Why Healthcare Security Matters

guest · Jun 12, 2019

Critical Bug in Infusion System Allows Changing Drug Dose in Medical Pumps
June 12, 2019
https://www.bleepingcomputer.com/ne...m-allows-changing-drug-dose-in-medical-pumps/

Researchers discovered two vulnerabilities in Alaris Gateway Workstations that are used to deliver fluid medication. One of them is critical and an attacker could leverage it to take full control of the medical devices connecting to it.
Attacker can alter drug infusion rate
Researchers at CyberMDX discovered that AGW's firmware can be replaced remotely with a custom version. An attacker sitting on the same network as the target system would be able "update and manipulate a CAB file, which stores files in an archived library and utilizes a proper format for Windows CE," say the researchers.
CyberMDX disclosed their findings privately to Becton Dickinson, who confirmed the vulnerability. The two companies worked together to remediate the problem.

The second vulnerability discovered by CyberMDX has a high-severity score of 7.5 and is in the web-based interface of AWG. It has a low attack complexity and can give hackers access to the device monitoring, event logs, and configuration of the device.
Exploiting it requires only the IP address of a target AWG, which makes for an easy mission for someone already on the network.
Click to expand...

ronjor · Jun 12, 2019

Quest, LabCorp breach stirs questions of cybersecurity risk from outside vendors

Rebecca Pifer @RebeccaMPifer June 10, 2019
"While there is no immediate financial impact for Quest or LabCorp, the breach is credit negative for the companies because it exposes them to reputational risk and shines a spotlight on how they select and assess their vendors," Moody's wrote in the report.
AMCA provides billing collections services to Optum360 (a contractor with Quest), which is in turn owned by for-profit healthcare behemoth UnitedHealth Group.
Click to expand...

guest · Jun 12, 2019

Privacy breach at QEH spurs surveillance of an employee's access to health charts
Hospital employee accessed a patient's health records without authorization
June 12, 2019
https://www.cbc.ca/news/canada/prince-edward-island/pei-privacy-health-1.5172124

P.E.I.'s privacy watchdog wants Health PEI to keep closer tabs on one of its employee's use of patient health records, following a privacy breach last year at Queen Elizabeth Hospital.
That's according to a new report by Information and Privacy Commissioner Karen Rose, posted May 30.

The patient alerted Health PEI to concerns over one employee at QEH, who was personally known to the patient, who, according to the log, had accessed the patient's medical records several times.
According to the report, when asked about the allegation, the employee told Health PEI that all of their access to the patient's health information was for "professional reasons."

However the agency's investigation concluded the employee had accessed, without authorization, the patient's records on some occasions. Health PEI found the employee was unable to offer a reasonable explanation for why the records had been accessed on those occasions.

"Victims of unauthorized access to personal health information require reasonable assurance." — Privacy Commissioner Karen Rose
Click to expand...

hawki · Jun 12, 2019

"Over 20M Patients Affected In Massive AMCA Medical Data Breach, Attorney General Frosh Warns Marylanders

Maryland Attorney General Brian E. Frosh warns Marylanders their medical and other private information may have been compromised by a cyberattack against American Medical Collection Agency, a third party collection agency for laboratories, hospitals, physician groups, medical providers and others...

The compromised information varies for each, but includes some or all of the following:

Patient Name
Date of Birth
Address
Phone Number
Date of Service
Provider
Balance Information
Payment Card Information
Bank Account Information
Social Security Number
Lab Test Performed..."

https://baltimore.cbslocal.com/2019/06/12/maryland-medical-data-breach-amca/

ronjor · Jun 13, 2019

Allscripts is buying ZappRx, a prescription drug start-up

Christina Farr @chrissyfarr 13 June 2019
ZappRx is selling itself to Allscripts, a publicly-traded health IT company, according to sources familiar.
Allscripts is looking to diversify its business outside of electronic medical records.
ZappRx was founded by Zoe Barry, who started the company after her brother was diagnosed with epilepsy.
Click to expand...

guest · Jun 13, 2019

Hospital to pay $300,000 in damages in medical records case
June 12, 2019
https://www.dothaneagle.com/enterpr...cle_7e906ec8-8d3c-11e9-b584-9b6c02b11398.html

A Coffee County jury on Tuesday awarded $300,000, including punitive damages, to plaintiff Amy Pertuit against Medical Center Enterprise for illegal access and disclosure of protected health information.

In a unanimous verdict, the jury found that Medical Center Enterprise failed to take action against its then-employee, Dr. Lyn Diefenderfer, after it learned that Dr. Diefenderfer had illegally accessed and disclosed Pertuit’s medical records.
Cash said $295,000 of the damages were punitive “against the hospital for its failure to properly investigate and punish Dr. Diefenderfer,” as MCE had apparently been made aware of Dr. Diefenderfer’s actions.

According to Cash, the hospital’s own privacy officer found 22 separate violations of HIPAA or the hospital’s privacy policy against Dr. Diefenderfer.
Click to expand...

Minimalist · Jun 14, 2019

Medical infusion-pump system has two serious bugs, researchers say

Researchers have found two vulnerabilities in a type of infusion-pump system, which hospitals used to administer medication, that they say could allow a hacker to disable the device, infect it with malware, or create false readings.

The vulnerabilities are in a pump system known as the Alaris Gateway Workstation made by Becton, Dickinson and Company (BD), a New Jersey-based medical equipment vendor.
Click to expand...

https://www.cyberscoop.com/medical-infusion-pump-system-two-critical-bugs-researchers-say/

ronjor · Jun 14, 2019

Healthcare executives need to make cybersecurity a business priority

Help Net Security June 13, 2019
Risks associated with Internet of Things, medical devices, third-party vendors, and program management are top of mind for healthcare executives, according to a CynergisTek’s survey.
Click to expand...

guest · Jun 14, 2019

87,400 Patients Impacted by Union Labor Insurance Phishing Attack
June 13, 2019
https://healthitsecurity.com/news/87400-patients-impacted-by-union-labor-insurance-phishing-attack

Union Labor Life Insurance, a subsidiary of Ullico, recently began notifying 87,400 patients of a potential data breach caused by an employee responding to a phishing email.

According to officials, an employee opened a malicious link in an email that appeared to be sent from a trusted business partner. It included a link to an apparent legitimate file sharing site, which requested the employee enter in their login credentials. But the link was fraudulent and gave the hacker their login details.
The compromised data included plan member names, addresses, dates of birth, Social Security numbers, and personal health information of the individuals and their family members.
Click to expand...

guest · Jun 14, 2019

Boardman medical practice hacked, told to pay $75,000 in bitcoin to unlock system
June 13, 2019
http://www.wfmj.com/story/40646778/...told-to-pay-75000-in-bitcoin-to-unlock-system

According to the report, N.E.O. Urology located on the 7400 block of Southern Avenue, had their computer systems hacked and re-encrypted.

A practice administrator told police that a fax was waiting for him when he arrived at the building requesting that the company pay a ransom to have the computer systems unlocked.
Police say the fax listed "Pay4Day.io" as the contact for further information.
Reports say the company contacted their I.T. Firm and were able to "backdoor" the hackers.

N.E.O Urology told police that the hackers went so deep into their system that it took until Wednesday to access their computer systems.
Police say N.E.O. Urology reported a revenue loss between $30,000 and $50,000 per day.
Click to expand...

ronjor · Jun 14, 2019

YouTube Testimonials Lure Patients to Shady Stem-Cell Clinics

Megan Molteni 06.14.19
Since the mid-2000s, clinics have been selling expensive, unproven stem-cell treatments to any patient desperate enough to believe their claims of cures for everything from arthritis to autism. At first, these clinics operated almost entirely overseas. But for the past decade, they have flourished in the US without much of a fight from regulators, even as the experimental therapies they hawk have been tied to serious infections, several cases of blindness, and one patient’s death.
Click to expand...

guest · Jun 15, 2019

Inside the cyberattack at Estes Park Health
June 13, 2019
https://www.eptrail.com/2019/06/13/inside-the-cyberattack-at-estes-park-health/

According to Estes Park Health CEO Larry Leaming, staff were noticing that computer screens were acting strangely, and Dr. Joseph Lee noticed it as well while treating a patient.
Hall was witnessing ransomware taking control and locking down programs, files and information to hold for ransom.

“When they realized something was locking files, they kind of pulled the plug on everything, shut down all the file servers and cut off all access to the data center,” Leaming said.
So after that occurred, EPH was left without network access or even phone service. They quickly set up their Hospital Incident Command Center and started dealing with the immediate issues, which first was establishing communications.
Leaming said that the hackers first locked down the software in the clinic, and the digital imaging software, which holds all images of x-rays and other digital images. These were the main areas that were locked, but according to Leaming, no data ever left that software, they were only locked.
Click to expand...

“I think it is important to say that likely the only way to restore the software in the clinic and the only way we were able to restore the imaging and so forth is because our insurance company paid the ransom money and we were able to get the keys to unlock those files,” Leaming said.
Click to expand...

guest · Jun 17, 2019

Patient data stolen during theft at Red Deer hospital
June 17, 2019
https://www.reddeeradvocate.com/news/break-in-at-red-deer-hospital-some-patient-data-breached/

Alberta Health Services is notifying 6,129 patients that their health information may have been viewed by someone other than their authorized care providers.
The measure follows the theft of two hard drives contained in equipment in the rehabilitation department at Red Deer Hospital during a break-in in April.

Investigators believe the likelihood of health information contained on the EMG hard drive – which was password protected, but unencrypted – being used or misused is extremely low, says AHS.
A review of security in the hospital is underway to identify possible enhancements.
Click to expand...

guest · Jun 18, 2019

‘WannaCry’ Ransomware Hits 40% of Health Care Organizations
June 17, 2019
https://hospicenews.com/2019/06/17/wannacry-ransomware-hits-40-of-health-care-organizations/

More that 40% of health care organizations have experienced a cyber attack involving the “WannaCry” ransomware cryptoworm within the past six months, according to a report by the cyber security firm Armis.

Health care organizations, including hospices, continue to be the preferred target of cyber criminals who can glean patient names, insurance information, financial information, addresses, social security numbers and other data that hackers can use for identity theft or other fraudulent activity.
“Health care, manufacturing and retail sectors have high rates of old operating systems in their networks,” the report indicated. "[...] It is not a coincidence that these sectors are also the ones affected the most by ransomware like WannaCry, which rely on unpatched devices for their successful operation.”
Click to expand...

guest · Jun 18, 2019

Cyber attacks cripple Olean Medical Group, possibly Seneca Nation Health System
June 17, 2019
http://www.oleantimesherald.com/ole...cle_0b54ee88-e184-517f-aee9-5a387fa04e05.html

Hackers attempting to ransom the computer systems at Olean Medical Group on Friday did not access records for 40,000 patients, group officials reported Monday.
In a faxed press release sent Monday, OMG officials noted the group is still seeing patients, even if charting is being completed by pen and paper instead of computer as the group recovers from the attack.

A similar situation appears to exist with the Seneca Nation Health System, with OMG officials reporting it is the same type of attack they experienced. The SNHS website also reported the computer system is down.
No individual took credit for the attack, with only an email address as a clue.
“A lot of these attacks come from overseas, but that’s just conjecture on our part,” Lewis said.
Click to expand...

ronjor · Jun 18, 2019

Delicious irony: Hacked medical debt collector AMCA files for bankruptcy protection from debt collectors

By Shaun Nichols in San Francisco 18 Jun 2019
The healthcare debt collector ransacked by hackers, who gained access to millions of patients' personal information, has filed for bankruptcy protection.
Click to expand...

guest · Jun 18, 2019

ResiDex Software Announces Data Security Incident
June 18, 2019
https://www.prnewswire.com/news-rel...security-incident----tennessee-300869168.html

Tenx Systems, LLC d/b/a ResiDex Software ("ResiDex") specializes in providing software for assisted living homes, group homes, and organizations providing care for the elderly or disabled,
On April 9, 2019, ResiDex became aware of a data security incident, including ransomware, which impacted our server infrastructure and took our systems offline. ResiDex immediately undertook efforts to restore its servers to a new hosting provider.

The investigation did determine that first access to ResiDex's systems occurred on approximately April 2, 2019, with the ransomware launched on April 9, 2019.
The data security incident may have resulted in unauthorized access to protected health information, including medical records that existed on ResiDex's software as of April 9, 2019, and/or personal information including names and social security numbers.
Click to expand...

ronjor · Jun 18, 2019

Spin the wheel and find today's leaky cloud DB... *clack clack... clack* A huge trove of medical malpractice complaints

By Shaun Nichols in San Francisco 18 Jun 2019 at 22:58
150,000 personal records on people, including US veterans, upset with their healthcare
Click to expand...

guest · Jun 19, 2019

Medical implants should be secured against cyber attack, experts urge
June 19, 2019
https://eandt.theiet.org/content/ar...be-secured-against-cyber-attack-experts-urge/

The Nuffield Council on Bioethics (NBC), an independent body that aims to influence policy decisions around medical ethics, has warned that current regulations do not include requirements to demonstrate cyber security of implants before they can be approved.
Connected implants such as pacemakers and implantable defibrillators are becoming increasingly commonplace and can monitor the body and automatically deliver treatment in response to changes.
They can store, process and transmit data about the patient and implant, and receive software updates.

“The emergence of connected implants opens up possibilities for improving patient care through data gathering and use,” NBC said in a briefing note for policy makers.
“However, these implants are vulnerable to error and attack and raise privacy issues."
Click to expand...

guest · Jun 19, 2019

NHS service accidentally reveals identities of HIV patients in email blunder
June 19, 2019
https://www.grahamcluley.com/nhs-se...-identities-of-hiv-patients-in-email-blunder/

An email sent by NHS Highland invited people with HIV to a support group run by Raigmore Hospital’s sexual health clinic in Inverness, Scotland. But rather than blind carbon copying (Bcc’ing) the sensitive email’s recipients, all addresses were included in the email’s Cc: field.
Ironically the email invitation promised to “respect anonymity” and to “never identify members present” at the meeting.

Sadly this isn’t the first time that HIV patients have suffered at the hands of a careless privacy breach.
A few years ago, a sexual health clinic in Soho, London, managed to disclose the names and email addresses of approximately 780 people, most of whom had HIV.
Click to expand...

guest · Jun 19, 2019

Specsavers says Qld customers' private medical information may have been compromised
June 19, 2019
https://www.abc.net.au/news/2019-06...ach-potential-compromise-for-clients/11223800

In an email to customers in Bundaberg this week the company outlined the recent privacy breach, stating clients' medical details had potentially been taken.
"Contents may include your name, date of birth, address, phone number, email address, clinical records of your optometry tests, and Medicare details," the email read.

How the information was compromised is still being investigated, but it appears a physical computer server was stolen.
"During the fit-out works, a range of building materials and IT equipment, including a password-protected computer server, went missing from an onsite storage facility," Specsavers said.
Click to expand...

guest · Jun 19, 2019

Shingle Springs Health and Wellness Center Ransomware Attack Impacts 21,000 Patients
June 19, 2019
https://www.hipaajournal.com/shingl...ter-ransomware-attack-impacts-21000-patients/

Shingle Springs Health and Wellness Center (SSHWC) in Placerville, CA, is notifying 21,513 patients that protected health information (PHI) was potentially compromised as a result of a recent ransomware attack.
SSHWC learned on April 7, 2019 that its server infrastructure had been compromised and ransomware had been deployed. As a result of the attack, all computer systems were rendered inoperable and access to patient data and essential files was blocked.

The ransomware attack is believed to have been conducted to extort money from SSHWC; however, files containing PHI were involved in the breach and could potentially have been compromised. Those files contained names, addresses, telephone numbers, Social Security numbers, health insurance information, provider names, dates of service, amount paid or owed, and diagnosis codes.
Click to expand...

guest · Jun 20, 2019

Meds prescriptions for 78,000 patients left in a database with no password
Database containing 390,000 Vascepa prescriptions for 78,000 patients left open on the internet
June 20, 2019
https://www.zdnet.com/article/meds-...patients-left-in-a-database-with-no-password/

A MongoDB database was left open on the internet without a password, and by doing so, exposed the personal details and prescription information for more than 78,000 US patients.
The database contained information on 391,649 prescriptions for a drug named Vascepa; used for lowering triglycerides (fats) in adults that are on a low-fat and low-cholesterol diet.

According to the vpnMentor team, all the prescription records were tagged as originating from PSKW, the legal name for a company that provides patient and provider messaging, co-pay, and assistance programs for healthcare organizations via a service named ConntectiveRX.

vpnMentor argues that whoever left that database open -- may it be PSKW or one of its partners -- has violated HIPAA, and may be in line for a hefty fine for failing to encrypt the patient data it had stored on the database server, a HIPAA golden rule.
However, Dissent, the administrator of DataBreaches.net [...] told ZDNet that just because a system stores medical information, it doesn't mean it's necessarily covered by HIPAA.
Click to expand...

ronjor · Jun 20, 2019

CVS just laid out a big reason why health companies are worried about Amazon

Christina Farr @chrissyfarr 20 June 2019
Health care companies have claimed that they are not threatened by Amazon.
But in a recent lawsuit, CVS argued that Amazon could pose a threat by negotiating directly with insurers, bypassing its lucrative pharmacy benefits manager (PBM) business.
Click to expand...

guest · Jun 21, 2019

May 2019 Healthcare Data Breach Report
June 20, 2019
https://www.hipaajournal.com/may-2019-healthcare-data-breach-report/

In April, more healthcare data breaches were reported than in any other month to date. The high level of data breaches has continued in May, with 44 data breaches reported. Those breaches resulted in the exposure of almost 2 million individuals’ protected health information.

From January 2019 to May 2019, an average of 37.2 breaches have been reported each month. Up until May 31, 2019, 186 healthcare data breaches had been reported to OCR, which is more than half (52%) the number of breaches reported last year.
It remains to be seen whether the increase in data breaches is just a temporary blip or whether 40+ healthcare data breaches a month will become the new norm.
Causes of May 2019 Healthcare Data Breaches
Hacking/IT incidents were the most numerous in May with 22 reported incidents. In total, 225,671 records were compromised in those breaches. The average breach size was 10,258 records with a median of 4,375 records.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

ronjor Global Moderator

guest Guest

hawki Registered Member

ronjor Global Moderator

guest Guest

Minimalist Registered Member

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

ronjor Global Moderator

guest Guest

hawki Registered Member

ronjor Global Moderator

guest Guest

Minimalist Registered Member

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

Useful Searches