Why Healthcare Security Matters

guest · Sep 25, 2018

Health Data Breach Tally Shows Mistakes That Lead to Trouble
Organizations Need to Avoid Mishaps That Can Make Matters Worse
September 25, 2018
https://www.inforisktoday.com/health-data-breach-tally-shows-mistakes-that-lead-to-trouble-a-11555

Recent additions to the federal health data breach tally shine a light on some of the mistakes that contribute to breaches - and in some cases, make situations worse.

A Sept. 25 snapshot of the wall of shame website, which lists reported health data breach impacting 500 or more individuals, shows a total of 263 breaches affecting a total of nearly 7.3 million individuals have been added to the tally so far in 2018.
No Good Quick Fixes
As for other mistakes, organizations need to ensure their employees and vendors are mindful about actions that can not only lead to privacy and security incidents - but also potentially make breaches worse.
Click to expand...

guest · Sep 25, 2018

UMass Memorial Health Care Entities to Pay $230,000 to Resolve AG’s Lawsuit Over Data Breaches
Lawsuit Alleges Breaches Exposed 15,000 Massachusetts Residents’ Personal and Health Information to Unauthorized Parties
September 20, 2018
https://www.mass.gov/news/umass-mem...000-to-resolve-ags-lawsuit-over-data-breaches

UMass Memorial Medical Group Inc. and UMass Memorial Medical Center Inc. will pay a total of $230,000 to resolve claims that two separate data breaches exposed the personal and health information of more than 15,000 Massachusetts residents, Attorney General Maura Healey announced today.

“Massachusetts residents rely on their health care providers to keep private health information safe and secure,” said AG Healey. “This resolution ensures UMass Memorial implements important measures to prevent this type of breach from happening again.”

As part of the settlement, the UMass Memorial Medical Group Inc. and UMass Memorial Medical Center Inc. have agreed to conduct employee background checks and ensure proper employee discipline; train employees on the proper handling of patient information; limit employee access to patient information; identify and remediate potential data security issues; and promptly investigate suspected improper access to patient information.
Click to expand...

guest · Sep 27, 2018

Aspire Health hacked by phishing scheme, loses some patients' protected health information
September 26, 2018
https://eu.usatoday.com/story/money...ishing-scheme-patient-health-data/1430262002/

Aspire Health, a health care company that offers in-home treatment in 25 states, was hacked earlier this month and lost some patient information to an unknown cyberattacker.

The hack, disclosed for the first time in federal court records filed Tuesday, occurred after a phishing attack gained access to Aspire’s internal email system Sept. 3. The hacker then forwarded 124 emails to an external email account, including emails that contained “confidential and proprietary information and files” and “protected health information,” according to the court records.
Aspire trying to ID the hacker
In the court records filed Tuesday, Aspire said it has tried to identify the hacker but so far has been unable to do so. The phishing attack originated from a website with an IP address in Eastern Europe for which Google is the registrar.

The hacking attack was revealed Tuesday as Aspire filed a federal court motion seeking to subpoena Google for more information on the unknown hacker.
Click to expand...

ronjor · Sep 28, 2018

The FDA's New Digital Health Cyber Unit: What Would It Do?

Marianne Kolbasuk McGee (HealthInfoSec) • September 27, 2018
If all goes according to plan, the Food and Drug Administration will launch in fiscal 2019 a new digital health "center of excellence" that includes a cybersecurity unit. The new unit would not only deal with cyber issues pertaining to new health technologies, but also challenges facing older medical devices.
Click to expand...

guest · Sep 28, 2018

ronjor said: ↑

Insider Steals Customer Data From Global Healthcare Group
Click to expand...

Health insurer Bupa fined £175k after staffer tried to sell customer data on dark web souk
Firm failed to monitor CRM system thousands could access
September 28, 2018
https://www.theregister.co.uk/2018/09/28/bupa_fine_dark_web/

International health insurance business Bupa has been fined £175,000 after a staffer tried to sell more than half a million customers' personal information on the dark web.

The miscreant was able to access Bupa's CRM system SWAN, which holds records on 1.5 million people, generate and send bulk data reports on 547,000 Bupa Global customers to his personal email account.

After investigating, the Information Commissioner's Office fined the insurance company £175,000 for systemic failures to protect personal data, which is a breach of data protection laws.

According to the ICO's report (PDF), because Bupa failed to routinely monitor the SWAN activity log it didn't notice a defect that resulted in certain reports being logged incorrectly or not at all.
Click to expand...

Report (PDF): https://ico.org.uk/media/action-weve-taken/mpns/2259871/bupa-mpn-20180928.pdf

ronjor · Oct 1, 2018

ronjor said: ↑

The FDA's New Digital Health Cyber Unit: What Would It Do?
Click to expand...

FDA Reveals Steps to Bolster Medical Device Cybersecurity

Marianne Kolbasuk McGee (HealthInfoSec) October 1, 2018
'Playbook' Prepared; Data Sharing Efforts Planned
Click to expand...

ronjor · Oct 2, 2018

Responding to Ransomware Attacks: Critical Elements

Marianne Kolbasuk McGee (HealthInfoSec) • October 2, 2018
Experts Provide Tips for Smoother Recoveries
Click to expand...

guest · Oct 3, 2018

Remote Access System Hacking Is No. 1 Patient Safety Risk
October 3, 2018
https://healthitsecurity.com/news/remote-access-system-hacking-is-no.-1-patient-safety-risk

Hackers attacking healthcare through remote access systems and disrupting operations is the number one patient safety risk, according to the ECRI Institute’s annual Top 10 Health Technology Hazards for 2019.

ECRI Institute said it published 50 cybersecurity-related alerts and problem reports in the last 18 months, a major increase over the prior period.

“The consequences of an attack can be widespread and severe, making this a priority concern for all healthcare organizations,” said ECRI Health Devices Program Executive Director David Jamison. “In critical situations, this could cause harm or death.”
Click to expand...

ronjor · Oct 4, 2018

BlackBerry's new blockchain tools could boost security for medical IoT

By Conner Forrest | October 4, 2018
Fresh off the announcement of its Spark platform, BlackBerry unveiled a host of tools aimed at improving data privacy in healthcare.
Click to expand...

Minimalist · Oct 5, 2018

Hackers fly under the radar for two years after infecting chiropractic clinic with malware

Chiropractors may not be regarded as full-blown medical doctors, but hackers don’t discriminate when targeting the health sector, as one chiropractor in Tillamook, Oregon will tell you.

A report published by local publication Tillamook County Pioneer reveals that on August 3rd, 2018, during an internal security audit, Tillamook Chiropractic Clinic learned its systems harbored carefully crafted malware for more than two years.
Click to expand...

https://hotforsecurity.bitdefender....g-chiropractic-clinic-with-malware-20430.html

guest · Oct 5, 2018

Siilo injects $5.1M to try to transplant WhatsApp use in hospitals
October 5, 2018
https://techcrunch.com/2018/10/05/siilo-injects-5-1m-to-try-to-transplant-whatsapp-use-in-hospitals/

Yet WhatsApp is not specifically designed with the safe sharing of highly sensitive medical information in mind. This is where Dutch startup Siilo has been carving a niche for itself for the past 2.5 years — via a free-at-the-point-of-use encrypted messaging app that’s intended for medical professions to securely collaborate on patient care, such as via in-app discussion groups and being able to securely store and share patient notes.

Messages sent via Siilo are also automatically deleted after 30 days unless the user specifies a particular message should be retained. And the app does not make automated back-ups of users’ conversations.

There’s also mandatory security for accessing the app — with a requirement for either a PIN-code, fingerprint or facial recognition biometric to be used. While a remote wipe functionality to nix any locally stored data is baked into Siilo in the event of a device being lost or stolen.

Like WhatsApp, Siilo also uses end-to-end encryption [...] It also specifies that user messaging data is stored encrypted on European ISO-27001 certified serversreview on request.
Click to expand...

guest · Oct 6, 2018

Why Healthcare Cyberattacks Should Be a Concern for Consumer Data Collectors
October 5, 2018
https://securityintelligence.com/wh...ld-be-a-concern-for-consumer-data-collectors/

As reported by Forbes, an electronic health record (EHR) could be worth hundreds, even thousands, of dollars on the black market. And unlike a credit card or financial record, a medical record is a living document that can be used by criminals over a person’s lifetime — there’s no closing down a health record.

“From a purely monetary perspective, medical records, depending upon their completeness, can fetch upwards of $1,000 per record,” according to RedLock’s Matt Chiodi.

Over the last decade, healthcare clinics and hospitals have widely adopted EHR systems to save on costs. However, while they’re more efficient than paper systems, digital records are also vulnerable to cyberattacks.

Companies that work in this space will see an increased level of scrutiny as more data breaches inevitably hit the sector in the coming months and years.
Click to expand...

Beyonder · Oct 6, 2018

I'ts astounding this keeps happening. Why are they gambling with peoples' lives?

guest · Oct 10, 2018

Rebound Orthopedics & Neurosurgery phishing attack results in data breach
October 10, 2018
https://www.scmagazine.com/home/new...rgery-phishing-attack-results-in-data-breach/

Rebound Orthopedics & Neurosurgery, which operates in the Vancouver and Portland. Ore. metro areas, has reported a data breach which may have affected 2,800 patients and employees.

On May 22, 2018, an unknown threat actor gained unauthorized access to an employee’s email account after it was compromised in a phishing email sent from the address of a contractor whose account had also been compromised, according to The Columbian.

Patients’ name, date of birth, Social Security number, driver’s license number, financial account information, and limited health information may have been compromised in the incident, the medical center’s forensics team leaned on Aug. 8.
Click to expand...

ronjor · Oct 11, 2018

Report: Remote Access Is No. 1 Healthcare Tech Hazard

Marianne Kolbasuk McGee (HealthInfoSec) • October 11, 2018
ECRI Institute Calls Attention to Cyber Risks for Second Consecutive Year
Click to expand...

guest · Oct 11, 2018

Mail mix up sends Michigan Medicine letters to the wrong people
October 11, 2018
https://www.scmagazine.com/home/new...ichigan-medicine-letters-to-the-wrong-people/

For the second time this year healthcare provider Michigan Medicine is notifying patients that some of their personally identifiable information may have been exposed, this time due to a mailing error.

Michigan Medicine, which is part of the University of Michigan, said in a statement that in September a third-party printing vendor sent 3,700 patients a fundraising campaign letter where the name and address on the envelope did not match the information contained in the letter.
This meant the recipient was able to see the name, contact information and in some cases email addresses of the letter’s intended recipient.

No Security Numbers, credit or debit card or bank account numbers were exposed and the letters contained no medical information.
Click to expand...

Minimalist · Oct 12, 2018

FDA warns users of cyber vulnerabilities in pacemaker programmers

The Food and Drug Administration has issued a cybersecurity advisory for two models of programming equipment that doctors use to check cardiac devices like pacemakers, citing a vulnerability that could allow unauthorized access to the programmers.
Click to expand...

https://www.cyberscoop.com/medtronic-programmers-fda-cybersecurity-advisory/

guest · Oct 15, 2018

WannaCry Cost NHS £92 Million
October 15, 2018
https://www.infosecurity-magazine.com/news/wannacry-cost-nhs-92-million/

The infamous WannaCry ransomware campaign of 2017 caused losses in the region of £92m for the NHS, the government has revealed.

In a progress update titled Securing cyber resilience in health and care, the Department of Health and Social Care caveated the figures by saying they are only broad estimates.

[...] A much larger £72m was lost in the aftermath with additional IT support drafted in to help restore data and systems.
“Assuming each of the 80 severely affected trusts would have required the equivalent of five days FTE additional resource of an IT specialist, the cost of IT support at the time of the attack would have been £0.5m,” the report explained.
Click to expand...

Report (PDF): https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/747464/securing-cyber-resilience-in-health-and-care-september-2018-update.pdf

ronjor · Oct 15, 2018

Aetna Hit With More Penalties for Two Breaches

Marianne Kolbasuk McGee (HealthInfoSec) October 15, 2018
Cases Involved Mailings That Potentially Exposed Sensitive Health Information
Click to expand...

guest · Oct 16, 2018

Insurer Anthem Will Pay Record $16M for Massive Data Breach
October 16, 2018
https://www.securityweek.com/insurer-anthem-will-pay-record-16m-massive-data-breach

The personal information of nearly 79 million people — including names, birthdates, Social Security numbers and medical IDs — was exposed in the cyberattack, discovered by the company in 2015.

The settlement between Anthem Inc. and the Department of Health and Human Services represents the largest amount collected by the agency in a health care data breach, officials said.

Roger Severino, director of the HHS Office for Civil Rights [...] said the Anthem settlement is nearly three times larger than the previous record amount paid to the government in a privacy case. That sends a message to the industry that "hackers are out there always and large health care entities in particular are targets," he added.

The company lacked an enterprisewide risk analysis, had insufficient procedures to monitor activity on its systems, failed to identify and respond to suspected or known security incidents, and did not implement "adequate minimum access controls" to shut down intrusions from as early as February 2014.
Click to expand...

Minimalist · Oct 17, 2018

Remote Code Implantation Flaw Found in Medtronic Cardiac Programmers

A flaw in Medtronic’s CareLink 2090 and CareLink Encore 29901 programmers, which are portable computer systems used to manage implanted cardiac devices in clinical settings, would have allowed remote code implantation over Medtronic’s dedicated Software Deployment Network (SDN).
Click to expand...

https://threatpost.com/remote-code-implantation-flaw-found-in-medtronic-cardiac-programmers/

guest · Oct 17, 2018

Philips will challenge tech giants to bring blockchain to healthcare
October 17, 2018
https://thenextweb.com/blockchain/2018/10/17/philips-solve-healthcare-data-breaches-with-blockchain/

Researchers at Philips are exploring the use of blockchain in establishing trust and accountability across medical research ecosystems. This will hopefully help prevent security incidents and lay the ground for improving innovation and cooperation in ways that weren’t possible before.
What is Philips doing?
Philips Research is working on an exciting project that Hennessy calls “verifiable data exchange.” “This is basically the ability for researchers in a network of hospitals and universities to request data that suit a need for research,” Hennessy says.

The process will revolve around three disciplines: anonymizing data, requesting data and fulfilling requests.

Blockchain will be the technology that supports the audit trail of data exchanges. Philips researchers believe that the transparent storage of data exchange between the involved parties will create a system of shared risk and responsibility.
Click to expand...

guest · Oct 18, 2018

Brace yourself, Britain: Health minister shares 'vision' for NHS 'tech revolution'
October 18, 2018
https://www.theregister.co.uk/2018/10/18/brit_health_minister_shares_vision_for_nhs_tech_revolution/

“The tech revolution is coming to the NHS,” he boldly claimed yesterday, as he outlined his “vision” to erect a modern tech architecture that will provide the basis for a new generation of digital services.

[...] all digital, data and tech services must use the Data Security and Protection Toolkit (DSPT) to show they are “practising good cyber security” in relation to the performance of the National Data Guardian's 10 data security standards.

This means no “unsupported” operating systems - and keeping kit up to date - unlike what happened with WannaCry and all those unpatched Windows 7 boxes. [...]
Click to expand...

guest · Oct 19, 2018

HealthCare.gov Portal Suffers Data Breach Exposing 75,000 Consumers
October 19, 2018
https://gizmodo.com/healthcare-gov-portal-suffers-data-breach-trump-offici-1829877392

Sensitive information belonging to roughly 75,000 individuals was exposed after a government healthcare sign-up system got hacked, the Centers for Medicare & Medicaid Services (CMS) said on Friday.

The agency said that “anomalous system activity” was detected last week in the Direct Enrollment system, which Americans use to enroll in healthcare plans via the insurance exchange established under the Affordable Care Act—also known as Obamacare.

The agency did not supply any additional details regarding the types of personal information exposed, though insurance applicants are typically asked to provide sensitive details, such as Social Security numbers.
Click to expand...

guest · Oct 23, 2018

mood said: ↑

Insurer Anthem Will Pay Record $16M for Massive Data Breach
October 16, 2018
https://www.securityweek.com/insurer-anthem-will-pay-record-16m-massive-data-breach
Click to expand...

Analysis: Did Anthem's Security 'Certification' Have Value?
Insurer Was Certified as HITRUST CSF Compliant Before Its Mega-Breach
October 23, 2018
https://www.inforisktoday.com/analysis-did-anthems-security-certification-have-value-a-11634

Now that the insurer has agreed to a record $16 million HIPAA settlement with federal regulators, who spelled out in detail the company's security shortcomings - including the lack of a risk assessment - it's worth scrutinizing the value of adopting a security framework.

While many security experts say compliance with frameworks, such as HITRUST's and others, has value in helping to demonstrate an organization's security maturity, they caution that such compliance is no assurance of immunity from a breach, much less verification that an organization has taken all the right security precautions.
No Guarantees
"The HITRUST certification is about a framework for compliance. Compliance is evidence driven: Policies, procedures, plans, forms, etc." says Tom Walsh, founder of consultancy tw-Security.

"I'm not aware of any hacker that has been thwarted by an organization that had a set of well-written policies. [...] Compliance and frameworks help organizations reduce their risks, but they cannot eliminate all of the threats."
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

Minimalist Registered Member

guest Guest

guest Guest

Beyonder Registered Member

guest Guest

ronjor Global Moderator

guest Guest

Minimalist Registered Member

guest Guest

ronjor Global Moderator

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

Minimalist Registered Member

guest Guest

guest Guest

Beyonder Registered Member

guest Guest

ronjor Global Moderator

guest Guest

Minimalist Registered Member

guest Guest

ronjor Global Moderator

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches