Why Healthcare Security Matters

ronjor · Dec 14, 2018

A Second State Hits EmblemHealth With Breach Fine

Marianne Kolbasuk McGee (HealthInfoSec) • December 14, 2018
Case Involves Social Security Numbers Exposed in Mailings
Click to expand...

guest · Dec 18, 2018

Healthcare Employees Aware of Ransomware Threats
December 18, 2018
https://www.infosecurity-magazine.com/news/healthcare-employees-aware-of/

In a new survey of North American healthcare employees, Kaspersky Lab found that ransomware has hit nearly a third of companies more than once.

Findings of the report, Cyber Pulse: The State of Cybersecurity in Healthcare, are based on the responses from the 1,758 employees surveyed. Participants ranged from doctors and surgeons to admins and IT staff within the United States and Canada. Of the total participants, 33% of healthcare employees who are aware of a ransomware attack to their organization said attacks have happened more than once.

More than one in six healthcare employees said that they know of a ransomware cybersecurity attack on their organization that has occurred in the past five years or more.
The last 12 months seem to have been slightly better, though, with only 27% of healthcare IT employees claiming that their employer experienced a ransomware cybersecurity attack within the past year.
Click to expand...

"Cyber Pulse: The State of Cybersecurity in Healthcare" (PDF): https://go.kaspersky.com/rs/802-IJN-240/images/Healthcare-Survey-Report.pdf

guest · Dec 18, 2018

Vermont, Dallas medical facilities suffer email account breaches
December 18, 2018
https://www.scmagazine.com/home/sec...cal-facilities-suffer-email-account-breaches/

In separate incidents, two U.S. health care facilities have publicly disclosed data breaches that resulted from the unauthorized access of an employee’s email.

Yesterday, the University of Vermont Health Network – Elizabethtown Community Hospital (ECH) acknowledged that an unauthorized individual remotely accessed an employee’s email account on Oct. 9. This account contained the personal information of roughly 32,000 patients, in some cases including Social Security numbers, names, dates of birth and addresses.
[...] ECH’s online public disclosure [...]

Meanwhile, the Dallas-Fort Worth location branch of the nationwide CCRM fertility clinic also recently posted a breach notification, as reported by DataBreaches.net.
CCRM said it sent out notification letters to potentially affected patients on Dec. 3, adding that it has “taken steps to prevent a similar event from occurring in the future.”
Click to expand...

ronjor · Dec 19, 2018

Data Leak Exposes Psychologists' Home Addresses

Jeremy Kirk December 19, 2018
A large health insurer in Western Australia inadvertently shared the home addresses of some psychologists to a web-based appointment booking service, the West Australian reported Wednesday.
Click to expand...

ronjor · Dec 20, 2018

Another State Announces a HIPAA Breach Settlement

Marianne Kolbasuk McGee (HealthInfoSec) December 20, 2018
In the latest HIPAA enforcement action taken by a state, Massachusetts Attorney General Maura Healey's office has signed a $75,000 consent judgement with McLean Hospital, a psychiatric facility, for a breach that affected 1,500 individuals.
Click to expand...

guest · Dec 22, 2018

hawki said: ↑

"LifeBridge data breach exposes personal information of 500,000 patients...

The attacker accessed the health system’s servers through one of its physician practices, LifeBridge Potomac Professionals. Information potentially taken included names, addresses, birth dates, insurance information and Social Security numbers found in the patient registration and billing system..."

http://www.baltimoresun.com/health/bs-hs-data-breach-lifebridge-20180522-story.html
Click to expand...

LifeBridge Health faces class-action lawsuit stemming from massive cyberbreach in 2016
December 21, 2018
https://www.healthcarefinancenews.c...ion-lawsuit-stemming-massive-cyberbreach-2016

Law firm Murphy, Falcon & Murphy has filed a statewide class action lawsuit against Baltimore provider LifeBridge Health on behalf of more than 530,000 consumers whose personal information including Social Security numbers, birth dates, names, addresses, health insurance information, client treatment information, and medical diagnoses were stolen.

LifeBridge should have implemented appropriate and adequate technological safeguards to prevent such a massive cyberbreach from occurring, and certainly should have notified its patients immediately after learning of the breach," Hassan Murphy, managing partner at Murphy, Falcon & Murphy said.
Click to expand...

ronjor · Dec 28, 2018

What's Ahead for Health Data Privacy, Security in 2019?

Consultant Rebecca Herold Offers Predictions for the Coming Year Rebecca Herold • December 28, 2018
This was an eventful year for healthcare cybersecurity and privacy incidents and developments. But what's ahead for 2019? Here are eight predictions.
Click to expand...

ronjor · Dec 31, 2018

My Health Record had 42 data breaches in 2017-18 but no 'malicious' attacks: ADHA

By Chris Duckett December 31, 2018
Highest category of breaches was due to attempted Medicare fraud, the Australian Digital Health Agency has said in its 2017-18 annual report.
Click to expand...

guest · Jan 2, 2019

HHS Releases Voluntary Cybersecurity Practices for Health Industry
January 2, 2019
https://www.nextgov.com/cybersecuri...ealth-industry/153835/?oref=ng-homepage-river

The Department of Health and Human Services on Friday released a publication containing voluntary cybersecurity practices to healthcare organizations ranging in size from local clinics to large hospital systems.

Titled “Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients,” the four-volume publication is the result of a two-year public-private partnership between HHS and healthcare industry professionals. According to a press statement from HHS, more than 150 cybersecurity and healthcare experts participated in the effort, which was mandated through the Cybersecurity Act of 2015.

“The healthcare industry is truly a varied digital ecosystem. We heard loud and clear through this process that providers need actionable and practical advice, tailored to their needs, to manage modern cyber threats,” said Erik Decker, industry co-lead and Chief Information Security and Privacy Officer for the University of Chicago Medicine.
Click to expand...

Minimalist · Jan 5, 2019

Despite Efforts, Healthcare Security Threats Continue to Rise

The healthcare security threat is rising due to a variety of factors, including unpatched systems and lack of dedicated funds.
Click to expand...

https://www.itprotoday.com/cloud-security/despite-efforts-healthcare-security-threats-continue-rise

Minimalist · Jan 7, 2019

Managed Healthcare Provider Humana Discloses Data Breach

Healthcare management provider Humana recently revealed that hackers accessed information of individuals who had applied for a Humana health insurance policy via Bankers Life.
Click to expand...

https://www.securityweek.com/managed-healthcare-provider-humana-discloses-data-breach

guest · Jan 8, 2019

Ransomware Attacks: The Data Integrity Issues
Healthcare Incident Points to Possible 'Altered' Patient Data
January 7, 2019
https://www.inforisktoday.com/ransomware-attacks-data-integrity-issues-a-11917

In a notification statement, the Podiatric Offices of Bobby Yee, which has locations in Monterey and Salinas, reports that on Oct. 29, 2018, the practice was "the victim of a ransomware attack which resulted in the unauthorized alteration and potential corruption of their medical files, including patient personal information."

Attacks potentially impacting the integrity of patient data is "is the next 'big risk' issue," predicts former healthcare CIO David Finn, executive vice president at security consulting firm CynergisTek.
Changed But Not Viewed?
Can data be altered or corrupted in ransomware and other cyberattacks without being viewed or exfiltrated, as the podiatry practice of Dr. Bobby Yee says happened at its organization?

"Yes, absolutely," says former healthcare CISO Mark Johnson, a shareholder at consultancy LBMC Information Security. In theory, there are attacks with the capabilities to do this, he notes. "If you have enough access to encrypt the data, then you have enough access to change the data," he adds.
Click to expand...

ronjor · Jan 8, 2019

Top 5 things to know about IoT in medicine

By Tom Merritt in Internet of Things on January 8, 2019, 12:23 PM PST
The Internet of Things has uses in many different industries; Tom Merritt explains five ways it's being used in the medical field.
Click to expand...

guest · Jan 10, 2019

Public Report of the Committee of Inquiry (COI) into the cyber attack on Singapore Health Services Private Limited Patient Database
January 10, 2019
https://www.mci.gov.sg/pressroom/news-and-stories/pressroom/2019/1/public-report-of-the-coi

The Committee of Inquiry (COI)1, convened to inquire into the events and contributing factors leading to the cyber attack on Singapore Health Services Private Limited (SingHealth)’s patient database system, has released its public report.
The report is accessible here.
Click to expand...

Public report (PDF): https://www.mci.gov.sg/~/media/mcicorp/doc/report%20of%20the%20coi%20into%20the%20cyber%20attack%20on%20singhealth%2010%20jan%202019.pdf?la=en

"While some measures may seem axiomatic, the cyberattack has shown that these were not implemented effectively by IHIS at the time of the attack. For IHiS, SingHealth, and other organisations responsible for large databases of personal data, getting the fundamentals right is a necessary and vital step in building cybersecurity competencies and the ability to counter the real, present, and constantly evolving cybersecurity threats."

"[...] We must recognise that cybersecurity threats are here to stay, and will increase in sophistication, intensity, and scale. Collectively, these organisations must do their part in protecting Singapore's cyberspace, and must be resolute in implementing these recommendations."
Click to expand...

guest · Jan 10, 2019

First GDPR fine in Portugal issued against hospital for three violations
January 3, 2019
https://iapp.org/news/a/first-gdpr-fine-in-portugal-issued-against-hospital-for-three-violations/

Centro Hospitalar Barreiro Montijo has been fined 400,000 euros for violating the General Data Protection Regulation.

The country's supervisory authority, Comissão Nacional de Protecção de Dados, found that there were three violations of the GDPR. First was a violation of Article 5(1)(c), a minimization principle [...]
The second, a violation of integrity and confidentiality as a result of non-application of technical and organizational measures to prevent unlawful access to personal data [...]
[...] the incapacity of the defendant to ensure the continued confidentiality, integrity, availability and resilience of treatment systems and services [...]
Click to expand...

guest · Jan 10, 2019

mood said: ↑

First GDPR fine in Portugal issued against hospital for three violations
January 3, 2019
https://iapp.org/news/a/first-gdpr-fine-in-portugal-issued-against-hospital-for-three-violations/
Click to expand...

Is GDPR Compliance Tougher Than HIPAA Compliance?
Analysts: GDPR Case in Portugal Offers Lessons for U.S. Healthcare Entities
January 9, 2019
https://www.inforisktoday.com/gdpr-compliance-tougher-than-hipaa-compliance-a-11922

That enforcement action - which was reportedly levied last July but only recently made public - apparently was Portugal's first since GDPR's compliance deadline on May 25, 2018.

"But it also shows that GDPR enforcers may expect more stringent privacy and security controls than are typically practiced under HIPAA."
"Merely being HIPAA compliant may not serve as a competent defense in a GDPR proceeding; the opposite may not be true."
Click to expand...

Minimalist · Jan 11, 2019

APT heist of Singapore health data exploited Microsoft Outlook, inquiry finds

An advanced hacking operation that last year stole personal data on 1.5 million health care patients in Singapore, including the prime minister, targeted an unpatched version of Microsoft Outlook, an official inquiry has found.
Click to expand...

https://www.cyberscoop.com/apt-heis...ta-exploited-microsoft-outlook-inquiry-finds/

Minimalist · Jan 11, 2019

Third-Party Breach Exposed 31K Patient Records

The healthcare sector continues to be the target of cyberattacks, with Managed Health Services (MHS) of Indiana Health Plan announcing recently that a third-party data breach potentially exposed up to 31,000 patients' personal data in one of two security incidents the company has disclosed in the past month.
Click to expand...

https://www.infosecurity-magazine.com/news/third-party-breach-exposed-31k/

Minimalist · Jan 13, 2019

The theft of 1.5 million patient records, including those of Singapore's Prime Minister, from the city state's SingHealth hospital group by hackers could probably have been stopped had the IT department not been so useless, an inquiry has found.
Click to expand...

https://www.theregister.co.uk/2019/01/11/singapore_health_hack/

Minimalist · Jan 14, 2019

What You Need to Know About Secure Mobile Messaging in Healthcare

With the majority of people using smartphones these days, texting is all but a given when trying to communicate with your friends or family. But what about your doctor?

A recent study determined that 96 percent of physicians use text messaging for coordinating patient care. This can raise eyebrows and red flags.

Anyone with a cheap scanner, which can be obtained easily from the likes of Amazon, can potentially access these texts and the sensitive information therein. If a stranger knowing your vacation plans isn’t concerning enough, imagine them having access to your health records.
Click to expand...

https://www.tripwire.com/state-of-security/healthcare/secure-mobile-messaging-healthcare/

Minimalist · Jan 14, 2019

Employees sacked, CEO fined in SingHealth security breach

Two employees have been sacked and five senior management executives, including the CEO, fined for their role in Singapore's most serious security breach, which compromised personal data of 1.5 million SingHealth patients. Further enhancements also will be made to beef up the organisation's cyber defence, in line with recommendations dished out by the committee that reviewed the events leading up to the breach, according to Integrated Health Information Systems (IHIS).
Click to expand...

https://www.zdnet.com/article/employees-sacked-ceo-fined-in-singhealth-security-breach/

Minimalist · Jan 14, 2019

Arm yourselves for healthcare’s cybersecurity war

The US healthcare industry is a gold mine for industrial hackers. Commandeering hospital systems has become stable and profitable work for those willing to execute these attacks. Despite years of embarrassing data breaches, the industry has yet to respond and remains unprepared for the threat at hand.
Click to expand...

https://www.zdnet.com/article/arm-yourselves-for-healthcares-cybersecurity-war/

ronjor · Jan 14, 2019

New hospital price lists are massive spreadsheets full of gibberish

Beth Mole - 1/14/2019, 2:30 PM
From unintelligible abbreviations and jargon to $32,456.66 "headaches."
Click to expand...

ronjor · Jan 16, 2019

Singapore Imposes $740,000 Fines Over Major Cyber Attack

By AFP on January 17, 2019
Singapore's privacy watchdog Tuesday imposed fines of Sg$1 million ($740,000) on a healthcare provider and an IT agency over a cyber-attack that saw health records of about quarter of the population stolen.
Click to expand...

ronjor · Jan 17, 2019

Why Do Phishing Attacks Continue to Plague Healthcare?

Marianne Kolbasuk McGee (HealthInfoSec) January 17, 2019
Experts Offer Tips for How to Avoid Falling Victim
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

Why Healthcare Security Matters

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches