Why Healthcare Security Matters

ronjor · Oct 29, 2019

Quest Diagnostics Proposed Breach Settlement Approved

Marianne Kolbasuk McGee (HealthInfoSec) October 29, 2019
Patients Whose HIV Test Results Were Exposed Will Get $75
Click to expand...

guest · Oct 29, 2019

Patients’ personal info exposed online after SC hospitals records were compromised
October 29, 2019
https://www.thestate.com/news/local/article236768133.html

Patients and volunteers at several Midlands hospitals might have had their personal information exposed online, according to Prisma Health.

The problem was discovered after a Prisma Health employee’s login credentials were compromised, said Tammie Epps, a spokeswoman for the largest hospital system in South Carolina.
Records from the six hospitals of Prisma Health-Midlands were affected in the leak, which was discovered on Aug. 29, Epps said in a news release. The company did not respond by Tuesday evening to questions from in The State, including about why the public was not alerted sooner.

The Prisma news release did not say how many patients and volunteers might have been affected by the compromise.
Prisma Health said it is mailing letters to the people who might have been affected by the incident.
Click to expand...

The company did the same thing in September after patient information was exposed when a notebook was stolen from a doctor’s car.
The notebook, stolen on July 9, contained information about OB/GYN patients from the Prisma Health Richland Campus in Columbia, according to a news release.

In March, an email phishing incident was reported by Prisma, but medical records were not affected.
Click to expand...

guest · Oct 30, 2019

NHS pagers are leaking medical data
Unprotected pager messages are broadcasting health and medical data across UK cities
October 30, 2019
https://techcrunch.com/2019/10/30/nhs-pagers-medical-health-data/

An amateur radio rig exposed to the internet and discovered by a security researcher was collecting real-time medical data and health information broadcast by hospitals and ambulances across U.K. towns and cities.

Daley Borda, a security researcher and bug bounty hunter, stumbled upon the exposed webcam. The live stream was grainy, and the quality of the images so poor that it was just possible to make out the text on the display.

“You can see details of calls coming in — their name, address, and injury,” he told TechCrunch.
The hobbyist was picking up and decoding pager communications from a nearby regional National Health Service trust.

“With some cheap, relatively basic, software it is possible for hobbyists to access these frequencies and decode the information being sent, which appears is what has occurred here,” the spokesperson said.
Click to expand...

Old but reliable
Pagers — or beepers — may be a relic of the past, but remain a fixture in U.K. hospitals.
But few were thinking about message security when pager use was at its peak.

“They aren’t secure,” Andy Keck, an electronics and amateur radio hobbyist, told TechCrunch. Keck said messages sent over the pager network are encoded when they are converted into a burst of radio waves and broadcast over the air.
130,000 NHS pagers
Although the number of pagers has dropped to near-zero from their height in the 1980s, pagers still carry a considerable amount of information every day.
Click to expand...

guest · Oct 31, 2019

20,000 Utah Valley Eye Center patients may have had information hacked after HIPAA breach
October 31, 2019
https://www.heraldextra.com/news/lo...cle_3c1e986a-0532-520f-9d25-5569b843dd01.html

Demographic information for more than 20,000 patients could have been accessed after Utah Valley Eye Center was hacked last year, according to the center.

The Provo business’s portal was hacked on June 18, 2018, and an email was sent to 5,764 patients disguised as a notification from PayPal telling the patients they had received a payment, according to a press release.
The eye center immediately sent an email to patients who had received the PayPal email after learning its system had been hacked, according to the release. The center believes only emails were accessed, but that patient names, addresses, birth dates and phone numbers could have been seen.
The center has taken additional steps to secure the systems, which is mainly used for scheduling reminders.
Click to expand...

ronjor · Oct 31, 2019

HHS Updates Security Risk Assessment Tool

Marianne Kolbasuk McGee (HealthInfoSec) October 31, 2019
Many HIPAA enforcement actions taken by federal regulators have chastised organizations for their poor security risk assessments. In light of this ongoing challenge, The Department of Health and Human Services has released an updated version of its security risk assessment tool, which includes enhancements such as improved asset and vendor risk management features.
Click to expand...

guest · Nov 1, 2019

Cyber criminals hack a hospital and steal patients' personal information in terrifying security breach
November 1, 2019
https://www.dailymail.co.uk/news/ar...hetic-Group-hacked-cyber-security-breach.html

Perth Anaesthetic Group in the city's south was hacked on Thursday morning and criminals gained access into the hospital's database.
The cyber hackers sent out fake invoices to several patients demanding they submit payments for treatments.

'The breach was controlled and the impacted individuals have been contacted,' Ms McGrath told The West Australian.
'There was no ransom demand and no money was paid.'
In the wake of the attack an email was sent around to patients of the group ensuring them that security on the hospital had been increased.
Click to expand...

guest · Nov 2, 2019

The Brooklyn Hospital Center Notice of Data Security Incident
November 2, 2019
https://finance.yahoo.com/news/brooklyn-hospital-center-notice-data-230000523.html

The Brooklyn Hospital Center (the "Hospital") is a full-service community teaching hospital located in Brooklyn, New York. The Hospital is providing notice of a recent data security incident that may affect the security of personal information in our care.
However, we are unable to recover certain data related to specific patients, therefore, we are notifying patients regarding the data incident and steps we have taken since discovery of this event.

In late July 2019, the Hospital became aware of unusual activity relating to certain Hospital servers. The Hospital immediately commenced an investigation, which included working with a leading third-party forensic investigation firm, to determine the full nature and scope of the incident. Through this investigation, we determined that a malware that encrypted certain systems had disrupted the operation of certain Hospital systems;

Further, the Hospital is reviewing its policies and procedures relating to data security and taking steps to enhance existing security protocols.
Click to expand...

The Brooklyn Hospital Center: Notice of Data Event

guest · Nov 2, 2019

Lawsuit: Philips Claims Repair Company Hacked its Medical Devices
November 1, 2019
https://www.legalscoops.com/lawsuit-philips-claims-repair-company-hacked-its-medical-devices/

Electronics company Philips has filed a lawsuit against a Seattle-area repair company, alleging that it hacked into its imaging machines and stole trade secrets.

Philips claims that Summit Imaging created software intended to hack into ultrasound machines and other devices to circumvent access controls that regulate the hardware.
Summit Imaging promotes its software to health care customers, including hospitals, clinics, manufacturers and healthcare networks. They market their software as a way to get around these restrictions, like the ones Philips puts on its devices.

Summit provides repair services for Philips imaging devices. Allegedly, once Summit has the hardware, it uses its own Adepto software to get around restrictions and alter the device’s software.
Click to expand...

Philips alleges imaging service company hacked its ultrasound machines

[...] lawsuit filed in federal court in Seattle.
Click to expand...

guest · Nov 3, 2019

18 cybersecurity incidents in October
November 1, 2019
https://www.beckershospitalreview.com/cybersecurity/18-cybersecurity-incidents-in-october.html

Numerous privacy incidents at hospitals, IT suppliers and other healthcare organizations captured public attention last month.
While some security incidents only affected less than 1,000 patients, others were said to have affected more than 500,000.

Here are 18 healthcare privacy incidents reported by Becker's Hospital Review in October: [...]
Click to expand...

ronjor · Nov 4, 2019

Facebook wants to give you medical advice. But can you trust it?

By Ruth Reader 10.28.19
Despite widespread problems of mistrust and disinformation, Facebook is launching a mobile tool to show people what screenings and immunizations they should be getting based on their age and sex.
Click to expand...

guest · Nov 4, 2019

Eye Clinic Notifies Thousands About 2018 Breach
Patient Portal Incident Involved Third-Party Vendor
November 4, 2019
https://www.databreachtoday.com/eye-clinic-notifies-thousands-about-2018-breach-a-13348

A Utah eye clinic began notifying about 20,000 patients last week about a June 2018 breach involving a third-party appointment reminder portal vendor. Many of the affected individuals had been previous targets of an email scam last year tied to the breach.

"It's vital today for healthcare organizations to have a strong vendor risk management program that continually identifies, mitigates and manages the risk the organizations face from sharing data with vendors," says Matthew Sadler, senior manager at the consultancy LBMC Information Security.
Portal Problem
In an Oct. 31 statement, the Utah Valley Eye Center, a Provo-based clinic, says that its portal used to send out appointment reminders to patients was hacked last June. A third-party vendor, DemandForce, runs the portal.

"On June 18, 2018, our scheduling reminder portal was hacked, resulting in an email being sent out to many of our patients disguised as a notification from PayPal that they had received a payment," the statement notes.
The Utah Valley Eye Center breach was posted on HHS OCR's HIPAA Breach Reporting Tool website as being reported on Nov. 1 as a hacking/IT incident involving a desktop computer and impacting more than 20,400 individuals. The HHS website lists health data breaches impacting 500 or more individuals.
Click to expand...

ronjor · Nov 5, 2019

Healthcare data breaches will cost industry $4 billion by year's end, and 2020 is poised to be worse

Jeff Lagasse 04 Nov 2019
Providers continue to be the most targeted organizations for industry cybersecurity breaches, with nearly 4 out of 5 breaches.
Click to expand...

guest · Nov 5, 2019

OCR Issues Two HIPAA Enforcement Actions, Plus Adjusts Future Fines
Settlement With University of Rochester Medical Center, Penalty for Texas HHS Commission
November 6, 2019
https://www.databreachtoday.com/ocr...ent-actions-plus-adjusts-future-fines-a-13360

OCR on Tuesday said it signed a $3 million HIPAA settlement with the University of Rochester Medical Center related to breach reports in 2013 and 2017 involving the losses of an unencrypted flash drive and an unencrypted laptop.
URMC, which includes the School of Medicine and Dentistry and Strong Memorial Hospital, is one of the largest health systems in New York state with over 26,000 employees.

At a HIPAA conference in Washington on Tuesday, OCR Director Roger Severino noted that the agency has also issued a $1.6 million civil monetary penalty against the Texas Health and Human Services Commission in a case involving web application security.
URMC Settlement
"Of note, in 2010, OCR investigated URMC concerning a similar breach involving a lost unencrypted flash drive and provided technical assistance to URMC," OCR says. "Despite the previous OCR investigation, and URMC's own identification of a lack of encryption as a high risk to ePHI, URMC permitted the continued use of unencrypted mobile devices."

So far in 2019, OCR has taken HIPAA enforcement actions against at least seven entities, including URMC and Texas Health and Human Services Commission.
Click to expand...

Adjusting Penalties
In other action on Tuesday, HHS issued a final rule to adjust its civil monetary penalties for annual inflation - including civil monetary penalties for HIPAA violations. The increase of about 1 percent, which affects all tiers of HIPAA enforcement penalties, goes into effect immediately.
Click to expand...

guest · Nov 6, 2019

IT Misconfiguration Leads to 15 Breach Reports
Letters From Texas Health Resources Hospitals Mailed to Wrong Recipients
November 6, 2019
https://www.inforisktoday.com/misconfiguration-leads-to-15-breach-reports-a-13371

A misconfigured billing system that caused a mailing mishap affecting nearly 83,000 individuals has prompted Texas Health Resources to file 15 breach reports to federal regulators - one for each hospital involved.

The healthcare system serves more than 7 million patients in North Texas through a physicians group and 26 hospital locations.
In a statement, Texas Health Resources says that on Aug. 23, it learned that a misconfiguration of its billing system "allowed for patient information to be matched with and sent to the incorrect guarantor" from about July 19 through Sept. 4.

"Texas Health immediately took steps to correct the misconfiguration and began an investigation," the statement says.
A total of nearly 83,000 individuals were affected by the Texas Health incident, according to the HHS website, which lists health data breaches affecting 500 or more individuals.
Click to expand...

guest · Nov 7, 2019

mood said: ↑

More than 20,000 clients’ information compromised after Sweetser email hacking
October 25, 2019
https://bangordailynews.com/2019/10...ion-compromised-after-sweetser-email-hacking/
Click to expand...

Two Maine Healthcare Providers Report Email Security Breaches Impacting 52,000 Patients
November 7, 2019
https://www.hipaajournal.com/two-ma...l-security-breaches-impacting-52000-patients/

InterMed, one of the largest healthcare providers in Southern Maine, has discovered information on up to 30,000 patients has potentially been accessed by an unauthorized individual as a result of a recent email security breach.

On September 6, 2019, InterMed discovered an employee’s email account had been accessed by a third-party without authorization.
Emails and attachments in the compromised accounts contained patient information such as names, dates of birth, clinical information, and health insurance information, and for 155 individuals,
Sweetser Breach Impacts 22,000 Current and Former Clients
Another Maine healthcare organization has also recently announced an email system breach. Sweetser, a Saco, ME-based provider of mental health services, discovered a potential email account breach on June 24, 2019 when suspicious activity was identified in the account
Click to expand...

ronjor · Nov 7, 2019

Study: Ransomware, Data Breaches at Hospitals tied to Uptick in Fatal Heart Attacks

Hospitals that have been hit by a data breach or ransomware attack can expect to see an increase in the death rate among heart patients in the following months or years because of cybersecurity remediation efforts, a new study posits. Health industry experts say the findings should prompt a larger review of how security — or the lack thereof — may be impacting patient outcomes.
Click to expand...

guest · Nov 8, 2019

MCP binder with personal information of 3,300 people missing for almost 2 years
Missing since Jan. 2018, but department says it was told Oct. 23
November 7, 2019
https://www.cbc.ca/news/canada/newfoundland-labrador/mcp-binder-missing-gfw-1.5352032

A binder with the personal health information of roughly 3,300 people has been missing from the MCP office in Grand Falls-Windsor for almost two years, but the Department of Health says it found out last month.

"This is a matter I take very seriously. I apologize to those who may be impacted by this unfortunate incident," said Health Minister John Haggie in a press release advising the public of the privacy breach Thursday afternoon.
The department said it's advising the public of the privacy breach now after its executive was told on Oct. 23, 2019 that the binder had been missing since Jan. 25, 2018.
It's not clear why it has taken almost two years to alert individuals who may have had their personal information shared, nor why it took that long for the department to be advised.
New system, training for staff
"Steps have been taken to update the claims tracking process and MCP now uses an electronic system with appropriate security features," the release continued.
Click to expand...

guest · Nov 8, 2019

No patient information 'misused' after Salem Health employee email breach, spokesman says
November 8, 2019
https://eu.statesmanjournal.com/sto...lem-health-email-breach-spokesman/4169672002/

An unauthorized person gained access to employee email accounts at Salem Health Hospitals & Clinics, but a spokesman said Thursday that patient information was not "misused."

The unauthorized access happened in July; hospital officials don't know if the person viewed any patient information in the email phishing attack.
The health care provider learned Aug. 1 the unauthorized person gained access to employee email accounts on July 31.

This week spokesman Elijah Penner said in an emailed statement: "The incident was reviewed thoroughly and Salem Health has no indication that any patient information has been misused.
Click to expand...

guest · Nov 8, 2019

Health Data Breach Tally Update: Top Causes
An Analysis of the Latest Trends - and What's Ahead
November 8, 2019
https://www.databreachtoday.com/health-data-breach-tally-update-top-causes-a-13386

Hacker attacks, IT mishaps and vendor errors are among the top causes of the largest health data breaches added to the official federal tally so far this year.

A Friday snapshot of the U.S. Department of Health and Human Services' HIPAA Breach Reporting Tool website shows 429 breaches affecting a total of more than 40 million individuals have been added to the tally so far this year.
2019 Trends Playing Out
Of breaches posted in 2019 so far, 252 are reported as a "hacking/IT incident," and those affected a total of more than 35 million individuals - or about 88 percent of all those affected by breaches added to the tally.
Taking Action
So what health data breach trends are on the horizon for the year ahead?
"I believe we will continue to see hacking/IT incidents leading the way at least in terms of the biggest breaches," predicts Jon Moore, chief risk officer at privacy and security consulting firm Clearwater.
Click to expand...

guest · Nov 8, 2019

Hacker may have private information on nearly 44,000 TennCare members after Magellan data breach
November 8, 2019
https://eu.tennessean.com/story/new...-members-magellan-health-services/2534103001/

The private information of nearly 44,000 TennCare members may have been stolen by a hacker who breached the email system of the agency’s pharmacy management vendor, officials announced on Friday.
The private information that was potentially compromised includes names, social security numbers, member IDs, health plans, provider names and the names of drugs members have been prescribed.

Both TennCare and Magellan Health Systems have known about the risk for two months, but did not announce the breach or tell affected people until Friday.
When asked why TennCare waited to disclose the breach, TennCare spokeswoman Sarah Tanksley said the agency worked to get a “full understanding of the incident” and determine which members may have been impacted.

“We have confidence in Magellan and this process,” Tanksley said in a text message.
Click to expand...

guest · Nov 9, 2019

DHS Warns of Critical Flaws in Medtronic Medical Devices
November 8, 2019
https://www.securityweek.com/dhs-warns-critical-flaws-medtronic-medical-devices

An advisory published by the DHS’s Cybersecurity & Infrastructure Security Agency (CISA) warns of three recently patched vulnerabilities in Medtronic Valleylab FT10 and FX8 devices that could allow attackers to install a non-root shell.
The impacted devices use multiple sets of hardcoded credentials that, if exposed, could allow attackers to read files, CISA’s advisory reads. Tracked as CVE-2019-13543, the first of these vulnerabilities has a base score of 5.8.

It was also discovered that the vulnerable products use the descrypt algorithm for OS password hashing. Although network-based logons are disabled, other vulnerabilities could be used to get local shell access and obtain these hashes. The issue is tracked as CVE-2019-13539 and has a CVSS score of 7.0. [...]

“Medtronic recommends that surgeons and nurses continue to use these devices as intended. Customers should maintain good cyber hygiene practices by only connecting these devices to the hospital network when necessary and shutting them down between uses until the new software update is complete,” the medical equipment provider says.
Click to expand...

guest · Nov 10, 2019

Medicaid data made public for the first time
November 8, 2019
https://www.fedscoop.com/cms-medicaid-data-public/

The Centers for Medicare & Medicaid Services made some Medicaid data public for the first time Thursday to enable research into improving health care.

The data comes from the Transformed Medicaid Statistical Information System (T-MSIS) and was released as part of CMS’s MyHealthEData initiative promoting the creation of new health care solutions.

“The research community and stakeholders will have a powerful tool to provide creative solutions on Medicaid and CHIP healthcare delivery, outcomes, and financing,” said Seema Verma, CMS administrator, in an announcement.
The White House Office of American Innovation launched MyHealthEData last year to make Medicare data available to patients, researchers and accountable care organizations.
About 570 organizations representing nearly 80,000 health care providers have signed up for the Data at the Point of Care pilot this year to improve information sharing of Medicare claims data.
Click to expand...

guest · Nov 10, 2019

Delta Dental of Arizona - Notice of Data Incident
November 9, 2019
https://finance.yahoo.com/news/delta-dental-arizona-notice-data-233000070.html

Delta Dental of Arizona learned of an incident that may affect the privacy of certain information and is providing notice of the incident so potentially affected individuals may take steps to better protect their personal information, should they feel it appropriate to do so. To date, Delta Dental of Arizona has not received any reports that personal information has been misused as a result of this incident.

What Happened? On or around July 8, 2019, Delta Dental of Arizona became aware of suspicious activity related to an employee's email account. Delta Dental of Arizona immediately commenced an investigation, working with third party forensic investigators, to assess the nature and scope of the email account activity. The investigation confirmed that the employee fell victim to an email phishing scheme that allowed an unauthorized individual to gain access to the email account on July 8, 2019.

Upon learning of this incident, Delta Dental of Arizona immediately took steps to ensure the security of its email environment and investigate the activity. Delta Dental of Arizona is also reviewing its existing policies.
Click to expand...

Notice - Data Privacy Incident (PDF): https://www.deltadentalaz.com/documents/DDAZ_DataPrivacyIncident0719_WebsiteNotice.pdf

This incident only affects individuals who may have done business with Delta Dental of Arizona or whose employer may have done business with Delta Dental of Arizona – not members or clients of other Delta Dental member companies.
Click to expand...

guest · Nov 10, 2019

Data breach put thousands of Florida Blue members’ personal information at risk
November 8, 2019
https://www.miamiherald.com/news/health-care/article237179858.html

A data breach at Magellan Health, Inc. has put the personal information of Florida Blue members at risk, the company announced Friday.
Florida Blue says “less than 1 percent” of its approximately 5 million members were affected.

The breach, which reportedly occurred on May 28, was traced back to an employee who handles the healthcare provider’s member data. Magellan believes the employee’s email was hacked in a phishing scam. In doing so, numerous personal identifiers including the members’ names, dates of birth and prescriptions might’ve been accessed.
Florida Blue issued the following statement:

“We take data breaches very seriously, and while we do not believe our members’ personal information was compromised, we are working closely with Magellan to make sure our potentially impacted members have access to credit monitoring and identity theft protection tools to help them ensure their information is protected.”
Click to expand...

guest · Nov 10, 2019

mood said: ↑

Intimate Details on Healthcare Workers Exposed as Cloud Security Lags
October 8, 2019
https://threatpost.com/intimate-details-healthcare-workers-exposed-cloud-security/149007/

Security Discovery: Freedom Healthcare Staffing Exposed Nearly a Million Records Online
Click to expand...

A leak report quietly disappears, leaving questions in its wake
November 10, 2019
https://www.databreaches.net/a-leak-report-quietly-disappears-leaving-questions-in-its-wake/

If you had read the report on Security Discovery at the time, you would have read that almost one million people were potentially affected.
In response, their external counsel called me and emailed me, saying, “We believe there are inaccuracies in [the reporting].”

[...] it seems like the biggest disagreement with Fowler’s reporting was one of numbers. [...] Why did Security Discovery just silently remove their post with no explanation at all? And what about all the sites that had linked to that report and reported his stated findings?

DataBreaches.net contacted Security Discovery to ask why they removed their report. And that’s when things got even more confusing, because it seems they removed their post because they didn’t have enough data to prove that the data were real and not “test data.” Fowler explained, in part: [...]
Click to expand...

Fowler seems to have found a real exposure, although the number of individuals exposed may be in controversy.
But Fowler gets the last word on this one, as he realized that in the future, they need to download and preserve more proof of leaks to support their reporting.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches