Why Healthcare Security Matters

guest · Oct 12, 2019

Monterey Health Center Provides Notice of Data Security Incident
October 12, 2019
https://finance.yahoo.com/news/monterey-health-center-provides-notice-020000662.html

Monterey Health Center today announced a recent event that may have impacted the privacy of personal information relating to certain current and former patients.

On August 12, 2019, Monterey Health Center became aware that its electronic medical records system became encrypted due to "ransomware" deployed by an unknown actor. Because the server that was encrypted stored patient medical records, Monterey Health Center worked quickly to (1) restore access to the patient information so they could continue to care for patients without disruption; and (2) investigate what happened and whether this incident resulted in any unauthorized access to, or theft of, patient information by the unknown actor.
Click to expand...

guest · Oct 12, 2019

Hospital district data breach larger than previously thought
October 12, 2019
https://www.heraldbanner.com/news/l...cle_8de4193e-ec86-11e9-9e1c-93b2837b6a5c.html

The Hunt Memorial Hospital District released an update regarding a criminal cyber attack which was discovered against the district earlier this year, warning more of the district’s patients may have been impacted.

“Our cyber security firm has determined the breach was more widespread than we originally believed,” according to Lisa Hill, the Director, Foundation Development and Marketing Communications for Hunt Regional Healthcare.
The information was released in a letter mailed this week to those who may have been affected by the data breach. The letter was distributed to all of the patients potentially targeted by the attack.

According to the release, the cyber attack occurred in May 2018 “during which hackers gained access to information in its computer network that included personal information of a subset of Hunt’s patients.”
The hackers were able to access medical records which contained information including patients’ names, telephone numbers, Social Security numbers, dates of birth, race and religious preferences.
Click to expand...

Hunt Memorial Hospital District: Notice of cyber attack (October 11, 2019)

guest · Oct 13, 2019

Philly health department website exposed names of thousands of people with hepatitis
October 12, 2019
https://www.inquirer.com/news/phila...reach-opioids-tableau-hepatitis-20191011.html

A public-data tool built by the Philadelphia Department of Public Health to track the prevalence of hepatitis infections left individuals’ health records accessible, compromising the names, addresses, Social Security numbers, and intimate health records of thousands of people receiving medical care in Philadelphia.

The department learned of the breach Friday when an Inquirer reporter discovered the data and notified the department. It was not clear how long the information was exposed. The data were taken down minutes after the department was notified.

"We will conduct a thorough investigation of this incident, attempt to determine if any confidential information was accessed by others, take appropriate corrective actions, and do everything we can to protect the privacy and security of personal information.”
It’s unclear what legal issues the breach poses.
Click to expand...

guest · Oct 13, 2019

Man given £1.5k after discovering data breach by chance
October 13, 2019
https://www.salisburyjournal.co.uk/news/17962484.man-given-1-5k-discovering-data-breach-chance/

The data breach took place in 2016 but Robert Richardson found out about it more than two years later after making a Right of Access information request.

Now Southern Health NHS Trust has admitted failing in its data protection obligations following the incident which involved a member of its staff accessing and sharing details of a patient’s confidential medical records without consent.
Mr Richardson received £1,500 as part of the settlement.

Mr Richardson added: “I was stunned and very upset to discover that this had taken place without my knowledge, or consent, and even more upset that the NHS had proceeded to access my private medical records to confirm to the council that I had not been a mental health patient, again without my knowledge or consent.”
A Southern Health NHS Foundation Trust spokesperson said: “[...]In this case, we apologise as we fell short of these standards and have updated our information sharing policy and staff guidance to provide clarification around information sharing requests from third parties.”
Click to expand...

guest · Oct 16, 2019

Report Reveals the Most Common Cyber Threats Faced by Healthcare Organizations
October 16, 2019
https://www.hipaajournal.com/report...er-threats-faced-by-healthcare-organizations/

A new report from Proofpoint offers insights into the cyber threats faced by healthcare organizations and the most common attacks that lead to healthcare data breaches.
Proofpoint’s 2019 Healthcare Threat Report highlights the ever-changing threat landscape and how the tactics used by cybercriminals are in a constant state of flux.

The study – conducted between Q2, 2018 and Q1, 2019 – shows how the malware variants used in attacks often change. Ransomware was a popular form of malware in Q2, 2018 and was used in many attacks on healthcare organizations, but ransomware incidents then dwindled rapidly as cybercriminals switched their attention to banking Trojans. For the remaining three quarters of the study period, banking Trojans were the malware variant of choice, although ransomware is now proving popular once again.

On average, targeted healthcare organizations received 43 imposter emails in Q1, 2019, an increase of 300% from Q1, 2018. Those attacks saw an average of 65 members of staff attacked at each healthcare organization.
Click to expand...

Proofpoint: New Healthcare Report Reveals Top Trends in People-Centric Cyber Attacks

guest · Oct 17, 2019

CSL files US suit against former staffer over stolen data
October 16, 2019
https://www.afr.com/companies/healt...o-sell-from-hold-ahead-of-agm-20191014-p530cv

CSL has revealed that it has been forced to file a lawsuit against a former employee whom it accuses of stealing sensitive information and trade secrets with the intention of taking it to a competitor.

The company's CSL Behring LLC unit filed a suit against Joseph Chiao on October 1, in the US District Court for the Eastern District of Pennsylvania, after the company discovered that the former medical director in CSL's specialty products area had taken a vast trove of sensitive company data.
The global blood products group's data security systems had earlier identified an unauthorised download of documents and CSL immediately launched the legal action.

According to US court documents obtained by The Australian Financial Review, CSL Behring accused Dr Chiao of emailing to his personal account and downloading to a thumb drive of thousands of CSL Behring files of highly sensitive information about therapy outcomes, product development and business strategies.
Click to expand...

Dutch pharma group Pharming denies involvement in CSL data breach
October 17, 2019
https://www.afr.com/companies/healt...nvolvement-in-csl-data-breach-20191017-p531lf

Dutch pharma company Pharming Group NV said it "categorically denies" any involvement in an alleged data breach by a former CSL staffer.

Shares in the listed €698 million ($1.14 billion) biotech company recovered in early trade Thursday after tumbling nearly 12 per cent the day before in Europe, after it was revealed the blood products giant CSL took legal action in the United States over the alleged abstraction of trade secrets by Dr Joseph Chiao from his former employer.
Click to expand...

guest · Oct 17, 2019

Athens man sues local health agency for data breach
October 17, 2019
https://www.athensnews.com/news/loc...cle_0b9996b2-f045-11e9-8dc6-075ed4c3dfa8.html

An Athens man has filed a class-action lawsuit against Health Recovery Services, Inc., in federal court alleging that a data breach at the private nonprofit agency jeopardized the private information of patients, putting them at “grave risk” of identity theft.

The suit comes after HRS learned last Feb. 5 that an “unauthorized IP address had remotely accessed its computer network,” the suit reads.

“Despite Defendant HRS’ duty to expeditiously notify individuals that their personal information may have been compromised, defendant HRS kept its knowledge of the data breach secret from plaintiff Foster and Data Breach Class members until releasing notification titled ‘NOTICE OF DATA INCIDENT’ on April 5, 2019, roughly two months after defendant discovered that the personal information of plaintiff Foster and the Data Breach Class members had been compromised and misappropriated since Nov. 14, 2018,” according to the lawsuit.
Fradin said Wednesday that the data breach could have impacted the data of HRS patients going back as far as 2014, if not before that. HRS notified roughly 20,485 patients of the data breach in April [...]
Regardless, Fradin in Foster’s lawsuit alleges that HRS’ approach at maintaining the privacy of the personal information of patients was “lackadaisical, cavalier, reckless or at the very least negligent.”
Click to expand...

guest · Oct 17, 2019

Mission Health sends letter warning of website data breach spanning years
October 16, 2019
https://wlos.com/news/local/mission...warning-of-website-data-breach-spanning-years

A data breach on the Mission Health store website spanning years has many on edge across Western North Carolina and beyond.

In a statement mailed to patients, Mission Health says they found a malicious code present on the store website that was sending the payment information to an unauthorized person. According to the letter, that malicious code was in place from March 2016 till June of 2019.
Mission promises there was no access to any medical records, however, credit card information may have been stolen at any point during that time frame.

Brinker says that’s not the only troubling thing he read, “The announcement that there was no information relative to my medical records that was obtained from this particular website invasion and what I’m looking at is with the information that was obtained from the website it’s very easy to much just one step next to my medical records.”
Mission Health says the online store was only used for people to purchase health products.
Click to expand...

guest · Oct 17, 2019

Email Breaches: A Growing Healthcare Challenge
October 17, 2019
https://www.inforisktoday.com/blogs/email-breaches-growing-healthcare-challenge-p-2807

Data breaches involving phishing and other email-related compromises persist as a top challenge for healthcare providers. So, what are some of the top trends emerging from these incidents?

Phishing attacks are the primary vector in many of the largest health data breaches being reported to the Department of Health and Human Services these days, said Roger Severino, director of HHS' Office for Civil Rights during the 11th annual HIPAA conference this week in Washington, D.C., which was co-sponsored by OCR and the National Institute of Standards and Technology.

In fact, the number of major health data breaches involving email being reported to HHS is climbing, according to OCR.
Biggest Breaches
As of Thursday, OCR's HIPAA Breach Reporting Tool website shows that so far in 2019, some 164 incidents have been reported as "email" breaches, impacting a total of nearly 2.7 million individuals.
So far this year, the largest "email" breach was reported as a hacking/IT incident in February by UConn Health.
Click to expand...

guest · Oct 18, 2019

VA Exposes Sensitive Veteran Data to Thousands of Unauthorized Employees
October 17, 2019
https://www.nextgov.com/cybersecuri...data-thousands-unauthorized-employees/160687/

A regional office of the Veterans Affairs Department mishandled its patients’ personal data [...]
According to the VA Inspector General, the agency’s Milwaukee regional office was storing personally identifiable information on its patients in two shared drives on the Veterans Benefits Administration’s enterprise network. The security lapse, first flagged by a whistleblower in September 2018, left the data exposed to more than 25,000 remote users across the country, many of whom had no need to access the information, auditors found.

The files stored on the network drives included “medical records, correspondence about medical examinations and disability claims decisions, and veterans’ statements in support of their claims,” the IG said, as well as patients’ names, addresses, birthdays and phone numbers. Some of the files dated back to 2016.

“The inadequate protection of sensitive personal information places veterans’ data at risk and could undermine the credibility of VBA and [veteran service organizations] in positions of trust,” they said in a report published Thursday.
Investigators found the slip-up stemmed from a combination of user negligence, poor technical controls and insufficient oversight on behalf of the agency.
Click to expand...

Report: "Mishandling of Veterans’ Sensitive Personal Information on VA Shared Network Drives"
(PDF - 578 KB): https://www.va.gov/oig/pubs/VAOIG-19-06125-218.pdf

guest · Oct 21, 2019

Data Leaks in the Medical Industry: A Worldwide Epidemic
October 21, 2019
https://www.wizcase.com/blog/medical-breaches-research/

Technology is moving at a fast pace and the security systems don’t seem like they can keep up. This is especially troubling when dealing with a company that is supposed to protect sensitive user data. The health industry is no exception, as companies share data with third-party providers around the world.

This can be especially troubling since medical data should be kept private. However, we’ve found several leaks that seriously raise questions regarding how our medical data is handled and secured in this technological era.
Our web security team, led by Avishai Efrat, found nine unsecured medical databases from around the world. Some of these databases are from 3rd party companies that provide data management and insight for medical institutions. Unfortunately, they might not understand the possible implications of handling sensitive data insecurely online. Some of the personal data that we found included: [...]
Click to expand...

guest · Oct 22, 2019

September 2019 Healthcare Data Breach Report
October 21, 2019
https://www.hipaajournal.com/september-2019-healthcare-data-breach-report/

September saw 36 healthcare data breaches of more than 500 records reported to the Department of Health and Human Services’ Office for Civil Rights, which represents a 26.53% decrease in breaches from the previous month.
1,957,168 healthcare records were compromised in those breaches, an increase of 168.11% from August. The large number of breached records is largely down to four reported incidents, each of which involved hundreds of thousands of healthcare records. Three of those incidents have been confirmed as ransomware attacks.
Click to expand...

guest · Oct 22, 2019

Data Breach at KRH May Have Affected 129,000 Patients’ Personal Information
October 22, 2019
https://flatheadbeacon.com/2019/10/...ffected-129000-patients-personal-information/

Beginning today, Kalispell Regional Healthcare is mailing out letters to nearly 130,000 patients whose personal information may have been involved in a data breach over the summer.

Patients’ personal information may have included their name, address, medical record number, date of birth, telephone number, email address, medical history and treatment information, date of service, treating and referring physician, medical bill account number and/or health insurance information. KRH says a small number of patients, 250 or fewer, may have had their Social Security numbers accessed.
The hospital discovered in June that multiple employees had unknowingly provided their KRH email login credentials to “unauthorized malicious criminals by way of a phishing scam.” Lambrecht called the cyber attack “highly sophisticated,” [...]
Click to expand...

guest · Oct 23, 2019

South Texas Dermatopathology Notifies 15,982 Patients About AMCA Data Breach
October 22, 2019
https://www.hipaajournal.com/south-...tifies-15982-patients-about-amca-data-breach/

South Texas Dermatopathology is the last known victim of the data breach at American Medical Collection Agency (AMCA) to report the breach to the Department of Health and Human Services Office for Civil Rights (OCR) and notify affected patients. The breach appeared on the OCR breach portal on October 7, 2019 and indicates 15,982 patients have been affected.

An unauthorized individual first gained access to AMCA systems on August 1, 2018. Access remained possible up to March 30, 2019 when the breach was detected and its systems were secured. During that time, the unauthorized individual had access to parts of AMCA systems that contained information such as names, addresses, phone numbers, dates of birth, balance information, dates of service, credit card or banking information and treatment provider information.

The full list of healthcare organizations affected by the AMCA breach is listed below. The number of patients affected has been taken from the HHS’ Office for Civil Rights’ breach portal. [...]
Click to expand...

guest · Oct 23, 2019

Over 17,000 patients' personal data exposed on national neurology registry website
October 23, 2019
https://www.thestar.com.my/news/nat...xposed-on-national-neurology-registry-website

In yet another data breach, more than 17,000 patients' personal data have been exposed on the government-linked National Neurology Registry (NNeuR) website due to a scripting error, news portal Free Malaysia Today (FMT) reported.

"All the data was downloadable and editable," the report said.
According to NNeuR, the registry started in December 2008 and is supported by the Health Ministry to gather information about stroke and epilepsy in Malaysia.
Click to expand...

Health Ministry: Patient data on National Neurology Registry at risk of exposure

The Health Ministry issued the statement after taking note of an earlier report by website Free Malaysia Today about how a scripting error on the NNeuR website may have allowed access to a confidential patient database, which included information such as NRIC, phone numbers and addresses.
Click to expand...

guest · Oct 23, 2019

OCR Imposes a $2.15 Million Civil Money Penalty against Jackson Health System for HIPAA Violations
October 23, 2019
https://www.hhs.gov/about/news/2019...penalty-against-jhs-for-hipaa-violations.html

The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services has imposed a civil money penalty of $2,154,000 against Jackson Health System (JHS) for violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security and Breach Notification Rules between 2013 and 2016.

On August 22, 2013, JHS submitted a breach report to OCR stating that its Health Information Management Department had lost paper records containing the protected health information (PHI) of 756 patients in January 2013. JHS's internal investigation determined that an additional three boxes of patient records were also lost in December 2012; however, JHS did not report the additional loss or the increased number of individuals affected to 1,436, until June 7, 2016.
On February 19, 2016, JHS submitted a breach report to OCR reporting that an employee had been selling patient PHI.

OCR's investigation revealed that JHS failed to provide timely and accurate breach notification to the Secretary of HHS, conduct enterprise-wide risk analyses, manage identified risks to a reasonable and appropriate level, regularly review information system activity records, and restrict authorization of its workforce members' access to patient ePHI to the minimum necessary to accomplish their job duties.
Click to expand...

guest · Oct 24, 2019

Geisinger Health Plan Notifies Members About Business Associate Phishing Attack
October 24, 2019
https://www.hipaajournal.com/geisin...ers-about-business-associate-phishing-attack/

Danville, PA-based Geisinger Health Plan has discovered the protected health information (PHI) of some of its members has been exposed as a result of a suspected phishing attack on one of its business associates, Magellan NIA.
Magellan NIA provides radiology benefits management services to the health plan, which requires access to plan members’ PHI.

Magellan NIA discovered the breach on July 5, 2019 when suspicious activity was detected in the email account of one of its employees. The account was immediately secured to prevent further unauthorized access and misuse and an investigation was launched to determine the extent of the breach.
Magellan NIA has since implemented additional security measures to protect against further phishing attacks, including disabling certain email protocols, implementing Microsoft Password Hash Sync, and establishing geofencing.
Click to expand...

ronjor · Oct 24, 2019

Phishing Schemes Continue to Plague the Healthcare Sector

Marianne Kolbasuk McGee (HealthInfoSec) October 24, 2019
Experts Offer Insights on Mitigating the Threat
Click to expand...

guest · Oct 25, 2019

Phishers strike at mobile wellness app company
October 25, 2019
https://nakedsecurity.sophos.com/2019/10/25/phishers-strike-at-mobile-wellness-app-company/

If you don’t believe that you could ever fall victim to a social engineering attack, take heed. Last week, a mobile healthcare application vendor reportedly fell victim to a scam that saw criminals send fraudulent mails to everyone in a director’s account.

Online criminals launched a cyberattack on healthcare app company Evergreen Life. Its app helps people log their own health information, taking in fitness, nutrition, and even DNA records. They can also connect to their GP, access their medical records, and book appointments. The app gives people a wellness score to help them assess the shape they’re in.
On Monday 21 October, the cybercriminals reportedly did their best to infiltrate Evergreen Life’s email systems using an age-old technique: phishing.

Executives at the firm believe that the crooks wanted to install ransomware on its systems, but told The Register that the company spotted the problem before they could get a foothold.
Evergreen Life took a responsible approach to dealing with the problem, say reports, including proper segmentation of its different systems. Its patient-facing systems are not connected to its email system, it said.
Click to expand...

guest · Oct 26, 2019

Betty Jean Kerr People’s Health Center discloses ransomware attack
Data breach at St. Louis health center impacts up to 152,000
A cyber attack last month locked data and demanded a ransom to unlock it
October 25, 2019
https://www.ksdk.com/article/news/l...enter/63-9279c732-55ab-47ca-aaea-130e3b06206a

Officials at a St. Louis health center that serves needy, uninsured residents says a cyber-attack has caused a data breach that potentially affected 152,000 people.

The Betty Jean Kerr People's Health Center said Friday that the attack involved patient information such as addresses and social security numbers, but no patient medical records. Information on medical providers and health center employees also was breached.
The incident last month locked data and demanded a ransom to unlock it. The center says it refused to pay the ransom and contacted police.
Click to expand...

guest · Oct 27, 2019

mood said: ↑

Two Southwestern Ontario hospitals hit by cyber attack
September 26, 2019
https://lfpress.com/news/local-news...tack/wcm/37654a62-dae4-4350-91e8-50ccf21830ab
Click to expand...

Hospital systems functioning normally again following cyberattack
October 25, 2019
https://london.ctvnews.ca/hospital-...ormally-again-following-cyberattack-1.4655885

A cyberattack that knocked computer networks offline at two area hospitals has come to an end.

On September 25, hackers disrupted computer networks at hospitals in Wingham and Listowel.
This week, the hospitals say they’ve ended the Code Grey and all systems are functioning as normal.

“While there are things that we can learn and improve upon, I am extremely proud of the entire hospital team. The teamwork, resiliency and professionalism of staff and physicians was exceptional,” said Listowel Wingham Hospitals Alliance Chief Executive Officer, Karl Ellis.
Click to expand...

guest · Oct 27, 2019

More than 20,000 clients’ information compromised after Sweetser email hacking
October 25, 2019
https://bangordailynews.com/2019/10...ion-compromised-after-sweetser-email-hacking/

Personal, health and financial information of more than 20,000 clients of a Maine mental health agency was compromised following a June email hacking incident, the agency said Friday.

The information contained in the hacked email account may have included clients’ names, addresses, dates of birth, telephone numbers, Social Security numbers, health insurance information and identification numbers, driver’s license numbers, Medicare or Medicaid information, payment or claims information, diagnostic codes, and information regarding medical conditions and treatment, according to the agency.

A digital forensics team the mental health services provider hired found that, for a 10-day period from June 18 to 27, Sweetser employee email accounts were subject to unauthorized third-party access.
On Sept. 10, the investigation revealed that multiple employee email accounts might have been hacked for information.
Click to expand...

guest · Oct 27, 2019

Dozens of patient records stolen from Winnipeg's Children's Hospital
Personal information of 54 youths taken from locked cabinet in hospital's reception area
October 25, 2019
https://www.cbc.ca/news/canada/manitoba/patient-records-stolen-winnipeg-childrens-hospital-1.5335800

The personal health information of 54 minors was stolen this week from a locked cabinet at the Children's Hospital in Winnipeg, the province's Shared Health agency said in a Friday news release.

The stolen records relate to two days' worth of scheduled surgical procedures for youths from Manitoba, Ontario and Nunavut.
The files were taken from a cabinet in the reception area of the Children's Hospital, which is on the Health Sciences Centre campus.
The provincial health organization is responsible for integrating and co-ordinating patient care across Manitoba, and is responsible for operations at HSC, including the Children's Hospital.

"The safety and security of our patients' personal information is a responsibility we take very seriously," Ronan Segrave, chief operating officer of the Health Sciences Centre, said in a news release.
Click to expand...

guest · Oct 28, 2019

Queensland Health blocks personal staff emails, cites malware fears
October 28, 2019
https://www.theage.com.au/national/...ails-cites-malware-fears-20191028-p5351i.html

Queensland Health has blocked staff from accessing personal email accounts out of concern about the high threat of hacking.

Four days ago, the Australian Cyber Security Centre issued an alert that EMOTET malware was targeting businesses and individuals through emailing attachments or website links that appeared normal.
A Queensland Health spokesman said the department's priority was "patient safety and privacy and our cyber security teams are not aware of any Queensland Health information being compromised".

"Preventative measures are in place and recommended protocols are being followed, and will remain until the threat has been reduced," the spokesman said.
Staff were reminded not to open suspicious emails or attachments, to not attempt to contact the sender by email or other means and to report any suspected phishing attempts.
Click to expand...

guest · Oct 29, 2019

Kroger reports 'isolated incident' involving pharmacy records
The patients' name, prescription number and potentially the third-party billing processor name may have been exposed
October 29, 2019
https://www.11alive.com/article/new...reach/85-0522c055-5060-4572-85a3-7a921fd57066

Kroger announced Monday that a box of pharmacy records was lost.

They said in late July, a records management service, Retrievex, Inc., the company’s business associate, shipped a box of pharmacy records to the Woodstock Kroger via a third-party common carrier.
Retrievex confirmed with the carrier that the box was lost in transit on Sept. 11, 2019 and concluded an internal investigation on Oct. 4, Kroger said. They formally shared the results with Kroger on Oct. 14.
The box contained drive-thru signature logs, which may have contained the patient’s first and last name, prescription number and potentially the third-party billing processor name.

[...] Felix Turner, manager of corporate affairs for Kroger’s Atlanta Division. “We take the privacy of our customers very seriously and are committed to creating additional safeguards to prevent a similar isolated event from recurring.”
Upon learning of this incident, Kroger worked with Retrievex to reinforce processes and procedures within both companies for shipping boxes containing protected health information.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches