Why Healthcare Security Matters

guest · Jan 17, 2021

Wisconsin Medicaid information accessed by unauthorized individual
January 15, 2021
https://www.wearegreenbay.com/news/...ormation-accessed-by-unauthorized-individual/

Gainwell Technologies announced that someone may have gained unauthorized access to some participants’ information in Wisconsin’s Medicaid program.

According to a release, an unauthorized individual gained access to an account starting on Oct. 29, 2020, that may have exposed the names, member identification numbers and billing codes for services received of some participants in Wisconsin’s Medicaid program.
Gainwell Technologies is a business associate of DHS that provides fiscal-agent services for the Wisconsin Department of Health Services (DHS) Medicaid program, which serves about 1.2 million members annually.
Click to expand...

guest · Jan 17, 2021

ronjor said: ↑

MD Anderson Cancer Center Appeals $4.3 Million HIPAA Fine
Click to expand...

[paywalled]
M.D. Anderson’s $4.3 Million Fine for Patient Data Loss Vacated
January 14, 2021
https://news.bloomberglaw.com/priva...-3-million-fine-for-patient-data-loss-vacated

The University of Texas’s M.D. Anderson Cancer Center dodged a $4.3 million fine for losing over 35,000 people’s protected health information after the Fifth Circuit ruled Thursday that HHS acted arbitrarily and capriciously in finding that the provider violated two information security regulations.

The U.S. Health and Human Services Department incorrectly applied regulations implementing the Health Insurance Portability and Accountability Act and the the Health Information Technology for Economic and Clinical Health Act to impose civil monetary penalties far in excess of a statutorily mandated $100,000 yearly cap, the U.S. Court of Appeals for the Fifth Circuit said.
Click to expand...

https://www.databreaches.net/wp-content/uploads/19-60226-CV0.pdf

On Petition for Review of a Final Agency Decision of the U.S. Department of Health and Human Services
[...]
M.D. Anderson unsuccessfully worked its way through two levels of administrative appeals. Then it petitioned our court for review. See 42 U.S.C. § 1320a-7a(e) (authorizing judicial review). After M.D. Anderson filed its petition, the Government conceded that it could not defend its penalty and asked us to reduce it by a factor of 10 to $450,000.
Click to expand...

guest · Jan 18, 2021

Medical Device Security: Diagnosis Critical
January 18, 2021
https://threatpost.com/medical-device-security/163127/

Medical-device security has long been a challenge, suffering the same uphill management battle that the entire sprawling mess of IoT gadgets has faced.

Last year, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued more than a half-dozen warnings tied to connected drug pumps alone. Vulnerabilities found in pumps made by Baxter International and Becton Dickinson Alaris System, for example, could be exploited to launch a DDoS attack, alter system configurations or siphon off patient data.
The Diagnosis
Cybersecurity has also become a major theme for the Federal Drug Administration, which oversees medical-device safety. In 2020, the FDA issued a flurry of warnings urging medical device-makers and hospitals to patch their hardware against a slew of vulnerabilities, ranging from SweynTooth and URGENT/11 to Ripple20 and SigRed.
Click to expand...

Reducing medical-device cybersecurity risks may be especially challenging, but there are some best practices that can help.
Click to expand...

guest · Jan 19, 2021

December 2020 Healthcare Data Breach Report
January 18, 2021
https://www.hipaajournal.com/december-2020-healthcare-data-breach-report/

2020 ended with healthcare data breaches being reported at a rate of 2 per day, which is twice the rate of breaches in January 2020. Healthcare data breaches increased 31.9% month over month and were also 31.9% more than the 2020 monthly average.

There may still be a handful more breaches to be added to the OCR breach portal for 2020 but, as it stands, 565 healthcare data breaches of 500 or more records have been reported to OCR in 2020. That is more than any other year since the HITECH Act required OCR to start publishing data breach summaries on its website.
Click to expand...

December was the second worst month of 2020 in terms of the number of breached records. 4,241,603 healthcare records were exposed, compromised, or impermissibly disclosed across the month’s 62 reported data breaches. That represents a 272.35% increase in breached records from November and 92.25% more than the monthly average in 2020. For comparison purposes, there were 41 reported breaches in December 2019 and 397,862 healthcare records were breached.
Click to expand...

guest · Jan 23, 2021

Einstein Healthcare Network Announces August Breach
January 21, 2021
https://threatpost.com/einstein-healthcare-network-announces-august-breach/163237/

Einstein Health Network, a Pennsylvania-based company operating medical rehab, outpatient and primary care centers, announced a breach of its employee email system, which exposed patient personal and medical information.
The company waited more than five months to make the compromise public.

Einstein said its email system was compromised by an “unauthorized person” on Aug. 5, according to the statement, and persisted through Aug. 17. Einstein added it wasn’t able to figure out whether the contents of patient-related emails were stolen but is taking steps to alert patients who might have had everything from their name, date of birth and even diagnoses and prescriptions exposed to criminals.
Click to expand...

Einstein Broke HHS Breach Notification Rule
Einstein emphasized the breach didn’t affect all patients, just those contained within employee email accounts.

But why did the company wait five months after the breach to notify their patients that their most sensitive data was potentially in the wrong hands? The statement said “we are mailing letters,” so presumably malicious actors have had a hefty head start on any potential mitigation efforts.
Click to expand...

guest · Jan 23, 2021

HIPAA Enforcement by State Attorneys General
January 21, 2021
https://www.hipaajournal.com/hipaa-enforcement-by-state-attorneys-general/

The Department of Health and Human Services’ Office for Civil Rights is the main enforcer of HIPAA compliance; however, state Attorneys General also play a role in enforcing compliance with the Health Insurance Portability and Accountability Act Rules.

State Attorney HIPAA cases were relatively rare occurrences, with only 11 settlements reached with covered entities and business associates to resolve HIPAA violations between 2010 and 2015. HIPAA enforcement by state attorneys general was stepped up in 2017 with 5 settlements and again in 2018 when 12 cases resulted in financial penalties for violations of the HIPAA Rules.
Click to expand...

Several data breaches have resulted in settlements being reached at both the federal and state level.
In many of the state AG enforcement actions below, the financial penalties resolve violations of federal (HIPAA) and state laws. Over the years there have been several cases where HIPAA Rules have been violated, but the decision was taken to bring actions for violations of equivalent provisions in state laws. [...]
Click to expand...

guest · Feb 8, 2021

FTC Finalizes SkyMed Data Leak Settlement
Firm Must Implement Security Improvements Following Exposure of Records
February 8, 2021
https://www.databreachtoday.com/ftc-finalizes-skymed-data-leak-settlement-a-15946

A finalized Federal Trade Commission settlement issued Friday specifies security improvements that SkyMed, a company that provides medical emergency travel services, must implement following the leak of 130,000 membership records.

Under the final settlement, SkyMed must send a notice to affected consumers describing the information exposed in the data leak and implement a comprehensive information security program. The firm must obtain biennial assessments of this program by a third party. And qualified staff members must evaluate the program annually and fix any deficiencies found.

"The settlement also prohibits SkyMed from misrepresenting how it secures personal data, the circumstances of and response to a data breach, and whether the company has been endorsed by or participates in any government-sponsored privacy or security program," the FTC notes.
Click to expand...

The settlement, however, includes no financial penalty.
Click to expand...

guest · Mar 21, 2021

February 2021 Healthcare Data Breach Report
March 19, 2021
https://www.hipaajournal.com/february-2021-healthcare-data-breach-report/

The was a 40.63% increase in reported data breaches of 500 or more healthcare records in February 2021. 45 data breaches were reported to the Department of Health and Human Services’ Office for Civil Rights by healthcare providers, health plans and their business associates in February, the majority of which were hacking incidents.
Causes of February 2021 Healthcare Data Breaches
Three breaches of more than 100,000 record were reported in February. The largest healthcare data breach of the month was reported by Kroger, an Ohio-based chain of supermarkets and pharmacies. The breach was due to a CLOP ransomware attack on a vendor – Accellion – that resulted in the theft of the protected health information of 368,100 of its customers. Kroger was one of several HIPAA-covered entities to be affected by the breach. [...]
Click to expand...

hawki · Apr 8, 2021

"Major DC insurance provider hacked by 'foreign cybercriminals'

CareFirst BlueCross BlueShield’s Community Health Plan District of Columbia (CHPDC) suffered a data breach carried out by what it described as a 'foreign cybercriminal' group in January that potentially impacted sensitive data...

A written notification to customers...with the company noting that some of the stolen information may have included names, addresses, phone numbers, dates of birth, Medicaid identification numbers, and other medical information...

The company is offering free two-year credit and identity theft monitoring to all enrolled customers potentially impacted...

The breach is the third to hit CareFirst BlueCross BlueShield in the past six years, which overall serves around 3.4 million customers in Virginia, Maryland, and Washington, D.C., and is one of the largest health insurance providers in the region..."

https://thehill.com/policy/cybersec...nce-provider-hacked-by-foreign-cybercriminals

hawki · Apr 23, 2021

"Yale New Haven Hospital among health systems affected by cyberattack targeting cancer radiation machines

Yale New Haven Hospital says that it is among health systems across the U.S. that have been impacted by a cyberattack targeting cancer radiation treatment machines..."

https://connecticut.news12.com/yale...berattack-targeting-cancer-radiation-machines

guest · Apr 24, 2021

Some personal information obtained by hacker in information security breach at Baptist Health
April 23, 2021
https://eu.swtimes.com/story/news/2...on-security-breach-baptist-health/7349916002/

Baptist Health is alerting its Fort Smith area patients there was an information security breach beginning in December that allowed a hacker to obtain names of patients and physicians and their procedures but not demographic information such as date of birth, social security number or address.

The incident impacts about 15,000 patients in the Fort Smith area, a Baptist Health spokesperson said.

"As a healthcare organization, protecting patient privacy is among our highest priorities," a Baptist Health news release states. "This week Baptist Health-Fort Smith is notifying affected patients by letter of an incident involving a breach of protected health information."
Click to expand...

guest · May 2, 2021

Thrifty Drug discloses security breach
April 29, 2021
https://bismarcktribune.com/news/st...cle_102ad9ff-3cc5-54ea-8078-1f1ce19e3386.html

Thrifty Drug Stores Inc., which does business as Thrifty White, is notifying customers about a security breach.
Some of those files contained Thrifty patient information, including names, dates of birth, prescription information, and for some patients, the medical record number.

Officials say they are not aware of any actual or attempted misuse of information, but they encourage patients to monitor for any suspicious activity.
Click to expand...

guest · May 2, 2021

Data breach discovered at Achievement Center of LECOM Health
April 30, 2021
https://www.yourerie.com/news/local...overed-at-achievement-center-of-lecom-health/

A recent data breach was discovered at the Achievement Center of LECOM Health

According to a news release release, ACLH discovered suspicious activity in two of its business email accounts back on March 2nd.
An investigation revealed that there was unauthorized access to one email account from the Achievement Center of LECOM Health from July 30, 2020 to August 3, 2020.
Click to expand...

The data analysis revealed that the types of information held by ACLH and potentially in one of the email accounts includes: demographic data ranging from name, address, date of birth, and/or social security number; clinical diagnosis, lab results, medication and/or other treatment information; and/or insurance information names, emails, and addresses.
Click to expand...

guest · May 10, 2021

Reported ransomware attack leads to weeks of Aprima EHR outages
May 7, 2021
https://www.healthcareitnews.com/news/reported-ransomware-attack-leads-weeks-aprima-ehr-outages

A reported ransomware attack on the CompuGroup Medical data center partner, MedNetwoRX, has impeded some customers' access to their Aprima electronic health record systems for more than two weeks.

According to emails forwarded to Healthcare IT News, the disruption began on April 22 – and some hosted Aprima clients are still waiting for service to be restored as of Friday.

"The outage has been tremendously disruptful to our ability to properly care for our patients," said Dr. Christopher Fox, a Colorado-based endocrinologist.
According to the email, "A sophisticated criminal organization carried out a ransomware attack on some of the hosting vendor’s systems, disaster recovery site, and backups."
Click to expand...

guest · May 18, 2021

mood said: ↑

Plastic surgeon facing disciplinary charge over allegations he filmed patients without consent
June 17, 2020
https://www.cbc.ca/news/canada/toronto/dr-6ix-disciplinary-charge-1.5616103
Click to expand...

Toronto plastic surgeon's licence suspended over social media posts, surveillance of patients without consent
Dr. Martin Jugenburg also faces class-action lawsuit for allegations of surveillance
May 14, 2021
https://www.cbc.ca/news/marketplace/plastic-surgeon-martin-jugenburg-licence-suspended-1.6027242

A Toronto plastic surgeon and self-styled social media influencer has had his licence to practise medicine suspended.

In a decision released on May 12, the disciplinary committee of the College of Physicians and Surgeons of Ontario (CPSO) suspended the licence of Dr. Martin Jugenburg — who goes by Dr. 6ix on social media — for six months over inappropriate online posts and for his use of surveillance cameras in his downtown Toronto clinic.
The decision sparked a mixed reaction from a woman who visited Jugenburg's clinic, the Toronto Cosmetic Surgery Institute, in 2018.
Click to expand...

guest · Jun 18, 2021

CVS Health database leak left 1B user records exposed online
June 16, 2021
https://www.fiercehealthcare.com/te...-leaves-1-billion-user-records-exposed-online

More than 1 billion search records belonging to CVS Health were accidentally posted online and accessible to the public earlier this year.

The database belonging to the healthcare and retail giant, which was not password protected, was discovered at the end of March by independent cybersecurity researcher Jeremiah Fowler, according to a report published by Website Planet, which conducts research into unsecured internet data.
The database, which was approximately 204 gigabytes in size and totaled 1.1 billion records, had no form of authentication in place to prevent unauthorized entry, the researchers said.
Click to expand...

guest · Jun 19, 2021

Coastal Medical Group notifies patients of data breach
June 18, 2021
https://centraljersey.com/2021/06/18/coastal-medical-group-notifies-patients-of-data-breach/

Coastal Medical Group, Old Bridge, is notifying patients of a data security incident that involved the patients’ health information.
On April 21, the practice discovered that certain of its computer systems were being affected by a data security event that the practice believes began on March 25, 2021, according to a prepared statement.

As a result, Coastal Medical Group is notifying all of its patients to make them aware of the event and offer resources to help ensure their information remains protected.
Click to expand...

The information affected by the incident may have included full name, home address, date of birth, and other demographic and contact information, Social Security number, insurance information, and diagnosis and treatment information.
The affected computer systems did not contain any payment card or financial account information.
Click to expand...

guest · Jun 19, 2021

Critical flaws in defibrillator management tool pose account takeover, credential risk for hospitals
June 17, 2021
https://www.scmagazine.com/home/hea...count-takeover-credential-risk-for-hospitals/

Multiple remote code execution vulnerabilities found in the ZOLL Defibrillator Dashboard could allow a hacker to take control over the impacted system, according to a Department of Homeland Security Cybersecurity and Infrastructure Security Agency alert.

The half-dozen flaws are found in all versions of the dashboard prior to 2.2. It would take a low-skill level to exploit and could enable an attacker to gain access to credentials or impact the confidentiality, integrity, and availability of the application.
Click to expand...

One flaw, which CISA warned has a high likelihood of exploit, is the dashboard’s use of hard-coded cryptographic keys that “significantly increases the possibility that encrypted data could be recovered” by an attacker.

“If hard-coded cryptographic keys are used, it is almost certain that malicious users will gain access through the account in question,” according to the alert. “The cryptographic key is within a hard-coded string value that is compared to the password. It is likely that an attacker will be able to read the key and compromise the system.”
In health care, where patch management continues to be a challenge for most providers, administrators should leverage NIST guidance on data integrity attacks.
Click to expand...

guest · Jun 20, 2021

Fertility clinic discloses data breach exposing patient info
June 20, 2021
https://www.bleepingcomputer.com/ne...-discloses-data-breach-exposing-patient-info/

A Georgia-based fertility clinic has disclosed a data breach after files containing sensitive patient information were stolen during a ransomware attack.

Reproductive Biology Associates, LLC, (RBA) is a fertility clinic that recruits egg donors, retrieves eggs, and stores them for later use by recipients, including those using the MyEggBank service.
Ransomware gang accessed embryology data
In a data breach notification issued by both RBA and its affiliate MyEggBank, RBA states that they first learned that they were hit by a ransomware attack on April 16th, 2021, when "a file server containing embryology data was encrypted and therefore inaccessible."

However, they believe the attackers first gained access to their systems on April 7th and a server containing health information on April 10th.
Click to expand...

"In the course of our ongoing investigation of the incident, on June 7, 2021 we determined the individuals whose personal information was affected," says the RBA data breach notification.
"Access to the encrypted files was regained, and we obtained confirmation from the actor that all exposed data was deleted and is no longer in its possession. "

Due to this, all affected patients should be on the lookout for strange emails or SMS texts regarding the fertility clinic, egg donor information, or other related information.
Click to expand...

guest · Jun 20, 2021

mood said: ↑

Police got 25,000 criminal complaints from victims of Vastaamo hack
November 6, 2020
https://www.foreigner.fi/articulo/n...sychotherapy-center/20201109132009008943.html
Click to expand...

Compensation uncertain for Vastaamo victims
Patients whose files were hacked have yet to receive any compensation.
June 20, 2021
https://yle.fi/uutiset/osasto/news/compensation_uncertain_for_vastaamo_victims/11991155

Victims of the Vastaamo data leak which exposed the private mental health provider's patient database to the dark web are facing a 29 June deadline to seek compensation from the bankrupt company.

It's now up to victims to decide whether to seek compensation through criminal proceedings or from Vastaamo's bankruptcy estate.
Police have so far received some 25,000 criminal reports in connection with the hacking of therapy centre Vastamo's database.
Click to expand...

No central advocacy
There is no central body seeking compensation for victims. In addition to Victim Support Finland, publicly funded legal aid offices can offer advice to individual victims.
So far one law firm is representing 113 victims on a pro bono basis. However, the firm, Potilasvahinkoapu, said it was not able to add any more victims to its case.

Åberg pointed out that any sums potentially paid out of the bankruptcy estate are likely to be modest.
Click to expand...

guest · Jun 21, 2021

May 2021 Healthcare Data Breach Report
June 18, 2021
https://www.hipaajournal.com/may-2021-healthcare-data-breach-report/

May was the worst month of 2021 to date for healthcare data breaches. There were 63 breaches of 500 or more records reported to the Department of Health and Human Services’ Office for Civil Rights in May. For the past three months, breaches have been reported at a rate of more than 2 per day. The average number of healthcare data breaches per month has now risen to 54.67.

May was also the worst month of the year in terms of the severity of breaches. 6,535,130 healthcare records were breached across those 63 incidents. The average number of breached healthcare records each month has now risen to 3,323,116. 17,733,372 healthcare records have now been exposed or impermissibly disclosed so far in 2021 and almost 40 million records (39.87M) have been breached in the past 12 months.
Click to expand...

Causes of May 2021 Healthcare Data Breaches
Hacking/IT incidents dominated the breach reports in May. Out of the 63 reported breaches, 47 (74.60%) were hacking/IT incidents. These incidents resulted in the exposure or theft of 6,432,367 healthcare records – 98.43% of all records breached in the month. The average breach size was 131,273 records and the median breach size was 4,250 records. [...]
Click to expand...

guest · Jun 21, 2021

Vermont hospital still calculating cost of ransomware attack
June 18, 2021
https://apnews.com/article/vt-state...ology-health-a520b10c5a6d674e3f3747d41c314088

Officials at Vermont’s largest hospital are still trying to determine the full financial impact of the cyberattack last October that knocked out computers affecting three hospitals in Vermont and three in New York.

Scheduling and patient medical records were affected and some cancer patients faced delays in treatment.
It took months for the University of Vermont Health Network to recover from the attack, estimated to cost upwards of $63 million.
Click to expand...

The network is insured for $30 million and officials are continuing to negotiate with the insurance companies, but the final cost will exceed the coverage, WCAX-TV reported.
The FBI is still investigating the origins of the attack.
Click to expand...

guest · Jun 23, 2021

Ohio Medicaid providers’ data may have been exposed from data breach
June 22, 2021
https://www.daytondailynews.com/loc...-from-data-breach/LX27UA4PZVBSVFAZCVM2GS53FM/

A state contractor shared Monday that Ohio Medicaid providers may have had their personal data exposed a month ago when someone gained unauthorized access to an app.

Ohio Medicaid said on Monday it was notified by its data manager, Maximus, that it had a cybersecurity incident around May 17. This potentially exposed provider names, social security numbers, addresses, and other information.
People covered by Medicaid were not affected. The company said the incident did not affect any other Maximus servers, applications, or customers and said there is no evidence that any of the information has been misused.
Click to expand...

An application with Ohio credentialing and licensing data was accessed by an unknown party between May 17 and May 19.

Maximus said in a statement that it “promptly took the impacted application offline, launched an investigation with a leading cybersecurity firm, activated response protocols, and notified law enforcement.”
Maximus is one of the largest contractor of government health data services in the world.
Click to expand...

guest · Jun 23, 2021

Iowa eye clinic: 500,000 patient files may have been stolen
June 22, 2021
https://apnews.com/article/ia-state...g-technology-5886dc62016f9fd541f7c8fe9846abf7

The records of roughly 500,000 patients of an eye clinic with locations throughout Iowa may have been stolen as part of a ransomware attack on the business earlier this year.

Wolfe Eye Clinic said Tuesday its computer network was attacked on Feb. 8 by hackers who demanded a ransom to unlock access to its systems, but the company didn’t pay the hackers. The company plans to notify affected patients that their information may have been stolen and offer them a year of credit monitoring and identity theft protection services.

“Unfortunately, these types of cyber incidents have become all-too-common for health care providers of all sizes nationwide,” Bland said.
The company has set up a website and call center to respond to the hacking. Affected patients can call 1-833-909-3906 to get more information.
Click to expand...

ronjor · Jun 23, 2021

Hospitals are selling treasure troves of medical data — what could go wrong?

By Nicole Wetsman Jun 23, 2021
They don’t need patient consent to use de-identified data
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Useful Searches