Why Healthcare Security Matters

guest · Nov 8, 2020

mood said: ↑

'Breach of privacy': Ontario Privacy Commissioner on electronic information found abandoned by MLHU
May 5, 2020
https://london.ctvnews.ca/breach-of...information-found-abandoned-by-mlhu-1.4925162
Click to expand...

2 hard drives and documents with personal health info left behind during MLHU move
November 7, 2020
https://london.ctvnews.ca/2-hard-dr...h-info-left-behind-during-mlhu-move-1.5179108

The Middlesex-London Health Unit (MLHU) is defending itself over a privacy breach earlier this year when papers and two computer hard drives containing personal information and personal health information were left behind at its former headquarters on King Street.

It happened during the move to its new location inside Citi Plaza in the spring. On April 23, Middlesex County employees discovered the computers and documents in a vault.
The MLHU conducted an internal investigation and says the items in question were left behind inadvertently.
Click to expand...

The health unit says there was some client PHI in the paper documents left behind. Information includes, client lists related to a 270 person food poisoning investigation, a fax request for medical records and a fax immunization report for a school-aged child.

But the MLHU says it's confident no one viewed the PHI in the documents because the papers were stored in a secure location.
As a result of the breach, the health unit is in the process of implementing new policies and procedures to ensure electronic devices are disposed of securely and the data they contain is erased and destroyed.
Click to expand...

guest · Nov 8, 2020

OCR Settles with Psychiatric Provider for HIPAA Right of Access Violation
November 6, 2020
https://healthitsecurity.com/news/o...-provider-for-hipaa-right-of-access-violation

The Department of Health and Human Services Office for Civil Rights announced it reached a $25,000 settlement with California-based Riverside Psychiatric Medical Group to resolve a potential HIPAA Right of Access violation.

The resolution marks the tenth of the OCR HIPAA Right of Access Initiative, which was launched in 2019 and designed to ensure providers are in compliance with the rule. The settlement is the seventh announced in 2020—including Dignity Health, NY Spine Medicine, and five other providers.

“When patients request copies of their health records, they must be given a timely response, not a run-around,” said OCR Director Roger Severino, in a statement.
Click to expand...

guest · Nov 9, 2020

mood said: ↑

Psychiatric health data thief extorting individual patients
Sensitive information published online
October 26, 2020
https://www.itnews.com.au/news/psychiatric-health-data-thief-extorting-individual-patients-555127
Click to expand...

Police got 25,000 criminal complaints from victims of Vastaamo hack
November 6, 2020
https://www.foreigner.fi/articulo/n...sychotherapy-center/20201109132009008943.html

The Finnish police have already received almost 25,000 criminal complaints from victims of the leak of personal data of patients from the Finnish psychotherapy center Vastaamo, whose system has been hacked by extortionists.

Vastaamo, a private center with clinics in 20 cities throughout the country that provides psychological and psychiatric treatment services also for patients from the public health system, was the victim of unauthorized access by hackers for the first time in November of 2018.
The vulnerabilities persisted until March 2019, five months in which the confidential data from patients prior to those dates were exposed.
Click to expand...

The criminals threatened to publish 100 daily patient files in the encrypted network Tor if the company does not pay them 450,000 euros in bitcoins. Hundreds of those files have been already published.
The police said Monday they are "actively investigating" in co-operation with other Finnish and international authorities.
Click to expand...

guest · Nov 12, 2020

Breach Lawsuit Spotlights Complex Vendor Issues
Medical Device Maker Sues a Subcontractor After Misconfiguration Incident
November 11, 2020
https://www.inforisktoday.com/breach-lawsuit-spotlights-complex-vendor-issues-a-15345

A medical device maker has sued an IT vendor in the wake of an email server migration mishap that exposed the health data of more than 277,000 individuals. The case illustrates the complexities of vendor risk management - especially after mergers and acquisitions.

In its lawsuit, Zoll Medical Corp. alleges that Campbell, Calif.-based Barracuda Networks was negligent in "failing to take reasonable precautions and safeguards" to protect Zoll's data from disclosure to unauthorized third parties.

"During a standard migration of data within [Barracuda's] network environment, [Barracuda] left open a data port, allowing an unauthorized third party to access [Zoll's] email communications containing patient health information and other confidential information," Zoll alleges in its lawsuit.
The lawsuit alleges that Barracuda left the data port open from Nov. 8 through Dec. 28, 2018.
Click to expand...

The Breach Report
Zoll reported the mishap on March 18, 2019 as a hacking/IT incident affecting more than 277,300 individuals, according the Department of Health and Human Services' HIPAA Breach Reporting Tool website, which lists health data breaches impacting 500 or more individuals.

In a March 2019 statement about the incident, Zoll noted that its email was archived by a third-party service provider to comply with record retention and maintenance requirements, policies and procedures.
"During a server migration, some data from Zoll emails was exposed," the company said.
Third-Party Risk Management
HIPAA attorney Paul Hales, who is not involved in the Zoll case, notes that the lawsuit illustrates the importance of keeping service level agreements and business associate agreements current and performing ongoing due diligence investigations of third parties entrusted with protected health information.
Click to expand...

guest · Nov 16, 2020

Healthcare Data Breaches to Triple in 2021
November 16, 2020
https://www.infosecurity-magazine.com/news/healthcare-data-breaches-to-triple/

Data breaches in the healthcare industry are likely to triple in volume in the coming year, according to a new report by Black Book Market Research.

The "2020 State of the Healthcare Cybersecurity Industry" report is based on a survey of 2,464 security professionals from 705 provider organizations. Respondents were asked to identify gaps, vulnerabilities, and deficiencies in security that make hospitals and physicians susceptible to data breaches and cyber-attacks.
Nearly threequarters (75%) of health system, hospitals and physician organizations surveyed reported that their infrastructures are unprepared to respond to attacks. Almost all (96%) felt that data attackers are outpacing their medical enterprises, placing providers at a disadvantage.
Click to expand...

Furthermore, the study revealed that 90% of health system and hospital employees who are now working remotely due to the outbreak of COVID-19 were not given any updated security guidelines or training on accessing sensitive patient data.
Click to expand...

guest · Nov 18, 2020

mood said: ↑

Psychiatric health data thief extorting individual patients
Sensitive information published online
October 26, 2020
https://www.itnews.com.au/news/psychiatric-health-data-thief-extorting-individual-patients-555127
Click to expand...

Audit finds no security shortcomings at hacked psychotherapy firm's Helsinki branch
November 18, 2020
https://yle.fi/uutiset/osasto/news/..._psychotherapy_firms_helsinki_branch/11653998

A survey by social and health sector regulators of the Helsinki branch of private psychotherapy firm Vastaamo which was the target of a serious hack earlier this autumn showed no shortcomings, according to the authority.

The firm was the target of a large-scale data breach that affected an estimated 40,000 patients. Some of the victims were blackmailed by the hacker, who threatened to release the sensitive information online. More than 25,000 criminal reports have since been filed by individuals over the matter.
The audit, carried out by the National Supervisory Authority for Welfare and Health (Valvira), focused on the security of patient data and monitored the firm's patient computer security system.
Click to expand...

guest · Nov 20, 2020

Mercy Iowa City reports over 60,000 Iowans were affected by data breach
November 18, 2020
https://kwwl.com/2020/11/18/mercy-iowa-city-reports-over-60000-iowans-were-affected-by-data-breach/

Mercy Iowa City determined that 60,473 Iowans were affected by a data breach incident, according to a letter sent out by the hospital.
Information such as names, Social Security numbers, driver’s license numbers, dates of birth, medical treatment information, and health insurance information could have potentially been revealed.

The hospital first discovered the issue on June 24, 2020 when an unauthorized third party sent out spam and phishing emails from an employee's account.
After learning of the incident, Mercy secured the email account to prevent further access. They also hired security firm to investigate and confirm the security of its email and computer systems.
Click to expand...

guest · Nov 22, 2020

mood said: ↑

A billion medical images are exposed online, as doctors ignore warnings
January 10, 2020
https://techcrunch.com/2020/01/10/medical-images-exposed-pacs/
Click to expand...

Millions of Medical Images Exposed, as US Fails to Secure PACS Flaws
November 19, 2020
https://healthitsecurity.com/news/m...ages-exposed-as-us-fails-to-secure-pacs-flaws

In the Fall of 2019, a damning report from ProPublica outlined a massive healthcare exposure: millions of medical images generated from Picture Archiving and Communication Systems (PACS) were left exposed and unsecured online. And the US was the biggest culprit.
One year later, and the US healthcare sector has still failed to close these major security gaps, where other countries took action.

The latest data shows that the largest offenders, just eight providers, are leaking more than 4 million medical images and records from about 1 million US citizens. These statistics do not include the remaining 162 healthcare entities that are also exposing this sensitive information.
Click to expand...

The initial ProPublica report led to a public outcry, followed by an inquiry into one of the biggest exposures caused by TridentUSA. The vendor and its affiliate MobileXUSA failed to secure X-Rays, MRIs, and other health data, while several PACS used by the Army were also found to be exposing data from servicemembers.

And unsurprisingly, not much has improved in the US a year after the report.

“This vulnerability presents a serious risk to patient data and privacy,” Sen. Warner told HealthITSecurity.com. “I’ve called on the Administration to address this threat, and it’s unfortunate they haven’t fully done that – especially as other nations appear to have gotten it right and threats from nefarious actors against our healthcare infrastructure are only growing.”
Click to expand...

guest · Nov 24, 2020

October 2020 Healthcare Data Breach Report
November 23, 2020
https://www.hipaajournal.com/october-2020-healthcare-data-breach-report/

October saw well above average numbers of data breaches reported the HHS’ Office for Civil Rights. There were 63 reported breaches of 500 or more records, which is a 33.68% reduction from September but still 41.82% more breaches than the monthly average over the last 12 months. The elevated numbers of breaches can be partly explained by continued reports from healthcare organizations that were impacted by the ransomware attack on the cloud software firm Blackbaud.

The protected health information of more than 2.5 million individuals were exposed or compromised in those 63 breaches, which is 74.08% fewer records than September, but still 26.81% more than the monthly average number of breached records over the past 12 months.
Causes of October 2020 Healthcare Data Breaches
As the above table shows, the healthcare industry in the United States has faced a barrage of ransomware attacks. Two thirds of the largest 15 data breaches reported in October involved ransomware. [...]
Click to expand...

guest · Nov 25, 2020

mood said: ↑

UK: Hospital investigating possible confidentiality breach
Hospital trust said it is treating matter "very seriously"
August 3, 2020
https://www.basingstokegazette.co.uk/news/18625857.hospital-trust-said-treating-matter-seriously/
Click to expand...

Second hospital data breach revealed in online papers
November 24, 2020
https://www.basingstokegazette.co.u...-hospital-data-breach-revealed-online-papers/

Details of the breach which was reported to the Information Commissioner’s Office (ICO) in July, have come to light in meeting papers published by Hampshire Hospitals NHS Foundation Trust (HHFT) online.

It is the second breach reported to the ICO by the trust between April and September this year.
The other breach was discovered by the Gazette in August, which saw personal details of women who had suffered a stillbirth published online.
Click to expand...

The trust has now published a report on both incidents to its board of directors, detailing what action it has take as a result.

In relation to the stillbirth breach, HHFT apologised for the distress caused to the women affected, which saw their details including previous miscarriages and pregnancy terminations, published in online papers.
Again, the ICO decided not to take enforcement action.
Click to expand...

guest · Nov 25, 2020

A month after cyberattack, UVM Medical Center restores access to electronic records
November 23, 2020
https://vtdigger.org/2020/11/23/a-m...center-restores-access-to-electronic-records/

The University of Vermont Medical Center’s electronic medical records system is up and running nearly a month after the hospital fell victim to a cyberattack.

Over the weekend, the hospital tech team restored Epic health records system, giving doctors and nurses full access to patient medical history, appointments, and medications, said Al Gobeille, a vice president of operations for the UVM Health Network on Monday.
He called it “a big advancement in our recovery.”
Click to expand...

The hospital officials “don’t know of any” patient data breaches “at this time,” said Gobeille. He promised to work with the federal government to verify that information. “If we find any [information was breached], we will notify each person immediately,” he said.
Click to expand...

guest · Nov 25, 2020

hawki said: ↑

"Cyber Attack Suspected in German Woman’s Death

BERLIN — The first known death from a cyberattack was reported Thursday after cybercriminals hit a hospital in Düsseldorf, Germany, with so-called ransomware... [...]
https://www.nytimes.com/2020/09/18/world/europe/cyber-attack-germany-ransomeware-death.html
Click to expand...

On That Dusseldorf Hospital Ransomware Attack and the Resultant Death
November 24, 2020
https://www.schneier.com/blog/archi...ansomware-attack-and-the-resultant-death.html

Wired has a detailed story about the ransomware attack on a Dusseldorf hospital, the one that resulted in an ambulance being redirected to a more distant hospital and the patient dying. The police wanted to prosecute the ransomware attackers for negligent homicide, but the details were more complicated:

After a detailed investigation involving consultations with medical professionals, an autopsy, and a minute-by-minute breakdown of events, Hartmann believes that the severity of the victim’s medical diagnosis at the time she was picked up was such that she would have died regardless of which hospital she had been admitted to. “The delay was of no relevance to the final outcome,”
Hartmann says.
“The medical condition was the sole cause of the death, and this is entirely independent from the cyberattack.”
Click to expand...

guest · Nov 30, 2020

Healthcare provider AspenPointe data breach affects 295K patients
November 30, 2020
https://www.bleepingcomputer.com/ne...spenpointe-data-breach-affects-295k-patients/

U.S. healthcare provider AspenPointe notified patients of a data breach stemming from a September 2020 cyberattack that enabled attackers to steal protected health information (PHI) and personally identifiable information (PII).

AspenPointe is a nonprofit funded by Medicaid, state, federal, and local government contracts, as well as donations, that manages 12 organizations serving over 50,000 individuals and families every.
Patients warned of identity fraud risks

"We recently discovered unauthorized access to our network occurred between September 12, 2020, and approximately September 22, 2020," AspenPointe said in a notification sent to clients earlier this month.
The organization hired external security experts to investigate the incident and find the extent of the information compromise affecting its network.
Click to expand...

Data breach affects over 295,000 patients

"Since the incident, we have forced password changes, implemented additional endpoint protection, increased monitoring, and implemented firewall changes, among other things," AspenPointe added.
While AspenPointe did not disclose the number of patients affected in this incident, the healthcare provider reported the data breach to the U.S. Department of Health and Human Services (HHS) on November 19th.
Click to expand...

guest · Dec 1, 2020

Thousands of unsecured medical records were exposed online
A cloud server used by nTreatment held data on US patients, including children
December 1, 2020
https://www.engadget.com/medical-records-exposed-health-data-ntreatment-174631525.html

Thousands of medical records for US patients, some of whom are children, were exposed in yet another lapse in health data security. A company named nTreatment, which handles records for clients in the healthcare industry, failed to protect one of its cloud servers with a password, according to TechCrunch.

The server stored around 109,000 files, including doctors' notes, third-party test results and insurance claims, along with some of nTreatment's internal documents. Almost all of that sensitive information was reportedly viewable through a web browser.
Click to expand...

guest · Dec 2, 2020

French pharmaceuticals distribution platform leaking 1.7+ TB of confidential data
December 1, 2020
https://cybernews.com/security/fren...on-platform-leaking-1-7-tb-confidential-data/

The CyberNews investigation team discovered an unsecured, publicly accessible Kibana dashboard of an ElasticSearch database containing confidential data belonging to Apodis Pharma, a software company based in France.

Apodis Pharma is a company that offers a digital supply chain management platform and other software solutions created for pharmacies, healthcare institutions, pharmaceutical laboratories, and health insurance companies.
The database discovered by CyberNews contains over 1.7 TB of confidential business-related data, including pharmaceutical sales data, full names of Apodis Pharma partners and employees, client warehouse stock statistics, pharmaceutical shipment locations and addresses, and more.
Click to expand...

On November 17, Apodis Pharma closed the database – it is no longer accessible to the public.
What’s the impact of the Apodis Pharma leak?
Malicious actors with unauthorized access to this database could cause a lot of damage not only to the clients of Apodis Pharma, but also to untold numbers of unsuspecting patients across France.
Click to expand...

guest · Dec 2, 2020

Disclosed OpenClinic Flaws Pose Remote Code Execution, PHI Risk
December 2, 2020
https://healthitsecurity.com/news/disclosed-openclinic-flaws-pose-remote-code-execution-phi-risk

Researchers from Bishop Fox Labs discovered four vulnerabilities in the OpenClinic application, an open-source health records management software, which could allow an attacker to read patient protected health information, among other serious risks.

Bishop Fox first discovered these flaws in August and attempted to contact OpenClinic’s development team on several occasions, before publicly disclosing the vulnerabilities on December 1.
The report follows an alert from the Department of Homeland Security Cybersecurity and Infrastructure Security Agency warning of 12 flaws in the platform, three of which were ranked critical and six rated high severity.
Click to expand...

The most severe flaw poses a risk of PHI loss. Researchers explained that authenticated users could upload medical test documents, stored in the /tests/ directory, which did not require the user to be authenticated to the application.
Click to expand...

guest · Dec 3, 2020

mood said: ↑

Data Breach at KRH May Have Affected 129,000 Patients’ Personal Information
October 22, 2019
https://flatheadbeacon.com/2019/10/...ffected-129000-patients-personal-information/
Click to expand...

Proposed settlement announced in Kalispell Regional Healthcare breach lawsuit
Class Action Settlement Notice - Kalispell Healthcare Data Breach: Morgan & Morgan, LLP
December 3, 2020
https://www.fairfieldsuntimes.com/n...cle_982fd55e-9942-5a9a-82de-dddd78593fba.html

This notice affects all persons who received notice from Kalispell Regional Healthcare that your personal information was or may have been compromised in the data breach initially disclosed by Kalispell on or about October 2019.

YOU ARE HEREBY NOTIFIED, pursuant to Rule 23 of the Montana Rules of Civil Procedure that a hearing will be held on Tuesday, January 5, 2021 [...]
This Summary Notice provides only a summary of matters regarding the Consolidated Action and the Settlement.
Click to expand...

FAQ - Kalispell Data Breach Settlement

Answers to important questions about the nature of the Settlement, the type of benefits available, who is eligible to receive them, and how to file claims.
[...]
6. What does the Settlement provide?
Under the Settlement, Kalispell will pay $4,200,000.00 into a Settlement Fund that will be used to provide the following benefits: [...]
Click to expand...

guest · Dec 3, 2020

Leak left 243 million Brazilians’ medical records and personal info ripe for the picking
That’s more than the living population of Brazil
December 3, 2020
https://www.theverge.com/2020/12/3/...lth-leak-medical-records-personal-information

The personal information of more than 243 million Brazilians was potentially accessible for at least six months thanks to weakly encoded credentials kept in the source code of the Brazilian Ministry of Health’s website (via ZDNet). The security issue was first reported by Brazilian publication Estadão.

The personal data of anyone who had registered with Sistema Único de Saúde (SUS), Brazil’s national health system, could be viewed. That data included people’s full names, addresses, and telephone numbers, reported Estadão.
The Ministry of Health’s website stored the encoded access credentials to the database of personal information in its source code, reports Estadão.
Click to expand...

Health records can be quite valuable on the black market given the amount of personal information they often include. If a bad actor knew of this vulnerability, it’s very possible they could have taken this data to use for their own nefarious purposes or to sell later. The Ministry of Health has corrected the problem, according to Estadão.
Click to expand...

guest · Dec 8, 2020

A ransomware attack hit the Greater Baltimore Medical Center
December 7, 2020
https://securityaffairs.co/wordpress/112017/malware/greater-baltimore-medical-center-ransomware.html

The Greater Baltimore Medical Center in Towson, Maryland was a victim of a ransomware attack that impacted its IT systems.

At the time of this writing, it is not clear the family of ransomware that hit the healthcare providers, it only confirmed that the security breach forced some procedures scheduled for Monday to be canceled.

“On the morning of Sunday, December 6, 2020, GBMC HealthCare detected a ransomware incident that impacted information technology systems. Although many of our systems are down, GBMC HealthCare has robust processes in place to maintain safe and effective patient care.” states the Computer Network Incident Update published by the healthcare provider.
GBMC confirmed that it is responding to the incident in accordance with its well-planned process and policies.
Click to expand...

guest · Dec 8, 2020

Over 100 GE Healthcare Devices Affected by Critical Vulnerability
December 8, 2020
https://www.securityweek.com/over-100-ge-healthcare-devices-affected-critical-vulnerability

The vulnerability, which is tracked as CVE-2020-25179 with a critical severity rating, has been found to impact CT scan, molecular imaging, PET, X-Ray, ultrasound and mammography devices, as well as workstations and imaging devices used in surgery. The list includes GE’s Brivo, Definium, Discovery, Innova, Optima, Odyssey, PETtrace, Precision, Seno, Revolution, Ventri, and Xeleris products.

“We have conducted a full risk assessment and concluded that there is no patient safety concern. Maintaining the safety, quality, and security of our devices is our highest priority.”
The issue discovered by CyberMDX researchers is related to the presence of hardcoded credentials for a proprietary management software made by GE Healthcare.
Click to expand...

An attacker who has network access to a targeted device can abuse these credentials, which are the same globally, to gain access to PHI and other sensitive data. An attacker can also modify the exposed data, execute arbitrary code on the system, or cause the system to become unavailable, CyberMDX said.
Click to expand...

CyberMDX Research Team Discovers Critical Vulnerability in GE Radiological Equipment — "MDhex-Ray"

CyberMDX, CISA and GE working together to mitigate potential breaches of crucial healthcare devices
CVE-2020-25179 was given a CVSS score of 9.8, reflecting a critical severity, in the ICS-CERT Advisory ICSMA-20-343-01.
Click to expand...

guest · Dec 9, 2020

Mercy Health discloses an insider breach, fires the employee
Mercy Patients Notified About A Medical Records Incident
December 4, 2020
https://www.prnewswire.com/news-rel...out-a-medical-records-incident-301186720.html

This news release is being issued to provide notice about a medical records privacy incident affecting patients who received services at Mercy Health ("Mercy") medical facilities.

On October 7, 2020, Mercy learned that on one or more prior occasions, a Mercy employee accessed medical record information that was not needed by the employee for patient care purposes. The information accessed by the employee included names, addresses, dates of birth, other demographic information, medical record number, treatment and other clinical information and/or radiological images.
Upon discovering the incident, Mercy immediately investigated the incident and made additional enhancements to procedures to prevent a similar incident from happening in the future.
Click to expand...

guest · Dec 9, 2020

Fraudsters who stole health information to fund spending spree plead guilty
December 7, 2020
https://www.kltv.com/2020/12/07/fra...information-fund-spending-spree-plead-guilty/

Two individuals have pleaded guilty to conspiracy to obtain information from a protected computer in the Eastern District of Texas.

Demetrius Cervantes, 46, of McKinney, and Amanda Lowry, 40, of Sherman, pleaded guilty to conspiracy to obtain information from a protected computer on Dec. 3, 2020. Their co-conspirator, Lydia Henslee, 29, of Denison, faces additional charges.
Cervantes, Lowry, and Henslee, were named in a federal indictment on Sept. 11, 2019. The defendants were each charged with conspiracy to obtain information from a protected computer and conspiracy to unlawfully possess and use a means of identification.
Click to expand...

According to the superseding indictment, the defendants are alleged to have conspired to pay and receive kickbacks in exchange for orders from physicians that were subsequently used to obtain payments from federal health care programs. The conspirators obtained patient information, including protected health information and personally identifiable information, and used the information to create fictitious physician orders.
Click to expand...

guest · Dec 10, 2020

mood said: ↑

A month after cyberattack, UVM Medical Center restores access to electronic records
November 23, 2020
https://vtdigger.org/2020/11/23/a-m...center-restores-access-to-electronic-records/
Click to expand...

Cyberattack cost UVM Medical Center $1.5 million a day
December 8, 2020
https://vtdigger.org/2020/12/08/cyberattack-cost-uvm-medical-center-1-5-million-a-day/

The October cyberattack cost the University of Vermont Medical Center $1.5 million a day in increased expenses and lost revenue, hospital president Stephen Leffler said Tuesday.

That “back of the envelope” calculation doesn’t include the cost of getting the system back up and running, he told reporters.
Forty-two days have elapsed since the attack occurred on Oct. 28. The total cost, including lost revenue and expenses, could exceed $63 million.
Click to expand...

The hospital is still grappling with the impacts of the attack six weeks after a hacker downed all of its online operations. Though many of the medical center’s systems have been restored, Leffler predicted a “multiweek process” to address a backlog of postponed appointments and the slew of handwritten records that must be entered into the online system.
Click to expand...

guest · Dec 11, 2020

Carriere, MS Man Sentenced to 42 Months Imprisonment for Stealing Personal Identifying Information of More Than 8,000 Healthcare.Gov Customers and Causing $587,000 in Losses
December 10, 2020
https://www.justice.gov/usao-edla/p...hs-imprisonment-stealing-personal-identifying

U.S. Attorney Peter G. Strasser announced that COLBI TRENT DEFIORE, age 27, a resident of Carriere, Mississippi, was sentenced to 42 months imprisonment, 3 years of supervised release [...]

On numerous occasions in November 2018, DEFIORE accessed and obtained without authorization, the personal identifying information of more than 8,000 individuals by improperly accessing the healthcare.gov database. DEFIORE did so for the purpose of his private financial gain and in furtherance of criminal acts, including wire fraud.
Click to expand...

Specifically, DEFIORE conducted “bulk searches” of the database, which he was prohibited from doing, and was able to view the personal information of healthcare.gov customers. DEFIORE then copied the results of his searches onto a virtual clipboard and sent them to himself via email.
Click to expand...

guest · Dec 11, 2020

Norwegian DPA imposes administrative fine to Østfold HF Hospital
November 25, 2020
https://edpb.europa.eu/news/nationa...es-administrative-fine-ostfold-hf-hospital_en

The Norwegian Data Protection Authority has decided on an administrative fee of NOK 750,000 to Østfold HF Hospital. The background is that in the period 2013-2019, the hospital stored report extracts from patient records outside the safe zone. The case started with a notice of personal data breach from the hospital.

The folders where the extracts were stored were not access controlled, and the activity in the folders was not logged. The report extracts have also been stored long after the lists were no longer needed. That such extensive storage of unshielded health information could take place over a long period of time, we believe indicates shortcomings in the internal management system, says senior legal adviser Susanne Lie
Click to expand...

The Norwegian Data Protection Authority considers that Østfold HF Hospital has not established a system for access control that is sufficient to prevent similar breaches from occurring in the future, and particular reference is made to the routines for access control and storage of personal data.
Click to expand...

Note: [NOK 750,000 ~= $85.000]

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches