Why Healthcare Security Matters

guest · Mar 8, 2020

As medical records are stolen and shared, data protection faces a crisis of faith
March 5, 2020
https://siliconangle.com/2020/03/05...-faith-medical-records-stolen-shared-thecube/

One sector where this is growing exponentially is health-related information. From connected hospital equipment to cloud-accessible patient scans, collection and analysis of patient data is leading to amazing advances in healthcare technology.

As the industry faces a “crisis of faith,” it seems there is just one thing that all parties seem to agree upon: Medical data must be kept safe and secure, and regulation is the way to do it.
In this report, theCUBE, SiliconANGLE Media’s mobile livestreaming studio, looks at the security problems currently facing the healthcare industry and the solutions being proposed to fix them.
[...]
Will humanity’s love of connected devices revolutionize healthcare management and put the power over personal data back in the hands of the owner? Or will digital devices prove to be data-sucking voids that steal sensitive information and secretly share it?
Click to expand...

guest · Mar 8, 2020

Computer systems at UK and UK HealthCare hobbled by massive, month-long cyber attack
March 8, 2020
https://www.kentucky.com/news/local/education/article240970221.html

The University of Kentucky and UK HealthCare conducted a major reboot of their computer systems early Sunday morning in an effort to end a month-long cyber attack that university officials say is the most substantial cyber intrusion in university history.

The unidentified “threat actors” infiltrated Kentucky’s largest university system in early February from somewhere outside the United States and installed malware that utilized UK’s vast processing capabilities to mine cryptocurrency, such as Bitcoin, said Eric Monday, UK’s executive vice president for finance and administration.
Blanton insisted that “patient safety [and] access to care was never compromised,” but day-to-day functions were likely interrupted, even repeatedly.

UK HealthCare, which includes UK Chandler Hospital and Good Samaritan Hospital in Lexington, has close to 2 million registered patients. When asked whether any private information of the university’s students, faculty and patients was vulnerable at any point, Monday said it was “hard to determine,” but that the “risk to people’s information is much lower today than it was a month ago.”
Click to expand...

guest · Mar 9, 2020

HHS Releases Final Data Sharing Rules
ONC, CMS Rules Aim to Provide Patients with Secure Access to Health Data
March 9, 2020
https://www.inforisktoday.com/hhs-releases-final-data-sharing-rules-a-13910

The Department of Health and Human Services on Monday released its long-awaited interoperability and information blocking final rules as called for under the 21st Century Cures Act. The aim of both rules is ultimately to provide patients with easy, secure access to their electronic health information - from electronic health record systems as well as from payers.

"We're taking these actions while maintaining and strengthening patient privacy protections," Alex Azar, secretary of the Department of Health and Human Services said in a press briefing. "Patient privacy should never stand in the way of patient control."
The MyHealthEData effort is designed to empower patients around a common aim - giving every American access to their medical information so they can make better healthcare decisions, Azar said.
Click to expand...

Scrutiny Begins
On Monday, some industry groups began issuing guarded statements about the rules as experts began to dig into the regulations.

"However, given that the rule introduces a number of new definitions and terminologies and the significant economic impact of this rule, we are disappointed the Office of the National Coordinator for Health Information Technology did not heed stakeholders' calls to issue an interim final rule."
Click to expand...

Department of Health and Human Services: HHS Finalizes Historic Rules to Provide Patients More Control of Their Health Data

“The days of patients being kept in the dark are over,” said CMS Administrator Seema Verma. “In today’s digital age, our health system’s data sharing capacity shouldn’t be mired in the stone age. Unfortunately, data silos continue to fragment care, burden patients, and providers, and drive up costs through repeat tests. [...]”

These final rules deliver on the Administration’s promise to put patients at the center of their care by promoting patient access and use of their own health information and spurring the use of and development of new smartphone applications.
Click to expand...

guest · Mar 10, 2020

Hospital devices exposed to hacking with unsupported operating systems
Some X-ray, CAT scan and MRI machines are using Windows 7 and Windows XP operating systems
March 10, 2020
https://www.cnet.com/news/hospital-devices-exposed-to-hacking-with-unsupported-operating-systems/

A huge proportion of internet-connected imaging devices at hospitals run outdated operating systems, according to research released Tuesday by Palo Alto Networks, a cybersecurity firm. The company found that 83% of these devices run on outdated software that can't be updated even when it contains known vulnerabilities that hackers can exploit.

he number increased significantly from 2018, which coincides with Microsoft ending support for Windows 7 earlier this year.
The devices are vulnerable to hacking not just because they run outdated software. Often, medical staff open emails on computers that run on the same network as the devices, and phishing attacks on email users remain one of the most effective hacking techniques on the internet.
Click to expand...

The research looked at 1.2 million internet-connected devices total in hospitals and other businesses. It's a small portion of the 4.8 billion internet-connected devices that business analysis firm Gartner said existed in 2019.

"These devices are playing an important role in the hospital," Olson said, "and they need to be functional at all times."
Click to expand...

guest · Mar 11, 2020

Health Provider Sued for Failing to Safeguard Patient Data
March 11, 2020
https://news.clearancejobs.com/2020...r-sued-for-failing-to-safeguard-patient-data/

Last month Health Quest was the latest in a growing line of Health Care systems and providers to get sued for failing to safeguard patient sensitive and private data. This data included, among other things, patient names, dates of birth, social security numbers, driver’s license numbers, financial account information, payment card information, PINs and security codes, health care provider names, dates of medical treatment, and treatment and diagnosis information.

More potential compromises of accounts were discovered in the fall of 2019, and those individuals were not notified until January of 2020.
The plaintiffs allege in their complaint that the failure to safeguard was based upon a duty owed to them by Health Quest under the terms of their own policy, HIPAA protocols, and common law. Health Quest, according to the document was grossly negligent in failing to follow industry standards and regulations [...]

Plaintiffs in this case seek both declaratory and injunctive relief – in other words, they want to know how this happened, proof that it is not happening now, and what Health Quest is going to do to protect their information in the future.
Click to expand...

guest · Mar 12, 2020

mood said: ↑

A billion medical images are exposed online, as doctors ignore warnings
January 10, 2020
https://techcrunch.com/2020/01/10/medical-images-exposed-pacs/
Click to expand...

[...] Northeast Radiology, a partner of Alliance Radiology, had the largest cache of exposed medical data in the U.S., according to Greenbone’s data, with more than 61 million images on about 1.2 million patients across its five offices. The server was secured only after TechCrunch followed up a month after Greenbone first warned the organization of the exposure. [...]
Click to expand...

Northeast Radiology Sends Notification of Data Security Incident
March 11, 2020
https://www.businesswire.com/news/home/20200311005694/en/

Northeast Radiology today announced that it is addressing a data security incident, caused by unauthorized individuals, which may have involved the personal information of some patients. Northeast Radiology and its healthcare management services provider, Alliance HealthCare Services, have completed an investigation with a leading forensic security firm and are evaluating systems and processes to help prevent future occurrences.

On January 11, 2020, Alliance HealthCare Services notified Northeast Radiology that unauthorized individuals gained access to Northeast Radiology’s picture archiving and communication system (“PACS”), which is used to store radiology images and related information. Upon learning of the incident, Alliance HealthCare Services launched an investigation to understand the incident, review all related security controls, and evaluate systems and processes to further strengthen protections for the PACS.

There is no evidence that any personal information was misused by the unauthorized individuals, and Northeast Radiology is not aware of any instances of fraud or identity theft as a result of this incident. However, Alliance HealthCare Services and Northeast Radiology’s investigation determined that 29 patients’ information was accessed in this incident.
Click to expand...

guest · Mar 12, 2020

Illinois public health agency website taken down by hackers
March 12, 2020
https://thehill.com/policy/cybersec...-health-agencys-website-taken-down-by-hackers

The website for a local Illinois health agency was taken down by a cyberattack this week, creating difficulties in distributing accurate information on the coronavirus outbreak.

On Thursday, the agency wrote in a separate Facebook post that it was still “working to get our website up and running.” The agency set up a new website to allow for access to information on coronavirus.
According to Mother Jones, the website was taken down by a ransomware attack and will likely be down for the next week or two.
Julie Pryde, the chief administrator of the health district, told Mother Jones that the cyberattack was “inconvenient,” but that the district had put in place a “robust continuity of action plan.”
Click to expand...

guest · Mar 13, 2020

Henry Mayo Newhall Hospital Fires Employees for Snooping on Medical Records
March 13, 2020
https://www.hipaajournal.com/henry-...es-employees-for-snooping-on-medical-records/

Henry Mayo Newhall Hospital in Santa Clarita, CA has fired several employees for snooping on the medical records of the Saugus High School shooter.

Under Health Insurance Portability and Accountability Act (HIPAA) Rules, hospital staff are only permitted to access the medical records of patients with whom they have a treatment relationship of if there is an otherwise legitimate business relationship for accessing the records.
On November 14, 2009, a student of Saugus High School shot five students [...] was taken to Henry Mayo Newhall Hospital where he died the following day.
The hospital investigated the potential HIPAA violations and discovered that in several cases, employees had viewed the records without any legitimate business purpose for doing so.
Click to expand...

Ozark Orthopaedics Discovers Breach of 4 Email Accounts
Ozark Orthopaedics in Fayetteville, AR has started notifying 15,240 patients about a recent data security incident involving their protected health information.

Unusual activity was detected in employee email accounts on October 8, 2019. Steps were immediately taken to secure the email system and an investigation was launched to determine the whether any patient information had been compromised. On November 18, 2019, Ozark Orthopaedics learned that four email accounts had been accessed by an unauthorized individual.
Click to expand...

guest · Mar 13, 2020

mood said: ↑

Illinois public health agency website taken down by hackers
March 12, 2020
https://thehill.com/policy/cybersec...-health-agencys-website-taken-down-by-hackers
Click to expand...

The ransomware has been identified as NetWalker
C-U Public Health District's website held hostage by ransomware attack
March 11, 2020
https://www.news-gazette.com/news/l...cle_2dadedcd-aadb-5cb1-8740-8bd9e8800e27.html

The district’s website was attacked by a new ransomware called NetWalker, Pryde said.
Victims generally receive a ransom demand for the encryption key to regain access to their data, according to Mat Deem, a customer service representative at Simplified Computers of Champaign. NetWalker hides in an essential Windows function to evade anti-virus detection, he said.

What remains safe and available are the health district’s email accounts, environmental health records and patient electronic medical records, all of which were moved to cloud storage six months ago, according to Pryde.
The district also has secure Wi-Fi, and staff members are currently using their laptops to work, she said.

John Bambenek, a local cybersecurity expert, said the health district falls into a “must operate” category.
“There are few companies that must always operate,” he said. “Public health districts in the midst of a pandemic is one of them.”
Click to expand...

guest · Mar 14, 2020

Czech hospital hit by cyberattack while in the midst of a COVID-19 outbreak
March 13, 2020
https://www.zdnet.com/article/czech...ck-while-in-the-midst-of-a-covid-19-outbreak/

The Brno University Hospital in the city of Brno, Czech Republic, has been hit by a cyberattack right in the middle of a COVID-19 outbreak that is picking up steam in the small central European country.

Hospital officials have not revealed the nature of the security breach; however, the incident was deemed severe enough to postpone urgent surgical interventions, and re-route new acute patients to nearby St. Anne's University Hospital, local media reported [1, 2, 3, 4].

"The hospital public announcement system started to repeat the message that all personnel should immediately shut down all computers due to 'cybernetic security'," Gramantik told us.
Following the incident's onset, teams from the Czech National Cyber Security Center (NCSC), Czech police (NCOZ) and hospital's IT staff are now working together on-site to recover the hospital's IT network.
Click to expand...

guest · Mar 15, 2020

North Carolina Eyecare Practice Reports Malware Attack
March 14, 2020
https://invisionmag.com/north-carolina-eyecare-practice-reports-malware-attack/

Randleman Eye Center in North Carolina reports that it was the victim of a malware attack.
The practice states in a press release that it “is taking action after becoming aware of an incident in which some of our systems were accessed by an unauthorized person.”

“While there is no evidence that suggests that any data was actually taken, we have notified individuals for whom we have contact information if their information may have been affected,” the practice explains.
The attack took place starting on or around Jan. 10, and the practice became aware of it on Jan. 13.

Randleman Eye Center states that it has been working to contain the malware and has engaged a third-party forensics firm to investigate the scope and source of the incident.
Click to expand...

Randleman Eye Center Provide Notice of Data Security Incident

guest · Mar 17, 2020

HSCC Publishes Best Practices for Cyber Threat Information Sharing
March 16, 2020
https://www.hipaajournal.com/best-practices-for-cyber-threat-information-sharing/

The Healthcare and Public Health Sector Coordinating Council (HSCC) has published best practices for cyber threat information sharing. The new guidance document is intended to help healthcare organizations develop, implement, and maintain a successful cyber threat information sharing program to reduce cyber risk.

One of the main benefits of participating in these programs is to learn about possible attacks and the mitigations to implement to avoid becoming a victim. If an attack occurs at one healthcare organization, it is probable that similar attacks will be performed on others.
The threat landscape evolves at a rapid pace and new attack methods are constantly being developed by cybercriminals.
Click to expand...

HSCC Shares Best Practice Cyber Threat Information Sharing Guidance

The guide builds upon earlier HSCC guidance that listed key information sharing organizations, a resource into these groups as a way to fuel necessary threat information sharing. Key groups include the Health Information Sharing and Analysis Center (H-ISAC), government resources, and other information sharing groups.
Click to expand...

ronjor · Mar 17, 2020

COVID-19: HHS Issues Limited HIPAA Waivers

Marianne Kolbasuk McGee (HealthInfoSec) March 17, 2020
Designed to Improve Patient Care Through Telehealth, Including Video Chats
Click to expand...

Minimalist · Mar 17, 2020

Ransomware attacks poised to disrupt coronavirus response efforts

Cybercrime around the coronavirus pandemic is increasing, and experts fear it could soon escalate to ransomware attacks that will disrupt response efforts within healthcare organizations as well as city, state and local governments.
Click to expand...

https://searchsecurity.techtarget.c...oised-to-disrupt-coronavirus-response-efforts

guest · Mar 21, 2020

Roundup of Recent Healthcare Data Breaches
March 20, 2020
https://www.hipaajournal.com/roundup-of-recent-healthcare-data-breaches/

A roundup of healthcare data breaches and security incidents recently reported to the HHS’ Office for Civil Rights and by media.
Texas Network of Walk-in Clinics Attacked with Maze Ransomware
AffordaCare Urgent Care Clinic, a network of walk-in clinics in Texas, has been attacked by the Maze ransomware gang.
Tandem Diabetes Care Patients Notified About Phishing Attack
Tandem Diabetes Care, Inc. in San Diego, CA has been targeted by cybercriminals who gained access to the email accounts of a limited number of its employees between January 17, 2020 and January 20, 2020.
Tandem is enhancing its email security controls, strengthening user authorization and authentication, and has changed its policies and procedures to limit the types of data that can be sent via email.
Foundational Medicine Email Account Breach Detected
The Cambridge, MA-based provider of genomic profiling services, Foundational Medicine, has discovered the email account of an employee has been compromised as a result of a response to a phishing email.
Foundational Medicine has notified all affected patients and additional security awareness training has been provided to the workforce.
Click to expand...

Randleman Eye Center Suffers Ransomware Attack
Randleman Eye Center in North Carolina has experienced a ransomware attack that affected a server containing patients’ protected health information.
Torrance Memorial Medical Center Discovers Exposure of Patients’ Radiology Images
Torrance Memorial Medical Center (TMMC) in California has discovered a server used by a third-party radiology vendor had security protections removed that allowed certain patient information to be accessed by unauthorized individuals.
PHI of 2,190 Patients Stolen in Burglary at California Dental Practice
On January 16, 2020, Genuine Dental Care in Saratoga, CA discovered thieves had broken into its offices and had stolen a server that contained the protected health information of 2,190 patients. Data on the server required multiple passwords to be entered in order for patient information to be accessed; however, it is possible that the thieves accessed patient data.
Click to expand...

guest · Mar 22, 2020

Hacked: Some patient information compromised in U of U Health breach
March 21, 2020
https://kutv.com/news/local/some-u-of-u-health-patient-information-may-be-compromised-in-data-breach

Data breaches under investigation by University of Utah Health may have resulted in some patient information being exposed to bad actors, according to a press release sent out Friday.
U of U Health laid out the circumstances of at least two known data breaches in which patient information may have been compromised:

1) Unauthorized access to some U of U Health employee email accounts took place between Jan. 22 to Feb. 27, according to the company. Unidentified parties were able to gain access to the accounts through phishing schemes — emails designed to trick employees by replicating those sent by trusted sources.
2) Malware was also discovered on an employee computer on Feb. 3, according to U of U Health. The company called on a cyber security company to help investigate, and found out that the malware might have allowed access to some patient information from the employee's email.
Click to expand...

Investigations of both incidents determined some patient information, which may have included names, dates of birth, medical record numbers, and "limited clinical information," could have been accessed by the party or parties who targeted the health care workers.

"Investigation of these incidents continues to be a complex, time consuming, and highly technical process," the press release states. "The investigation is ongoing but, at this time, U of U Health has no indication that patient information was misused."
Click to expand...

Minimalist · Mar 22, 2020

Hackers are targeting hospitals crippled by coronavirus

“Our message to ransomware gangs is: stay the hell away from hospitals”
Click to expand...

https://www.wired.co.uk/article/coronavirus-hackers-cybercrime-phishing

Minimalist · Mar 22, 2020

Cyber gangsters hit UK medical firm poised for work on Coronavirus with Maze ransomware attack

Cyber gangsters have attacked the computer systems of a medical research company on standby to carry out trials of a possible future vaccine for the Coronavirus, Covid-19.

The Maze ransomware group attacked the computer systems of Hammersmith Medicines Research (HMR), publishing personal details of thousands of former patients after the company declined to pay a ransom.
Click to expand...

https://www.computerweekly.com/news...-lorganisation-poised-for-work-on-Coronavirus

ronjor · Mar 23, 2020

Feds: Virus frauds spread, preying on Medicare recipients

By RICARDO ALONSO-ZALDIVAR Associated Press March 23, 2020
Federal law enforcement is warning that scam artists are preying on older people's fears by peddling fake tests for the coronavirus to Medicare recipients.
“It's a straight-up ruse to get your Medicare number or your Social Security number under the guise of having a test kit or a sanitary kit sent to you,” Schrank said. Often the caller will hang up as soon as that number is provided.
Click to expand...

FanJ · Mar 23, 2020

Dutch Police and Public Prosecution Service (in Dutch: Openbaar Ministerie; OM) is investigating scam/fake website offering surgical masks (in Dutch: mondkapjes).

News at the official site of the OM.
Article is only in Dutch (sorry)
Onderzoek naar oplichtingswebsite die mondkapjes aanbood
https://www.om.nl/actueel/nieuws/2020/03/23/onderzoek-oplichtingswebsite-die-mondkapjes-aanbood

The scam website is hosted in the US. The OM has asked the website hoster to take it off line.

(I hope they also notified the US authorities)

guest · Mar 23, 2020

Covid-busy NHS postpones cyber-security audit
March 23, 2020
https://www.scmagazineuk.com/covid-busy-nhs-postpones-cyber-security-audit/article/1677967

There will be a six-month delay in the crucial cyber-security resilience checks at NHS Trusts, because resources are diverted to handling the coronavirus outbreak, reported healthcare journal HSJ.

Organisations under NHS have to submit their annual “data security and protection toolkit” (DSPT) to government regulators this month, which assesses their respective levels of cyber-security. The deadline has been extended to the end of September, the report said, citing the NHSX briefing.
NHSX is a joint unit launched last month to oversee the digital transformation and cyber-security of NHS services across the nation.

However, this does not mean that the NHS has totally avoided all cyber-security related activities. They were in the process of phasing out legacy systems when the six-month delay was announced.
Click to expand...

Healthcare Journal HSJ: Covid-19 response forces halt to NHS cyber security checks

Security checks to keep the NHS safe from hackers have been delayed to help managers deal with covid-19.
The service has also been warrned of attempts to exploit the pandemic by online fraudsters.
Click to expand...

Minimalist · Mar 24, 2020

HHS.gov Open Redirect Used by Coronavirus Phishing to Spread Malware

An HHS.gov open redirect is currently being used by attackers to push malware payloads onto unsuspecting victims' systems with the help of coronavirus-themed phishing emails.
Click to expand...

https://www.bleepingcomputer.com/ne...ed-by-coronavirus-phishing-to-spread-malware/

Minimalist · Mar 24, 2020

Coronavirus: Kaspersky, Bitdefender make products free to NHS

Kaspersky and Bitdefender have both made various products and services available free to healthcare customers as the Covid-19 coronavirus pandemic intensifies
Click to expand...

https://www.computerweekly.com/news...spersky-Bitdefender-make-products-free-to-NHS

guest · Mar 25, 2020

Paris hospitals targeted in major cyberattack
March 24, 2020
https://www.itproportal.com/news/paris-hospitals-targeted-in-major-cyberattack/

Hackers have targeted hospitals in Paris with a major cyberattack, new reports have claimed.

According to a Bloomberg news report, the goal of the attack against the Paris Hospital Authority (AP-HP) was to overwhelm hospital computers and thus disable the service.
The organisation’s spokesperson told the media that it managed to successfully handle the attack, walking away unbruised.

AP-HP is the largest hospital network in Europe, and offers a lot more than just healthcare – its services also include research, prevention and education.
Click to expand...

guest · Mar 25, 2020

February 2020 Healthcare Data Breach Report
March 24, 2020
https://www.hipaajournal.com/february-2020-healthcare-data-breach-report/

There were 39 reported healthcare data breaches of 500 or more records in February and 1,531,855 records were breached, which represents a 21.9% month-over-month increase in data breaches and a 231% increase in breached records. More records were breached in February than in the past three months combined. In February, the average breach size was 39,278 records and the mean breach size was 3,335 records.
Largest Healthcare Data Breaches in February 2020
The largest healthcare data breach was reported by the health plan, Health Share of Oregon. An unencrypted laptop computer containing the records of 654,362 plan members was stolen from its transportation vendor in an office break in.

The second largest breach was a ransomware attack on the accounting firm BST & Co. CPAs which saw client records encrypted, including those of the New York medical group, Community Care Physicians.
Causes of February Healthcare Data Breaches
Hacking/IT incidents dominated the breach reports, accounting for two thirds (66.67%) of all breaches reported in February and 54.78% of breached records (839,226 records).
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

ronjor Global Moderator

FanJ Updates Team

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

ronjor Global Moderator

FanJ Updates Team

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Useful Searches