NHS radiographer, 32, faces jail after illegally accessing more than 200 female patients' personal records before hounding them for dates
December 6, 2019
https://www.dailymail.co.uk/news/ar...legally-accessing-records-hounding-dates.html

An NHS radiographer who illegally accessed the personal records of more than 200 female patients before pestering them for dates is facing jail.

Andrew Stewart, 32, who worked at hospitals in Lanarkshire and Ayrshire, used his position to look up patient files of women he had been treating and made a note of their contact details.
His crimes were uncovered when a woman he had been messaging recognised him at Crosshouse Hospital in Kilmarnock and reported it.

A massive probe was launched within the NHS leading to hundreds of patients receiving letters saying that their data had been breached.
He has now appeared at Hamilton Sheriff Court and admitted two charges of obtaining personal data of 32 named women and others without a clinical or medical reason to do so.
Click to expand...

guest · Dec 7, 2019

Data Privacy Event Disclosed by Sunrise Community Health
December 6, 2019
https://www.tripwire.com/state-of-s...-event-disclosed-by-sunrise-community-health/

Sunrise Community Health disclosed a data privacy event that might have affected some patients’ personal and medical information.

In the fall of 2019, Sunrise Community Health (“Sunshine”) learned of a data privacy incident through which an unauthorized party gained access to some of its employees’ email accounts.
Those pieces of data included patients’ names, dates of birth, Sunrise patient ID, provider name, medical test results, health insurance information and diagnosis details.
Beyond working to strengthen the security measures of its systems, the community health center also revealed that it’s in the process of notifying affected individuals about the incident. As quoted in a statement published by PR Newswire: [...]
[/quote9
Click to expand...

guest · Dec 9, 2019

NSW Ambulance expected to settle data breach class action
Court hearing to decide the value of the data about 130 Ambulance staff
December 8, 2019
https://www.cio.com.au/article/669509/nsw-ambulance-expected-settle-data-breach-class-action/

A settlement is expected to be reached in a class action brought against the NSW Ambulance Service relating to sensitive health and personal information that was illegally sold by a contractor.

Centennial Lawyers filed a class action in the Supreme Court of NSW on 20 November 2017 on behalf of all NSW Ambulance 130 employees and contractors whose sensitive health and personal information was inadvertently accessed between 14 January 2013 and 1 February 2013.
A contractor was given access to NSW Ambulance Service's records and database, he then collected and sold this information and, in 2016, was found guilty of unlawfully disclosing the information.

“Employers have a duty of confidence to their employees and they must take adequate steps to protect their employee records and this case highlights the damage that can be done if data security is breached," principal solicitor of Centennial Lawyers George Newhouse said.
Click to expand...

guest · Dec 9, 2019

ronjor said: ↑

3.7M potential victims of US health service hack
Click to expand...

Banner Health agrees to $6 million settlement over 2016 breach
December 9, 2019
https://www.modernhealthcare.com/cy...-agrees-6-million-settlement-over-2016-breach

Banner Health has agreed to pay up to $6 million to victims of a massive data breach the Arizona health system experienced in 2016, according to court documents filed last week.

Under the deal, nearly 3 million people who Banner notified after a 2016 data breach would be able to request reimbursement claims for expenses from the incident. Each class member's reimbursement is capped at $500 for ordinary expenses and $10,000 for extraordinary expenses. The overall cap that Banner agreed to is $6 million.
The settlement will provide "substantial monetary and injunctive relief" to the 2.9 million people who Banner notified after the 2016 data breach, according to the plaintiffs.

"However, we are hopeful that it will be resolved soon, at which time those who were impacted can learn additional information," she said. "In the meantime, data security is one of our highest priorities and we continue to work diligently to protect the sensitive information of our patients and employees."
Click to expand...

guest · Dec 9, 2019

More than half of NHS devices are still running Windows 7
And 20 per cent of Trusts have no plans to upgrade
December 9, 2019
https://www.theinquirer.net/inquirer/news/3084544/nhs-trusts-windows-7-half-devices

NHS Trusts are still running Microsoft's soon-to-be-defunct Windows 7 operating system on more than 20,000 devices.

That's according to cloud computing firm Citrix, which obtained the information through a Freedom of Information (FoI) request. The request was sent to 98 NHS Trusts across the UK, of which 77 responded.
As per the FoI, 52 per cent of the total 447,000+ devices being used in the NHS, including desktops, laptops, and tablets, are still running Windows 7, which reaches end-of-life status on 14 January 2020.
That's despite the fact that the Department of Health and Social Care (DHSC) last year announced a £150m plan to upgrade all NHS systems to Windows 10 by the time that Windows 7 reaches the digital graveyard.
Click to expand...

guest · Dec 10, 2019

NHS gives Amazon free use of health data under Alexa advice deal
December 8, 2019
https://www.theguardian.com/society...ee-use-of-health-data-under-alexa-advice-deal

Amazon has been given free access to healthcare information collected by the NHS as part of a contract with the government.
The material, which excludes patient data, could allow the multinational technology company to make, advertise and sell its own products.

But responses to freedom of information requests, published by the Sunday Times, showed the contract will also allow the company access to information on symptoms, causes and definitions of conditions, and “all related copyrightable content and data and other materials”.
Labour’s shadow health secretary, Jonathan Ashworth, told the Sunday Times that the government was “highly irresponsible” and “in the pocket of big corporate interests”.

An NHS spokesperson said: “No patient data is being provided to this company by the NHS, which takes data privacy extremely seriously and has put appropriate safeguards in place to ensure information is used correctly.”

Amazon told the Sunday Times the content it had access to was already on the NHS website. “Amazon does not build customer health profiles based on interactions with nhs.uk content or use such requests for marketing purposes,” it added.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches