Why Healthcare Security Matters

guest · Jan 19, 2020

mood said: ↑

Health Quest privacy breach potentially exposes patient information
June 1, 2019
https://eu.poughkeepsiejournal.com/...ially-exposes-patient-information/1311094001/
Click to expand...

Quest Health Systems Discovers Additional Patients Impacted by 2018 Phishing Attack
January 17, 2020
https://www.hipaajournal.com/quest-...al-patients-impacted-by-2018-phishing-attack/

Health Quest, now part of Nuvance Health, has discovered the phishing attack it experienced in July 2018 was more extensive than previously thought.

A secondary investigation of the breach revealed on October 25, 2019 that another employee’s email account was compromised which contained protected health information. According to the substitute breach notification on the Quest Health website, the compromised information varied from patient to patient, but may have included one or more of the following data elements in addition to names: [...]

Quest Health is now using multi-factor authentication on its email accounts and has strengthened security processes and provided additional training to its HQ employees on phishing and other cybersecurity issues.
It is currently unclear how many additional patients have been affected.
Click to expand...

guest · Jan 20, 2020

Saskatoon Sexual Health laptop containing 156 patients' information stolen in November 2018
January 20, 2020
https://thestarphoenix.com/news/loc...-patients-information-stolen-in-november-2018

In a Jan. 14 report, Ron Kruzeniski wrote that he found the clinic had taken reasonable steps to contain the breach stemming from the theft and has a plan in place to ensure it doesn’t happen again.

On Nov. 15, 2018, someone broke into the Saskatoon Sexual Health clinic, setting off alarms. The alarms had gone off twice that morning, and Saskatoon police responded to the first alarm.
They found the back door of the building was unlocked and later learned from staff that two laptops were missing. One of them contained scanned copies of patient’s records.

Saskatoon Sexual Health told the privacy commissioner that police had investigated and closed the file without recovering the laptops or making any arrests, according to Kruzeniski’s report. The clinic told the privacy commissioner it was able to account for all records that were on the stolen laptop.
Click to expand...

Kruzeniski advises organizations that do store information on mobile devices to keep them in locked drawers or cabinets and use encryption as well as strong passwords.
Click to expand...

guest · Jan 21, 2020

44,000 Patients Impacted by Phishing Attacks on InterMed and Spectrum Healthcare Partners
January 17, 2020
https://www.hipaajournal.com/44000-...on-intermed-and-spectrum-healthcare-partners/

The Portland, ME-based healthcare provider InterMed is notifying 33,000 patients that some of their protected health information has potentially been compromised as a result of a phishing attack.
The attack was detected on September 6, 2019. An internal investigation confirmed that the account was compromised on September 4 and the attackers had access to the account until September 6, 2019.

Steps have now been taken to improve email security and training has been reinforced to ensure employees adhere to email security best practices.
Phishing Attack Impacts 11,308 Patients of Central Maine Orthopaedics
11,308 patients of Central Maine Orthopaedics, part of Spectrum Healthcare Partners, are being notified that some of their protected health information has potentially been viewed by an unauthorized individual who gained access to the email account of one of its employees.
Spectrum Healthcare Partners has strengthened its technical controls and is providing more stringent security training to employees.
Click to expand...

4,564-Record Breach Reported by Children’s Hope Alliance
The Barium Springs, NC-based child welfare agency, Children’s Hope Alliance, has announced that a laptop computer containing sensitive information has been stolen.
According to the substitute breach notice on the Children’s Hope Alliance website, the laptop was stolen on October 7, 2019.

The breach summary states that this was a hacking/IT incident involving email. It is unclear at this stage whether this is an error, a separate breach, or if the laptop was used to hack into the employee’s email account.
Click to expand...

guest · Jan 21, 2020

Federal Breach Tally: 2020 Trends So Far
January 21, 2020
https://www.databreachtoday.com/federal-breach-tally-2020-trends-so-far-a-13633

Three weeks into the new year, several hacking incidents involving email have already been added to the federal tally of major health data breaches.

A snapshot Tuesday of the Department of Health and Human Services' HIPAA Breach Reporting Tool website shows seven data breaches have been added so far in 2020, affecting a total of nearly 131,000 individuals.
All but one of those were reported as hacking/IT incidents involving email.
Hacking Incidents
The largest of the breaches added to the federal tally so far in 2020 is an incident affecting more than 49,000 individuals reported on Jan. 3 by Minnesota-based Douglas County Hospital, which is operated by Alomere Health.
Click to expand...

Looking Ahead
So what kinds of breaches should healthcare entities be on alert for as 2020 progresses?

"Ransomware is almost certain to continue to be a lead cause of health data breaches," Borten predicts. "It is a low-budget attack that can yield nice profits for the perpetrators. And success relies in part on individuals who are not being mindful."
Click to expand...

guest · Jan 22, 2020

Google CEO eyes major opportunity in healthcare, says will protect privacy
January 22, 2020
https://www.reuters.com/article/us-...hcare-says-will-protect-privacy-idUSKBN1ZL1EG

Sundar Pichai, the CEO of Alphabet Inc and its Google subsidiary, said on Wednesday that healthcare offers the biggest potential over the next five to 10 years for using artificial intelligence to improve outcomes, and vowed that the technology giant will heed privacy concerns.

U.S. lawmakers have raised questions about Google’s access to the health records of tens of millions of Americans. Ascension, which operates 150 hospitals and more than 50 senior living facilities across the United States, is one of Google’s biggest cloud computing customers in healthcare.

“When we work with hospitals, the data belongs to the hospitals,” Pichai told a conference panel at the World Economic Forum in Davos, Switzerland.
Pichai said there was already strong privacy protecting regulations in place that provide a framework for Google to operate.
Click to expand...

guest · Jan 22, 2020

Report: Cannabis Users’ Sensitive Data Exposed in Data Breach
January 22, 2020
https://www.vpnmentor.com/blog/report-thsuite-breach/

Led by internet privacy researchers Noam Rotem and Ran Locar, vpnMentor’s research team discovered a data breach in THSuite, a point-of-sale system in the cannabis industry.

Our team identified an unsecured Amazon S3 bucket owned by THSuite that exposed sensitive data from multiple marijuana dispensaries around the US and their customers.
The leaked data included scanned government and employee IDs, exposing personally identifiable information (PII) for over 30,000 individuals.
Privacy Concerns for Cannabis Users
As a result of this data breach, sensitive personal information was exposed for medical marijuana patients, and possibly for recreational marijuana users as well. This raises some serious privacy concerns.
Medical patients have a legal right to keep their medical information private for good reason. Patients whose personal information was leaked may face negative consequences both personally and professionally.
Impact on Dispensaries
The data breach also affects dispensaries that trusted THSuite with their private information. These dispensaries may find themselves facing major consequences because of the possible HIPAA violation created by this breach.
Click to expand...

guest · Jan 22, 2020

December 2019 Healthcare Data Breach Report
January 21, 2020
https://www.hipaajournal.com/december-2019-healthcare-data-breach-report/

There were 38 healthcare data breaches of 500 or more records reported to the Department of Health and Human Services’ Office for Civil Rights in December 2019, an increase of 8.57% from November 2019.

While the number of breaches increased, there was a major reduction in the number of exposed healthcare records, falling from 607,728 records in November 2019 to 393,189 records in December 2019 – A drop of 35.30%. In December the mean breach size was 10,347 records and the median breach size was 3,650 records.
Causes of December 2019 Healthcare Data Breaches
There were 21 hacking/IT incidents reported by HIPAA-covered entities and business associates in December. 226,774 healthcare records were exposed or stolen in those incidents. The mean breach size was 10,798 records and the median breach size was 5,991 records. The incidents mostly consisted of phishing attacks, ransomware and malware infections, and coding errors. [...]
Click to expand...

guest · Jan 22, 2020

It's not just Google: Amazon, Microsoft, IBM get hospital data, too
January 22, 2020
https://mashable.com/article/microsoft-aws-ibm-get-hospital-patient-data-privacy/

Big data has become big business in healthcare.
The public freaked out in November 2019 at the Wall Street Journal’s revelations that Google was taking in non-anonymous healthcare information from hospital network Ascension.

Now, a new report from the Journal shows that the tech giant is far from alone: Microsoft, Amazon Web Services (AWS), and IBM also have data-sharing agreements with hospitals.
Startups, traditional health companies, and tech giants alike are pursuing data collection so that they can make tools that they say will help detect, predict, or prevent disease more efficiently than humans can.

According to the Journal, Microsoft is working on a “cancer algorithm” with Providence hospitals that reads information from doctors’ notes. AWS has a similar agreement with Seattle’s Fred Hutchinson Cancer Research Center. That data from doctors could contain information that matches an individual with their health data.
In regard to Microsoft and Amazon's deals, some of that data definitely did include identifiable info; in some cases, they said it wasn't possible to strip it all out.
Click to expand...

guest · Jan 23, 2020

Critical MDhex Vulnerabilities Shake the Healthcare Sector
January 23, 2020
https://www.bleepingcomputer.com/ne...-vulnerabilities-shake-the-healthcare-sector/

Critical vulnerabilities have been discovered in popular medical devices from GE Healthcare that could allow attackers to alter the way they function or render them unusable.
A set of six security flaws, they have been collectively named MDhex. Five of them received the highest severity rating on the Common Vulnerability Scoring System, 10 out of 10.
Healtcare monitors and servers impacted
Reported by CyberMDX, a healthcare cybersecurity company, the vulnerabilities affect GE CARESCAPE Patient Monitors, ApexPro telemetry (server/tower) systems, and Clinical Information Center (CIC) Pro systems.

Common to all the flaws is that exploiting them provides the attacker a direct path to the target device and allows them to read, write, or upload data.
The MDhex vulnerability bundle
Credited for the discovery of the MDhex bugs is Elad Luz, Head of Research at CyberMDX. He says that exploitation avenues depend on the affected system's design and configuration. [...]
Click to expand...

Responsible disclosure and coordination
It is unclear how many devices are vulnerable at a global level but CyberMDX believes that the install base could be in the hundreds of thousands.
Click to expand...

CyberMDX: CyberMDX Research Team Discovers Vulnerability in GE CARESCAPE, ApexPro, and Clinical Information Center (CIC) systems

guest · Jan 23, 2020

Epic’s CEO is urging hospital customers to oppose rules that would make it easier to share medical info
...patient privacy will be negatively impacted
January 23, 2020
https://www.cnbc.com/2020/01/22/epi...ospitals-to-oppose-hhs-data-sharing-rule.html

Epic Systems, one of the largest medical records companies, emailed the chief executives of some of the largest hospitals in the U.S. on Wednesday, urging them to oppose proposed regulation designed to make it easier to share medical information.

The email, which was written by Epic CEO Judy Faulkner and addressed to CEOs and presidents of hospital systems, urges recipients to sign a letter alongside Epic that voices disapproval for rules the Department of Health and Human Services proposed in 2019.
The proposed rules have pit patient advocates against some doctor groups and companies, like Epic. Critics say they don’t have enough provisions to protect patients’ privacy.

On the other side, patient advocates have spoken out in favor of the rules, which aim to make medical records accessible through application programming interfaces (APIs). The rules are also designed to make it easier for hospitals to share patient records with other medical offices or hospitals.
Click to expand...

‘Very little time is left’
The letter includes an urgent call to action. “HHS needs to hear from you so they understand that you feel these issues are important,” it says. “Very little time is left.”
Epic confirmed that it sent the letter.
Click to expand...

guest · Jan 23, 2020

Battle Creek Medical Center Data Hacked And Held For Ransom
January 23, 2020
https://detroit.cbslocal.com/2020/01/23/battle-creek-medical-center-data-hacked-and-held-for-ransom/

An important consumer alert for those of you who recently visited the hospital, hackers might be accessing your personal information.
It happened to the brookside surgery center in battle creek.

Doctors say hackers infected their computers with ransomware and then demanded $6,500 to fix it.
Officials say patient data was deleted in the process… But not shared with anyone else.
Click to expand...

guest · Jan 24, 2020

mood said: ↑

Healthcare cybersecurity for 2020 and beyond
January 7, 2020
https://cybersecurity.att.com/blogs/security-essentials/healthcare-cybersecurity-for-2020-and-beyond
Click to expand...

part 2
Healthcare security: How can blockchain help?
January 23, 2020
https://cybersecurity.att.com/blogs/security-essentials/healthcare-security-how-can-blockchain-help

This is part 2 of a blog on healthcare security. For more info, check out part 1. An independent guest blogger wrote this blog.

When it comes to data security, there is no more important place than the healthcare industry. When people go to the doctor, they provide all of their most sensitive information, from their health issues to their phone number, to a doctor they trust. When a medical office or database is hacked or damaged, and that information is released, it can be catastrophic to everyone involved.
Here are some best practices for now and advanced security platforms to look forward to in the future.
Click to expand...

guest · Jan 24, 2020

US neurological healthcare facility discloses data security incident
Unauthorized access to employee email compromises some patient info
January 23, 2020
https://portswigger.net/daily-swig/...are-facility-discloses-data-security-incident

A neurological healthcare facility in the US has reported a data security incident impacting an undisclosed number of patients.

The Center for Neurological and Neurodevelopmental Health (CNNH), a medical and psychological treatment service for neurodiverse individuals, reported this week that it had detected suspicious activity on an employee’s email account, beginning November 22, 2019.

“CNNH immediately took steps to secure the account and worked with a cybersecurity firm to assist in its investigation,” the organization, which operates locations in New Jersey and Pennsylvania, said in a press release.
The investigation found that unauthorized access to the email account in question had occurred between October 7 and November 22 of last year, potentially affecting the personal information of some CNNH patients.

CNNH, which offers services for infants, children, and adults, said that it would be improving its security measures following the incident.

“To help prevent something like this from happening in the future, CNNH has enhanced its email security, enabled multi-factor authentication on all email accounts, and is continuing to educate employees on email security.”
Click to expand...

guest · Jan 25, 2020

DHS data breach: Boxed for shredding, documents were dumped by janitor instead
January 24, 2020
https://eu.desmoinesregister.com/st...tion-department-of-human-services/4568004002/

The Iowa Department of Human Services reported Friday a data breach that occurred in November involving personal information of 4,784 individuals related to income maintenance and social work cases in Dallas County, according to a DHS news release.

A contracted custodial company mistakenly emptied boxes containing documents to be shredded into the office’s garbage dumpster. The incident was not discovered until after the garbage dumpster had been emptied.

"As a precaution, notifications were sent to all case parties whose information may have been printed and thrown into the garbage dumpster without being confidentially shredded. The department has had no reports that any affected parties had their information misused."
"DHS has clarified with all employees that all confidential paperwork must be secured to ensure confidentiality of its clients and the employees in the office were required to take refresher confidentiality training," Highland wrote.
Click to expand...

ronjor · Jan 25, 2020

Apple and Microsoft representatives are set to join a meeting on Monday promoting patient access to health data

Jan 24 2020 Christina Farr@chrissyfarr
Key Points
Apple and Microsoft will be represented by phone at a meeting designed to help push through a policy change to let consumers access their data “without further delay.”
Google was not on the attendee list but a representative told CNBC that the company supports greater openness.
Epic Systems has taken the opposing view, arguing that the rule will have a detrimental effect on patient privacy.
Click to expand...

guest · Jan 25, 2020

Nearly 200,000 Patients Impacted by PIH Health Phishing Attack
January 24, 2020
https://www.hipaajournal.com/nearly-200000-patients-impacted-by-pih-health-phishing-attack/

PIH Health, a 2-hospital nonprofit healthcare network based in Whittier, CA, has started notifying nearly 200,000 patients about a potential breach of their personal and protected health information in June 2019.

On June 18, 2019, PIH Health discovered the email accounts of certain employees had been accessed by unauthorized individuals as a result of a targeted phishing attack on its employees. The email accounts were immediately secured and an investigation was launched to determine the nature and extent of the breach.
PIH Health engaged leading cybersecurity experts to assist with the investigation and was notified on October 2, 2019, that the email accounts were subject to unauthorized access between June 11, 2019 and June 18, 2019.
Click to expand...

PIH Health: Notification of Data Security Incident

guest · Jan 25, 2020

Beaumont investigating security breach of 1,200 patient files
January 25, 2020
https://eu.detroitnews.com/story/ne...tient-files-informations-michigan/4574470002/

Beaumont Health officials are investigating a security breach by a former employee who accessed patient information, hospital officials said Saturday.

Beaumont notified 1,182 individuals about the incident on Friday saying a now-former employee had unauthorized access of patient information. The employee, who was terminated, is suspected of disclosing information to an individual working on behalf of a personal injury attorney, the hospital said.
The hospital's investigation determined on Dec. 10 that from Feb. 1, 2017, until Oct. 22, the former employee access and disclosed protected health information.
Click to expand...

guest · Jan 27, 2020

Tidelands Health named in class action lawsuit after December malware attack
January 25, 2020
https://wpde.com/news/local/tidelan...-action-lawsuit-after-december-malware-attack

The impacts of the December 12 cyberattack on the Tidelands Health Hospital System are unclear, but what is clear is that patients feel they were victimized as a result of negligence.

A class-action lawsuit was filed in federal court this week holding the hospital system liable for the attack and the treatment of patients thereafter.
The lawsuit calls the attack an act of ransomware that disrupted the operations of Tidelands Health, blocking the systems and data and included the disclosure of "highly sensitive" patient medical records of thousands of patients.

"It was a holy mess there," Kersey said. "Use this as a warning because you could be taking people's lives because you are not doing a backup."

The lawsuit claims the hospital system lost names, demographic information, date of birth, Social Security numbers and health insurance information among other information in the attack.
The attorneys claim since this breach, the hospital system has allowed that information to be at risk for fraud and identity theft.
Click to expand...

guest · Jan 28, 2020

ronjor said: ↑

LabCorp data breach exposes information of 7.7 million consumers
Click to expand...

another incident:
LabCorp security lapse exposed thousands of medical documents
January 28, 2020
https://techcrunch.com/2020/01/28/labcorp-website-bug-medical-data-exposed/

A security flaw in LabCorp’s website exposed thousands of medical documents, like test results containing sensitive health data.
It’s the second incident in the past year after LabCorp said in June that 7.7 million patients had been affected by a credit card data breach of a third-party payments processor. That breach also hit several other laboratory testing companies, including Quest Diagnostics.

This latest security lapse was caused by a vulnerability on a part of LabCorp’s website, understood to host the company’s internal customer relationship management system. Although the system appeared to be protected with a password, the part of the website designed to pull patient files from the back-end system was left exposed.
The bug is now fixed.
Click to expand...

“This is a massive privacy issue — and one that could impact affected users and patients for years to come,” said Rachel Tobac, a hacker, social engineer, and founder of SocialProof Security. “The sensitive nature of those documents and the leak of private medical status is a huge privacy violation for those patients for obvious reasons, but also sadly for some possibly less glaring reasons, as well.”
Click to expand...

ronjor · Jan 28, 2020

Monday, January 27, 2020
Electronic Health Records Vendor to Pay $145 Million to Resolve Criminal and Civil Investigations

Practice Fusion Inc. Admits to Kickback Scheme Aimed at Increasing Opioid Prescriptions
Practice Fusion Inc. (Practice Fusion), a San Francisco-based health information technology developer, will pay $145 million to resolve criminal and civil investigations relating to its electronic health records (EHR) software, the Department of Justice announced today.
Click to expand...

guest · Jan 30, 2020

Only 6 ransomware attacks on the UK's NHS since WannaCry worm hit in 2017 – report
209 incidents since 2014, say Freedom of Information figures
January 29, 2020
https://www.theregister.co.uk/2020/01/29/ransomware_in_the_nhs_survey/

The NHS has suffered 209 successful ransomware attacks since 2014, according to new figures based on Freedom of Information requests, but with a dramatic improvement since 2017, the year WannaCry ransomware hit the health service.

The figures, posted in a report from research company Comparitech [...]
The researchers surveyed 254 NHS Trusts, with 184 responding, 20 not responding and 50 refusing to hand over the information requested.
Click to expand...

Comparitech: Freedom of Information requests reveal 65 NHS trusts affected by ransomware in the last 5 years

guest · Jan 30, 2020

Access Health warns of data breach affecting 1,100 customers
January 29, 2020
https://westfaironline.com/120880/access-health-warns-of-data-breach-affecting-1100-customers/

A security breach at Access Health CT put the personal information and Social Security numbers of some 1,100 Access Health CT customers at risk last fall, according to the state health insurance exchange.

Those customers will receive an orange envelope in the mail this week notifying them of the compromising of their information, as well as instructions on how to enroll in credit monitoring or enact a credit freeze.

“Access Health CT takes the privacy and security of consumers’ personal information seriously, and it is making this public notice in an abundance of caution,” said the organization’s CEO, James Michel.
Following the identification of the data breach, AHCT worked with third-party experts to assess risk and help with proactive steps the agency can take to mitigate a reoccurrence.
Click to expand...

guest · Jan 30, 2020

Fake Exec Tricks New York City Medical Center into Sharing Patient Info
January 30, 2020
https://www.infosecurity-magazine.com/news/fake-exec-tricks-new-york-city/

An employee at a New York City medical center was tricked into giving out patient information by a threat actor purporting to be one of the facility's executives.
The data was shared by an individual at community-based non-profit the VillageCare Rehabilitation and Nursing Center (VCRN) who had received what they believed to be a genuine email from a senior member of staff.

In a Notice of Data Privacy Incident statement published on VCRN's website, the company stated: "The unauthorized actor requested certain information related to VCRN patients. Believing the request to be legitimate, the employee provided the information."
Information obtained by the threat actor included first and last names, dates of birth, and medical insurance information, including provider name and ID number for 674 patients.

Becoming a victim of a phishing scam has led VCRN to review its cybersecurity practices.
Click to expand...

VCRN Notice of Data Privacy Incident
VillageCareMAX Notice of Data Privacy Incident

guest · Jan 30, 2020

mood said: ↑

Epic’s CEO is urging hospital customers to oppose rules that would make it easier to share medical info
...patient privacy will be negatively impacted
January 23, 2020
Click to expand...

Long-Awaited HHS Data Sharing Rules Raise Privacy Worries
January 30, 2020
https://www.inforisktoday.com/long-awaited-hhs-data-sharing-rules-raise-privacy-worries-a-13671

As the wait continues for federal regulators to issue final rules for health IT interoperability and information blocking prevention, some industry stakeholders are raising serious concerns about the privacy of patient data accessed and shared using application programming interfaces and mobile consumer apps.

HHS' proposed rules on interoperability and information blocking prevention, which were released in February 2019, have been under review by the Office of Management and Budget since last fall and are expected to be issued soon
Critics Voice Concerns
Both of the HHS rules generated thousands of public comments, including many critical of the proposals.
Click to expand...

While Epic did not immediately respond to an Information Security Media Group request for comment, the company's public statement describes some of its privacy concerns.
Real Concerns?
While some skeptics suspect that some of the concerns expressed by Epic could be driven, in part, by competitive fears involving providing consumer app vendors access to patient health records, others say Epic's privacy worries are also legitimate.

"The privacy issues and the introduction of potentially insecure endpoint access are more of what concerns these vendors," notes Keith Fricke, principal consultant at tw-Security.
Click to expand...

guest · Jan 31, 2020

Meadville Medical Center dealing with data security incident
January 30, 2020
https://www.meadvilletribune.com/ne...cle_c57df018-42f3-11ea-b7a1-8bd21409fe3d.html

Meadville Medical Center is dealing with a data security incident involving its employee payroll system.
The security problem "may have resulted in unauthorized access to the personal information of some employees and their dependents," Rhoten confirmed in an email to the Tribune on Wednesday.

"Based on our investigation thus far, we have no evidence that this incident involves any patient information," Rhoten said.
Once the incident became known, Rhoten said the hospital secured its employee payroll computer portal, notified the FBI and launched an investigation into the incident.
"We are working with a professional security firm to address this incident and determine what personal information may have been involved," Rhoten said.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches