Why Healthcare Security Matters

guest · Apr 17, 2020

Beaumont Health security breach puts personal information of 112,000 at risk
April 17, 2020
https://www.bridgemi.com/business-b...-breach-puts-personal-information-112000-risk

The personal information of 112,000 people who were treated at Beaumont Health was potentially compromised in a phishing email data breach that dates back nearly a year, the state's largest hospital system announced Friday.

Among the details that may have been leaked to "an unauthorized third party" include names, dates of birth, Social Security numbers, medical conditions, and in some cases, bank account information and driver's license numbers.
The eight-hospital health system said it worked with external forensic cybersecurity experts to investigate the data breach, and notified those who were affected Friday by mail.
Click to expand...

Beaumont discovered in late March that employee email accounts had been accessed May 23-June 3, 2019 by a third party, potentially compromising such patient information as name, date of birth, diagnosis, diagnosis code, procedure, treatment location, treatment type, prescription information, Beaumont patient account number, and Beaumont medical record number.
Beaumont said the 112,000 people affected in the security breach accounts for less than 5 percent of the 2.3 million patients the health system serves.
Click to expand...

guest · Apr 18, 2020

Hackers may have accessed personal information of Aurora Medical Center Bay Area patients
April 17, 2020
https://www.greenbaypressgazette.co...sed-patients-personal-information/5152983002/

Hackers may have stolen personal information from patients at Aurora Medical Center Bay Area.

Someone used an email phishing scam around January 1 to gain access to email accounts of several of the Marinette hospital's employees, according to Advocate Health Aurora.
When hospital leaders learned of the breach on Jan. 9, they alerted federal and state law enforcement, started an internal investigation and changed credentials for the employee accounts.

Officials said the hackers didn’t get into the hospital's electronic health records system, but they might have had access to patients’ personal and health information through employee emails.
Click to expand...

guest · Apr 18, 2020

Is your Hospital Prepared for the Next Cyber Attack?
April 16, 2020
https://blog.checkpoint.com/2020/04/16/is-your-hospital-prepared-for-the-next-cyber-attack/

Today, hospitals are connected like never before with cloud, mobile, and IoT technologies that improve their efficiency and quality of service. However, these changes have punched holes in the “good old” security perimeter and have created more entry points for hackers to target. And they do…
With ~40M patient records exposed in 2019, healthcare organizations continue to experience an increase in the number of data breaches, year over year [3].

Ransomware is also a prevalent threat; In June 2019, five US healthcare providers reported ransomware attacks in a single week [4].
But what makes hospitals so vulnerable to cyber threats?
Click to expand...

guest · Apr 19, 2020

Personal employee information mistakenly published at Thunder Bay Regional Health Sciences Centre
April 17, 2020
https://www.cbc.ca/news/canada/thunder-bay/thunder-bay-hospital-privacy-breach-1.5535282

CBC News has learned hundreds of employees at the Thunder Bay Regional Health Sciences Centre had their personal information published online by their workplace.

At the end of March, 245 employees had personal information published on the hospital's website, including their names, as well as their social insurance number (SIN) and other identifying information. The information was online for about a week and a half.
The hospital discovered the internal error in early April, and took down the identifying information.
Click to expand...

Minimalist · Apr 22, 2020

Senators want Cyber Command and CISA to do more to deter coronavirus-focused hackers

A bipartisan group of senators sent a letter to both the Department of Defense and Department of Homeland Security on Monday urging them to take more action to defend the U.S. healthcare sector against hackers that have been exploiting the coronavirus pandemic.
Click to expand...

https://www.cyberscoop.com/coronavirus-cisa-cyber-command-senate-letter/

guest · Apr 24, 2020

Genetic Testing Lab Hack Affects 233,000
Second Largest Health Data Breach So Far This Year
April 24, 2020
https://www.databreachtoday.com/genetic-testing-lab-hack-affects-233000-a-14182

A California-based genetic testing laboratory has reported an email hacking incident that may have exposed medical information on nearly 233,000 individuals. It's the second-largest health data breach posted to the federal health data breach tally so far in 2020.

The incident that Ambry Genetics reported on March 22 to the U.S. Department of Health and Human Services also serves as a reminder about the cyberthreats facing all laboratories and other healthcare entities that handle sensitive patient information - including medical testing data related to the COVID-19 pandemic.

"Labs are handling more tests than in normal times, increasing the amount of patient data stored, processed or transmitted," says Keith Fricke, principal consultant at tw-Security.
Click to expand...

Ambry Breach Details
In a statement posted on its website, Aliso Viejo, California-based Ambry Genetics, a Konica Minolta company, says its security team identified unauthorized access to an employee's email account between January 22 and 24.
That information includes customers' names, medical information, information related to customers' use of Ambry's services and, in some cases, Social Security numbers, the statement says.
Click to expand...

guest · Apr 26, 2020

Poplar Bluff Regional Medical Center notifying patients after tornado hits secure records service provider
Notice of Potential Data Breach
https://www.pbrmc.com/notice-of-potential-data-breach

This notice provides information regarding a potential inappropriate disclosure of personal information due to a tornado that struck a building leased by STAT Informatics Solutions, LLC ("STAT") in Lebanon, Tennessee on March 3, 2020. STAT is based in Waupaca, Wisconsin and provides various secure record services to healthcare entities. Poplar Bluff Regional Medical Center contracts with STAT to scan paper documents into the hospital’s electronic medical record system and for secure destruction of records.

Regrettably, the records stored in the building damaged by the tornado contained medical records, which may have included personal information such as a patient’s full name, social security number, address, date of birth, medical record number, [...]
Hospital representatives visited the site right away and began working with STAT in the aftermath of the tornado to locate medical records, and to secure the remaining records on the site.
Click to expand...

guest · Apr 27, 2020

Parkview Medical Center confirms cyber attack
April 24, 2020
https://www.koaa.com/news/covering-colorado/parkview-medical-center-confirms-cyber-attack

News 5 has learned on Friday night that Parkview Medical Center in Pueblo was the target of a cyber attack on Tuesday, April 21st.

The result of the attack was a number of outages in Parkview's IT systems.
Upon learning of the incident, Parkview immediately engaged leading third-party forensic experts to investigate and mitigation is well underway..

Currently, the IT systems are not working, but Parkview trains and prepares for scenarios like this. The medical center is doing everything they can to bring our systems back online as quickly and securely as possible.
Click to expand...

guest · Apr 27, 2020

Sydney nurse stole patients’ credit cards for $36,000 spending spree
April 27, 2020
https://7news.com.au/news/crime/syd...edit-cards-for-36000-spending-spree-c-1001345

A nurse at a Sydney day surgery has been found guilty after going on a $36,000 shopping spree with credit cards nicked from unconscious patients.

Kauser made more than 78 fraudulent and attempted purchases in early 2018 [...]
In the most brazen episode, the then-nursing director at Sydney Skin and Vein Clinic stole a patient’s card while the woman was being operated on in the Chatswood surgery.

Kauser told NCAT she no longer wanted to be a nurse and the matter had “been a very big wakeup call”.
Click to expand...

guest · Apr 27, 2020

Huiying Medical Breached; Source Code for AI-assisted COVID-19 Detection, and Experimental Data of COVID-19 on Sale
April 25, 2020
https://medium.com/@cyble/huiying-m...tection-and-experimental-data-of-1f5c6426121c

Cyble researchers have identified a credible threat actor ‘THE0TIME’ claiming to have gained access to Huiying Medical Technology’s COVID-19 detection’s technology source code and COVID-19 experimental data.
As part of the breach, the preparator claims to have gained access to the COVID-19 detection technology code, as well as COVID-19 experiments data as well. The price for sale is 4 BTC.
Click to expand...

guest · Apr 27, 2020

mood said: ↑

Banner Health agrees to $6 million settlement over 2016 breach
December 9, 2019
https://www.modernhealthcare.com/cy...-agrees-6-million-settlement-over-2016-breach
Click to expand...

Judge Approves $8.9M Banner Health Settlement Over 2016 Data Breach
April 24, 2020
https://healthitsecurity.com/news/judge-approves-8.9m-banner-health-settlement-over-2016-data-breach

A Federal judge of the US District Court of Arizona has given final approval for the class-action lawsuit against Banner Health, stemming from its June 2016 data breach that impacted more than 3.7 million patients, members and beneficiaries, providers, and food and beverage outlet customers.

First proposed in December 2019, the settlement includes both monetary payments for breach victims and a requirement for the Arizona health system to improve its information security program.
Banner Health first announced the breach of its food and beverage outlets’ payment processing system in June 2016. Hackers were able to leverage the system to gain access into the Banner Health network, which led to a hack of its servers containing patient data of millions of patients.
Click to expand...

The approval makes it one of the largest breach-related settlements in healthcare.
Click to expand...

guest · Apr 27, 2020

March 2020 Healthcare Data Breach Report
April 24, 2020
https://www.hipaajournal.com/march-2020-healthcare-data-breach-report/

March 2020 saw a 7.69% month-over-month decrease in the number of reported healthcare data breaches and a 45.88% reduction in the number of breached records.

In March, 36 healthcare data breaches of 500 or more records were reported to the HHS’ Office for Civil Rights (OCR), which is more than 16% fewer than the average number of monthly breaches over the past 12 months. 828,921 healthcare records were breached in March, which is 194% higher than the monthly average number of breached records.
Largest Healthcare Data Breaches in March 2020
The largest healthcare data breach of the month was reported by the genetic testing company, Ambry Genetics Corporation. An unauthorized individual gained access to an employee’s email account that contained the data of 232,772 patients.
Causes of March 2020 Healthcare Data Breaches
Hacking/IT incidents dominated the breach reports once again, accounting for 52.78% of the month’s breaches (19 incidents) and 94.38% of all records breached in March (782,407 records). The average breach size was 41,179 records and the median breach size was 10,700 records.
Click to expand...

guest · Apr 30, 2020

[paywalled]
LabCorp Board Sued in Delaware Over Billing Vendor Data Breaches
April 29, 2020
https://news.bloomberglaw.com/corpo...in-delaware-over-billing-vendor-data-breaches

LabCorp’s board and top executives were hit with a Delaware lawsuit blaming them for investor losses stemming from two massive data breaches by a billing vendor that exposed the personal information of millions of patients.
The derivative suit targets the medical testing giant’s directors, CEO, chief financial officer, and chief information officer. It accuses them of failing to address “persistently deficient cybersecurity measures” even after the first major cyberattack on American Medical Collection Agency, which took place across eight months in 2018-2019.

Those board-level oversights left LabCorp vulnerable to a separate malware attack and then a second AMCA breach earlier... [...]
Click to expand...

new article with more info:
LabCorp investors file lawsuit, alleging 'persistent' failure to secure data
April 30, 2020
https://www.cyberscoop.com/labcorp-investor-lawsuit-data-breach/

LabCorp investors have filed a lawsuit against the company following a major data breach last year that was one of three cybersecurity incidents the company has faced since 2018.

The suit, filed by shareholder Raymond Eugenio on behalf of LabCorp investors, alleges that the medical testing company’s chief executive, chief financial officer, chief information officer and its board of directors failed to address “persistently deficient” data protection measures regarding the theft of data about millions of people.

The legal complaint, first reported by Bloomberg, involves a hack on the American Medical Collection Agency (AMCA), a debt collection agency which made collections on behalf of LabCorp and other medical companies.

“In light of LabCorp’s history of information security challenges, the company has both the knowledge and responsibility to heighten information security standards and processes to better protect the patients it serves,” the suit states.
Click to expand...

guest · May 3, 2020

Philippines NPC Investigating COVID-19 Related Breaches
May 1, 2020
https://www.huntonprivacyblog.com/2...-npc-investigating-covid-19-related-breaches/

On April 25, 2020, the Philippines National Privacy Commission (“NPC”) issued a statement that it is investigating several breach notifications it has received relating to the unauthorized disclosure of sensitive personal information of confirmed and suspected COVID-19 patients (the “Statement”).

According to MLex, a communications officer for the NPC has confirmed that the regulator will focus primarily on remedial measures rather than on the imposition of fines as it investigates the 17 breach notifications reports it received between March 15 and April 23, 2020.
In the Statement, the NPC calls upon health institutions and their data protection officers to strengthen the protection of patient data and outlines eight measures that can be implemented [...]
Click to expand...

guest · May 5, 2020

'Breach of privacy': Ontario Privacy Commissioner on electronic information found abandoned by MLHU
May 5, 2020
https://london.ctvnews.ca/breach-of...information-found-abandoned-by-mlhu-1.4925162

A “breach of privacy" is how Ontario’s Privacy Commissioner refers to information discovered on electronics abandoned by the Middlesex London Health Unit during a recent move.
The commissioner also commends the actions of local authorities to contain the breach and “minimize the impact.”

Staff had discovered personal information and potential personal health information on electronics abandoned inside 50 King St by the Middlesex London Health Unit during its recent move to Citiplaza.
While providing no new details about the type or quantity of information involved, the Commissioner’s statement concludes, "We continue to explore ways to ensure that appropriate measures are taken to prevent further breaches of this nature."
Click to expand...

guest · May 9, 2020

mood said: ↑

Former Lurie Children's employee wrongfully accessed patient data, hospital says
December 27, 2019
https://abc7chicago.com/health/lurie-patient-data-wrongfully-accessed-hospital/5791304/
Click to expand...

Lurie Children’s sued over patient information breach
May 8, 2020
https://chicago.suntimes.com/2020/5...ent-information-unauthorized-access-employees

A mother is suing Lurie Children’s Hospital and two former employees who allegedly accessed the medical records of her 3-year-old daughter, who underwent a sexual abuse examination at the hospital early last year.

The mother received a letter from the hospital in late December informing her a nursing assistant had been accessing her daughter’s medical records “without a work-related reason,” according to the lawsuit.
The lawsuit was filed Friday in Cook County Circuit Court.

“Rather than take it seriously, Lurie chalked it up to the curiosity of a bored employee,” according to the suit. “Lurie refused to discuss whether this was a more widespread problem.”
The hospital later reported to the U.S. Department of Health and Human Services the records of 4,195 children were accessed in the 12 months ending in September 2019, the lawsuit said.
A separate notice posted to the hospital’s website told patients a call center had been established to answer breach-related questions.
Click to expand...

The lawsuit seeks class-action status to include multiple patients whose records were improperly accessed.
The suit asks for damages and restrictions be put in place to prevent further breaches.
Click to expand...

guest · May 11, 2020

FTC Seeks Comment on Health Breach Notification Rule
May 11, 2020
https://www.hipaajournal.com/ftc-seeks-comment-on-health-breach-notification-rule/

The U.S. Federal Trade Commission (FTC) is seeking comment on its breach notification requirements for non-HIPAA-covered entities that collect personally identifiable health information.
The FTC’s Health Breach Notification Rule was introduced in 2009 as part of the American Recovery and Reinvestment Act of 2009 (ARRA). The rule took effect on August 22, 2010 and the FTC started actively enforcing compliance on February 22, 2010.

The FTC routinely reviews rules every 10 years. In the 10 years since the rule was passed, only 2 breaches have been published on the FTC website, as most breaches reported to the FTC have involved fewer than 500 records. The FTC also reports that it has not needed to enforce compliance, as the entities to which the rule applies are somewhat limited.
[...] however, the FTC explains that its rule may soon apply to a greater number of entities.

“As consumers turn towards direct-to-consumer technologies for health information and services (such as mobile health applications, virtual assistants, and platforms’ health tools), more companies may be covered by the FTC’s Rule.”
The FTC is seeking answers to specific questions about its rule in relation to its effectiveness, benefits, and relevance to determine whether the rule should remain as it is, should be scrapped, or updated to increase the benefits to consumers.
Click to expand...

FTC: FTC Seeks Comment as Part of Review of Health Breach Notification Rule

guest · May 12, 2020

Health Data Breach Update: What Are the Causes?
Phishing Still a Major Culprit, But Other Challenges Emerge
May 12, 2020
https://www.databreachtoday.com/health-data-breach-update-what-are-causes-a-14269

Phishing scams continue to be a leading cause of health data breaches so far this year. But the theft of unencrypted laptops led to the biggest breach reported in 2020, and an insider breach involving a physician exposed data on thousands of patients.

As of Tuesday, 171 major health data breaches affecting a combined total of nearly 3.6 million individuals have been added to the Department of Health and Human Services' HIPAA Breach Reporting Tool website so far this year
The website, also commonly referred to as the "wall of shame," lists health data breaches affecting 500 or more individuals.
Click to expand...

As of Tuesday, the federal tally shows a total of 3,237 major health data breaches affecting nearly 242.5 million individuals since September 2009, when the HIPAA Breach Notification Rule took effect.
Phishing Scams
The largest phishing-related breach added to the tally in recent weeks was reported by Meridian Health Services in Muncie, Indiana. The incident affected nearly 111,400 individuals [...]
Click to expand...

guest · May 12, 2020

Possible privacy breach at Pickering long-term care home hard-hit by coronavirus
May 12, 2020
https://globalnews.ca/news/6927266/coronavirus-orchard-villa-possible-privacy-breach/

A possible privacy breach has been reported at a Pickering long-term care home that’s been hard-hit by a novel coronavirus outbreak.

Long-term Care Minister Merrilee Fullerton said the possible breach is regarding “individual resident personal health info” at Orchard Villa long-term care.
A spokesperson for the home confirmed to Global News that an internal investigation was conducted, but further information regarding the breach wasn’t provided.

“We can confirm there is a possibility of a privacy breach of personal health information,” the spokesperson said.
Click to expand...

Our government takes personal privacy very seriously, and we are continuing to monitor this situation closely. I have been in contact with @PBethlenfalvy and we both share feelings of frustration and sadness at this recent development. 2/3
— Merrilee Fullerton, MPP (@DrFullertonMPP) May 9, 2020
Click to expand...

guest · May 12, 2020

Feds: Tenn. can share COVID-19 patient info without violating HIPAA
May 11, 2020
https://www.wvlt.tv/content/news/Te...ating-HIPPAA-according-to-feds-570390321.html

The COVID-19 pandemic sparked the state of Tennessee to exercise an option allowing it to share Protected Health Information (PHI) with first responders.

A memorandum of understanding allows the Tennessee Department of Health to release the names and addresses of Tennesseans diagnosed with the virus. The option was originally granted by the U.S. Department of Health in 1996 but wasn't adopted and made effective effective until April 21, 2020.

"Public health departments have dealt with sensitive information like this for years; protocols have already been in place for years," said health care regulation and compliance attorney Shannon Coleman Egle, a partner at Kraymer Rayson.
Many have asked whether the disclosure of patient information is a breach of the Health Insurance Portability and Accountability Act (HIPAA). The short answer is 'no,' according to Egle.
Click to expand...

guest · May 13, 2020

Nova Scotia
Latest N.S. privacy breach reveals names, medical conditions, sexual abuse details
May 13, 2020
https://www.cbc.ca/news/canada/nova...rnment-saying-little-privacy-breach-1.5566936

The Nova Scotia government is saying very little about another privacy breach, this one involving an unknown number of Workers' Compensation Board appeal decisions that include the names of workers and some intimate personal information about them.

The province issued a statement about the breach from Sandy MacIntosh, chief appeals commissioner of the Workers' Compensation Appeals Tribunal.

"The Workers' Compensation Appeals Tribunal (WCAT) is aware of this situation, and WCAT is following the Province's privacy breach protocol. The WCAT has reported this incident to the Privacy Review Officer," it said.
MacIntosh did not answer questions about how the breach happened or how many people were impacted, saying the full investigation will answer those questions.

A spokesperson in the office of the information and privacy commissioner said it was notified of the breach on Tuesday.
Click to expand...

guest · May 16, 2020

Management and Network Services Notifies 30,132 Patients About PHI Breach
May 15, 2020
https://www.hipaajournal.com/manage...ces-notifies-30132-patients-about-phi-breach/

Management and Network Services (MNS), LLC, a Dublin, OH-based provider of administrative support services to post-acute healthcare providers, has discovered the email accounts of some of its employees have been compromised.

In a May 4, 2020 breach notification letter, MNS explained that it learned on or around August 21, 2019 that several employee email accounts had been subjected to unauthorized access between April and July of 2019. The analysis of the email accounts recently revealed five accounts contained the protected health information of patients of its clients.
MNS has taken steps to improve email security such as enhancing password policies across the entire organization and implementing multi-factor authentication for all employee email accounts.
Click to expand...

Santa Rosa & Rohnert Park Oral Surgery Suffers Email Security Breach
Santa Rosa & Rohnert Park Oral Surgery on Portland, OR has discovered the email account of one of its employees was accessed by an unauthorized individual. The breach was detected on March 11, 2020 when suspicious activity was detected in the email account.
The forensic investigation revealed the email account was breached on December 20, 2019 and access remained possible until March 11, 2020 when the account was secured.
Click to expand...

PHI of 3,683 Ashtabula County Medical Center Patients Exposed Online
Ashtabula County Medical Center (ACMC), an affiliate of Cleveland Clinic, is notifying 3,683 patients that some of their protected health information has been exposed online. On or around January 6, 2020, ACMC posted an Excel spreadsheet on a website to comply with government requirements about medical cost disclosures.
ACMC has now updated its policies and procedures and has implemented additional safeguards to prevent similar breaches in the future.
Click to expand...

guest · May 20, 2020

mood said: ↑

Feds: Tenn. can share COVID-19 patient info without violating HIPAA
May 11, 2020
https://www.wvlt.tv/content/news/Te...ating-HIPPAA-according-to-feds-570390321.html
Click to expand...

COVID-19 data sharing with law enforcement sparks concern
May 19, 2020
https://federalnewsnetwork.com/gove...-sharing-with-law-enforcement-sparks-concern/

First responders argue the information is vital to helping them take extra precautions to avoid contracting and spreading the coronavirus.

But civil liberty and community activists have expressed concerns of potential profiling in African-American and Hispanic communities that already have an uneasy relationship with law enforcement. Some envision the data being forwarded to immigration officials.

“The information could actually have a chilling effect that keeps those already distrustful of the government from taking the COVID-19 test and possibly accelerate the spread of the disease,” the Tennessee Black Caucus said in a statement.
Sharing the information does not violate medical privacy laws, according to guidance issued by the U.S. Department of Health and Human Services

In Tennessee, the issue has sparked criticism from both Republican and Democratic lawmakers, who only became aware of the data sharing earlier this month.
Click to expand...

guest · May 20, 2020

Minnesota health system email attack exposes 10,000+ patients' info: 4 details
May 19, 2020
https://www.beckershospitalreview.c...exposes-10-000-patient-records-4-details.html

Mille Lacs Health System in Onamia, Minn., reported that select employees fell victim to an email cyberattack that affected thousands of patients' information.
Four things to know:

1. The health system found that an unauthorized entity had access to employee emails from Aug. 26, 2019 to Jan. 7, 2020. Mille Lacs discovered the phishing attack on Nov. 14, 2019, and began an investigation. [...]
Click to expand...

guest · May 21, 2020

North Bay Parry Sound District Health Unit Announces Privacy Breach
May 21, 2020
https://www.myhealthunit.ca/en/News...0&newsId=aac0d691-8103-432c-aac5-d8310d02c3ba

The North Bay Parry Sound District Health Unit (“Health Unit”) announced today that there was a privacy breach in relation to its online COVID-19 dashboard. The dashboard contained information related to the number of COVID-19 tests and confirmed cases in the local community. Inadvertently, personal identifying information was made accessible through the dashboard. A member of the public reported the breach to the Health Unit.

Information that was accidentally made accessible was first and last name, municipality, unique identifying number (but not OHIP number), testing date and location, and the test result (if available). It may also have included a telephone number. There was no other health, financial or personal information accessible through our dashboard. The dashboard has since been removed from the Health Unit’s website.
After the Health Unit was made aware of this issue, it immediately removed the information from its website and launched an investigation.
www.myhealthunit.ca/dashboardbreach
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches