Why Healthcare Security Matters

guest · Mar 11, 2019

Thousands of Arizonans hit in Medicaid agency’s data breach
March 11, 2019
http://ktar.com/story/2477709/thousands-of-arizonans-hit-in-medicaid-agencys-data-breach/

Thousands of Arizonans were affected by a data breach earlier this year that targeted the state’s Medicaid agency, it was announced Monday.

The breach of the Arizona Health Care Cost Containment System affected more than 3,100 individuals when their IRS 1095-B forms were delivered to the wrong addresses.
The forms do not contain social security numbers, but do have names and dates of birth.
Click to expand...

ronjor · Mar 12, 2019

Federal judge enters consent decree against Texas compounder, Guardian Pharmacy Services

March 12, 2019
A federal court ordered a Texas-based company to stop producing compounded drug products intended to be sterile until the company complies with the Federal Food, Drug, and Cosmetic Act (FD&C Act) and other requirements. According to the complaint, despite previous warnings from the FDA, Guardian Pharmacy Services continued to violate the law, putting patients at risk.
Click to expand...

guest · Mar 13, 2019

How susceptible are hospital employees to phishing attacks?
March 13, 2019
https://www.helpnetsecurity.com/2019/03/13/hospital-phishing-attacks/

Cybersecurity threats are a rising problem in society, especially for healthcare organizations. Successful attacks can jeopardize not only patient data but also patient care, leading to cancellations and disruptions in the critical services that hospitals provide.

Brigham investigators aggregated data from six anonymized U.S. healthcare institutions representing a broad spectrum of care and geography. In total, they analyzed click rates for more than 2.9 million simulated emails.
The team reports that 422,052 of these emails were clicked (14.2 percent) — roughly one in every seven. However, the odds of clicking on a phishing email decreased with increasing campaigns.

“The rates that we report here are consistent with findings across other industries, where click rates can range from 13 to 49 percent, depending on the industry, but we know that in healthcare the stakes are high. Patient data, patient care, patient trust and financial stability may be on the line,” said Gordon.
Click to expand...

ronjor · Mar 13, 2019

Your body has internet—and now it can't be hacked

by Kayla Wiles, Purdue University March 12, 2019
The human body carries electrical signals well. Now these signals can be contained within close proximity of the body, thanks to new technology developed by Purdue University engineers.
Someone could hack into your pacemaker or insulin pump and potentially kill you, just by intercepting and analyzing wireless signals. This hasn't happened in real life yet, but researchers have been demonstrating for at least a decade that it's possible.
Click to expand...

guest · Mar 13, 2019

Clinic hit by ransomware recovers in hours thanks to solid incident response plan
March 13, 2019
https://hotforsecurity.bitdefender....ks-to-solid-incident-response-plan-20957.html

Maffi Clinics, a chain of plastic surgery clinics in the United States, is notifying patients about a ransomware incident that briefly affected its systems. Unlike most cases involving ransomware, though, this one didn’t leave a scar, illustrating the power of strong security protocols.

According to the breach notice, Maffi encountered “unusual activity” on one of its servers in September last year. The chain immediately instated its incident response plan and shut down its systems to eliminate the chance of any malware spreading through its systems. As it turned out, the administrators’ hunch was correct: the clinic had just received a dose of ransomware.

Within about five hours, the incident was contained and all data was restored. In other words, the clinic denied the attackers the ransom and escaped unscathed. The clinic nonetheless emailed all patients whose information was subjected to the attack out of an abundance of caution.
The same notice reveals that Maffi has since implemented and continually evaluated additional safeguards to prevent a similar incident in the future.
Click to expand...

Breach notice (PDF): https://mafficlinics.com/wp-content/uploads/2019/03/maffi_hipaa-breach-document.pdf

guest · Mar 13, 2019

Cyberattack on EMS compromised 40K patient records
February 28, 2019
http://www.dailyadvance.com/News/2019/02/28/Cyberattack-on-EMS-compromised-40K-patient-records.html

December’s cyberattack against Pasquotank-Camden Emergency Medical Services compromised more than 40,000 patient records, Pasquotank County Manager Sparty Hammett said Wednesday.

The hack originated outside the United States, Hammett said, but he declined to specify where.
Hammett said the hacker exploited a vulnerability in the county’s billing software, provided by the company TriTech, and tricked it into considering the hacker a normal user.

[...] TriTech was not aware of the vulnerability, and has closed it. Hammett also said the county continues reviewing all its software for vulnerabilities, and the Soundside Group has tested its cyber-defenses following the attack.
Click to expand...

ronjor · Mar 14, 2019

Somewhat off topic but health related.

Walmart is so desperate to fix health care, it flies employees to top hospitals in other states for treatment

Christina Farr | @chrissyfarr 14 Mar 2019
Walmart shared a case-study this week on its efforts to improve health care for its employees.
It described how a patient got an all expenses paid trip to Geisinger Medical Center in Pennsylvania with his wife to get a second opinion on whether he needed spine surgery.
The employee, in fact, had Parkinson's Disease. That saved Walmart $30,000 by averting the procedure.
Click to expand...

ronjor · Mar 14, 2019

What to do if your identity was stolen in mass identity breach

by Kristen Jordan Shamus March 14, 2019
News recently that a malware attack at Detroit-based Wolverine Solutions Group, which handles mailing and other services for hundreds of health care companies, potentially exposed the personal information of hundreds of thousands of medical care patients, has many Michiganders concerned about whether their identities are at risk.
Click to expand...

guest · Mar 14, 2019

Proposed Rule Would Force Health Care Providers to Share Records Electronically
March 14, 2019
https://www.nextgov.com/it-moderniz...roviders-share-records-electronically/155580/

A new rule proposed by the Trump administration could put the health care records of millions of Americans in their own pockets and onto their smartphones—whenever they want, free of charge.
Health care providers and others that don’t play ball or engage in “information blocking” by not being interoperable with other providers or exchanges would face fines of up to $1 million under the rule.

While the rule dictates health records data must be shared in secure format between providers and patients, Rucker said users in the not-too-distant future may have to be cautious about what applications they decide to give access to their personal healthcare data.
“The reality is these smartphones are very powerful, all kinds of things are going to happen here,” Rucker said.
Click to expand...

guest · Mar 14, 2019

Pen Testing of HHS Units Reveals Weaknesses
OIG Report Highlights a Range of Security Concerns
March 14, 2019
https://www.inforisktoday.com/pen-testing-hhs-units-reveals-weaknesses-a-12171

In a summary report issued Wednesday, the HHS Office of Inspector General highlighted several security controls that need improvement across eight HHS operating divisions. The weaknesses included configuration management, access control, data input controls and software patching, the report notes. Similar concerns have been raised in previous OIG reports.

"Based on the findings of this audit, we have initiated a new series of audits looking for indicators of compromise on HHS and operating division systems to determine whether an active threat exists on HHS networks or whether there has been a past breach by threat actors," OIG says.

The OIG's latest findings also are in line with the types of issues common at many healthcare organizations.
Click to expand...

guest · Mar 15, 2019

Personal information of over 800,000 blood donors was accessible online for 2 months: HSA
March 15, 2019
https://www.straitstimes.com/singap...f-over-800000-blood-donors-exposed-online-hsa

The personal information of more than 800,000 people who have donated or registered to donate blood in Singapore since 1986 was improperly put online by a Health Sciences Authority (HSA) vendor for more than two months, but access to the database was cut off soon after the discovery.

It immediately took steps to verify that no sensitive medical or contact information was contained in the database.
Dr Choong also reassured donors that HSA's centralised blood bank system, which is separated from the Internet and secured, is not affected.

"We have engaged external cyber security professionals, KPMG in Singapore, and initiated a thorough review of our IT systems. We are working closely with HSA and other authorities in continuing investigations," he added.
Click to expand...

guest · Mar 15, 2019

Mental Healthcare Providers Respond to Ransomware Attacks
March 15, 2019
https://www.inforisktoday.com/mental-healthcare-providers-respond-to-ransomware-attacks-a-12187

In the two recent ransomware incidents, one of the targets - Delaware Guidance Services for Children and Youth - paid a ransom to unlock its patient records, and the other - Green Ridge Behavioral Health in Maryland - recovered without paying the extortionists.
Difficult Situations
Privacy attorney Iliana Peters of the law firm Polsinelli says recovery from ransomware attacks can prove difficult, especially if organizations do not have sufficient data backup policies and procedures.

Peters says it's "absolutely critical" that U.S. organizations have robust backup methods for their information, as is required by the HIPAA Security Rule.
Higher Expectations?
Mental healthcare providers also are often subject to privacy regulations that are more stringent than HIPAA, says Kate Borten, president of privacy and security consulting firm The Marblehead Group.
Click to expand...

guest · Mar 15, 2019

Spectrum Healthcare Latest to Issue Breach Notice
March 15, 2019
https://www.infosecurity-magazine.com/news/spectrum-healthcare-latest-to-1/

The data breach at Wolverine Solutions Group (WSG) continues to plague the healthcare industry, with more organizations, including Spectrum Healthcare, sending security notices to customers.
As was the case for many organizations who have already issued security notices, Spectrum said it has no reason to believe its systems or customer information may have been compromised.

“WSG’s expert could not find evidence that Spectrum Health Lakeland patient information was removed from its system as a result of the attack. However, WSG also told us that they cannot be 100 percent sure that patient information was not affected. [...]" Spectrum wrote in a letter to thousands of its customers.

“The healthcare industry must realize that risk never sleeps and change the frequency and processes for how third-party vendors are assessed, managed and remediated from once a year to real time and continuous,” said Ed Gaudet, CEO, Censinet.
Click to expand...

ronjor · Mar 16, 2019

Singapore public sector reports yet another security lapse

By Eileen Yu March 16, 2019
Following a spat of data breaches affecting healthcare patients in Singapore, this time, a server containing personal information of 808,201 blood donors was not properly secured by a third-party vendor, potentially exposing data such as blood type and national identification number.
Click to expand...

ronjor · Mar 16, 2019

Med-tech trade group launches online cybersecurity tool

March 15, 2019 by Joe Carlson
The Food and Drug Administration requires medical device companies to plan for cybersecurity at the earliest stages of design, and to monitor for new vulnerabilities long after devices have been shipped to customers. But industry insiders say companies are uneven in their abilities and willingness to address the issue and talk about it openly, which can hinder progress.
Now the Washington-based medical technology trade group AdvaMed is creating a new communication tool for med-tech companies known as an "information sharing and analysis organization," or ISAO (pronounced "I-sow") that will allow technical-minded med-tech experts to trade tips and analysis of ongoing problems.
Click to expand...

ronjor · Mar 17, 2019

A huge trove of medical records and prescriptions found exposed

Zack Whittaker@zackwhittaker 17 Mar 2019
A health tech company was leaking thousands of doctor’s notes, medical records, and prescriptions daily after a security lapse left a server without a password.
Click to expand...

guest · Mar 18, 2019

Cybersecurity: Don’t let the small stuff cause you big problems
March 18, 2019
https://www.zdnet.com/article/cyber-security-dont-let-the-small-stuff-cause-you-big-problems/

Healthcare providers risk 'death by a thousand cuts' if they take a poor approach to implementing cyber security and protecting networks and patient data.

"Those organisations which are successful in their transformation journey are those which make cybersecurity and data protection an obligation from the board to the bedside," said Daniel Jeffery, head of innovation and delivery at NHS Digital [...]
The key is to realise the opportunities from the digital revolution from a health and care perspective, but also making sure security is built in from the beginning Jeffery said.

Organisations of all sizes in all sectors need to have a cybersecurity strategy, but for healthcare, it's particularly important.
"What's really important is having control over the data and knowing where it is. It's the same issue that's dealt with in many other industries, but to an extra level of duty of care for the people whose data you've got," said Sian John, chief security advisor for EMEA at Microsoft.
Click to expand...

ronjor · Mar 19, 2019

Death By 1,000 Clicks: Where Electronic Health Records Went Wrong

By Fred Schulte and Erika Fry, Fortune March 18, 2019
The U.S. government claimed that turning American medical charts into electronic records would make health care better, safer, and cheaper. Ten years and $36 billion later, the system is an unholy mess. Inside a digital revolution that took a bad turn.
Click to expand...

guest · Mar 19, 2019

Woman Sues Northwestern Medicine After Her Medical Information Was Posted On Twitter
March 18, 2019
https://chicago.cbslocal.com/2019/0...e-medical-information-twitter-privacy-breach/

A woman at the center of a lawsuit said Northwestern Medicine Regional Medical Group did not inform her of a privacy breach of her medical records until she called after seeing the records posted on social media.
Gina Graziano called it a breach of trust, and said Northwestern should have better policies in place.

The suit alleges Wagner, a hospital employee, used her credentials to log in and access Graziano’s medical records, charts and files. Then, Wirth posted about procedures and treatments Graziano received at Northwestern Medicine Kishwaukee Hospital on social media.
In a letter from Northwestern Medicine to Graziano, the hospital acknowledges after “a thorough investigation” there was “inappropriate access” to her medical record by an employee on March 5 and 6 of last year.

“It’s a complete invasion of my client’s privacy,” said attorney Ted Diamantopoulos. “When a patient goes to a hospital, they expect to have their medical records private.”
Click to expand...

guest · Mar 19, 2019

NJ Based Home Health Radiology Services Leaked Nearly 40k Case Files
March 19, 2019
https://securitydiscovery.com/nj-based-home-health-radiology-services-leaked-nearly-40k-case-files/

On March 1st I discovered a non-password protected database that contained what appeared to be medical case files. I immediately notified the organization that we suspected was responsible based on information found inside the database.

This discovery contained the records of an estimated 37,000 people who’s data has been potentially compromised in an alleged data breach involving New Jersey based Home Health Radiology Services LLC. These records contained names, date of birth, phone numbers, addresses, diagnoses, notes, and we even saw Social Security Numbers (SSN).

Any Patient information that is transmitted or stored by electronic media or maintained on electronic media must be encrypted and unfortunately in this case it was in plain text. When it comes to HIPAA compliance organizations must include prevention, detection and response with their data protection practices.
Despite several attempts and a request for comment regarding this data incident, Home Health Radiology Services LLC has not responded or commented at the time of this publication.
Click to expand...

guest · Mar 20, 2019

Electronic data breach sees medical cannabis users' personal information compromised
March 18, 2019
https://calgaryherald.com/cannabis/...nnabis-users-personal-information-compromised

Natural Health Services Ltd., which operates Canada’s largest referral network of medical cannabis patients, informed clients last week that their personal health records had been accessed without authorization between Dec. 4, 2018, and Jan. 7, 2019. The breach could include data ranging from basic personal information to medical diagnoses, referrals, encounter notes and allergies.
The breach could include data ranging from basic personal information to medical diagnoses, referrals, encounter notes and allergies.

The company, which operates clinics in seven Canadian cities from Calgary to Windsor, said it has initiated its own privacy investigation while filing breach reports with privacy commissioners in Alberta, Saskatchewan, Manitoba and Ontario. Police have also been notified.
Click to expand...

guest · Mar 20, 2019

ronjor said: ↑

Singapore fingers deported fraudster for leak of list of thousands of HIV+ people
Click to expand...

HIV data leak: Mikhy Farrera Brochez pleads not guilty in US court
March 20, 2019
https://www.channelnewsasia.com/new...rera-brochez-pleads-not-guilty-in-us-11361180

Mikhy Farrera Brochez on Tuesday (Mar 19) pleaded not guilty in a US federal court in Kentucky to charges related to stolen identification documents from Singapore's HIV registry, according to his lawyer Jay Oakley.
He remains jailed at the Fayette County detention centre, and his three-day trial on federal charges has been set for May 7, said Oakley.

The 34-year-old, who previously worked in Singapore as a lecturer, is accused of sharing the HIV-positive status and personal information of 14,200 people from Singapore's HIV registry.
He was deported from Singapore in April last year, after serving a jail term for lying about his HIV status to gain an employment pass.
Click to expand...

ronjor · Mar 20, 2019

Patients mostly accept EHRs but privacy worries remain

Author Meg Bryant March 19, 2019
Despite acceptance of EHRs (Electronic Health Records) and the belief they improve or maintain quality of care, patients continue to have privacy concerns, a new Kaiser Family Foundation study shows.
Click to expand...

ronjor · Mar 20, 2019

Groups Ask FDA to Rethink Some Medical Device Cyber Proposals

Marianne Kolbasuk McGee (HealthInfoSec) March 20, 2019
Agency Receives Critique on Draft of Premarket Medical Device Cyber Guidance Update
Click to expand...

guest · Mar 21, 2019

UCLA Health Data Breach Class Action Settlement
March 19, 2019
https://topclassactions.com/lawsuit...a-health-data-breach-class-action-settlement/

A $7.5 million class action settlement has been reached, resolving claims that a July 2015 data breach exposed personal information stored by the UCLA Health Network.

The UCLA Health class action settlement provides $2 million to pay for unreimbursed loss claims and preventative measure claims. In addition, UCLA Heath has agreed to set up a cybersecurity enhancement fund of $5.5 million.
Lead plaintiffs accused the institution of failing to adequately protect information it obtained from patients, allowing hackers to access sensitive and personal information.

According to the class action lawsuit, the UCLA Health Network was subject to a cyber-intrusion incident possibly affecting up to 4.5 million current and former patients.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

Useful Searches