Why Healthcare Security Matters

guest · Mar 21, 2019

ZOLL Reports Recent Data Security Incident
March 18, 2019
https://www.prnewswire.com/news-releases/zoll-reports-recent-data-security-incident-300814181.html

On January 24, 2019, ZOLL learned of a data security incident that impacted the personal and medical information of some patients. As a precaution, ZOLL is providing this notice to make potentially affected patients aware of the incident and provide information on actions ZOLL has taken in response, resources available to impacted patients, and steps they can take to protect themselves.

During a server migration, some data from ZOLL emails was exposed. The vendor believes that the incident occurred between November 8, 2018 and December 28, 2018. At this point, ZOLL is not aware of any fraud or identity theft to any individual as a result of this exposure. The vendor has since confirmed that all information has now been secured.

ZOLL takes the privacy and security of patient information very seriously.
Further, ZOLL is taking steps to review its process for managing third party vendors and confirmed that the impacted vendor has also taken actions to help prevent against similar incidents in the future.
Click to expand...

ronjor · Mar 21, 2019

Health apps pose 'unprecedented' privacy risks

BBC 21 Mar 2019
Using popular health apps could mean private information about medical conditions is not kept confidential, researchers warn.
Of 24 health apps in the BMJ study, 19 shared user data with companies, including Facebook, Google and Amazon.
Click to expand...

ronjor · Mar 21, 2019

What the Transition to Smart Cards Can Teach the US Healthcare Industry

Joram Borenstein & Rebecca Weintraub 3/21/2019
Healthcare information security suffers from the inherent weakness of using passwords to guard information. Chip-based smart cards could change that.
Click to expand...

guest · Mar 21, 2019

Critical flaw lets hackers control lifesaving devices implanted inside patients
Implanted devices from Medtronic can have their firmware rewritten, DHS warns
March 21, 2019
https://arstechnica.com/information...lifesaving-devices-implanted-inside-patients/

Defibrillators are small, surgically implanted devices that deliver electrical shocks to treat potentially fatal irregular heart rhythms. In recent decades, doctors have increasingly used radios to monitor and adjust the devices once they're implanted rather than using older, costlier, and more invasive means.
No encryption, no authentication, and a raft of other flaws
That makes it possible for attackers within radio range to eavesdrop on the communications. Even worse, the protocol has no means of authentication for legitimate devices to prove they are authorized to take control of the implanted devices.
The researchers privately notified Medtronic of the critical vulnerability in January 2018.
Click to expand...

ronjor · Mar 22, 2019

Thursday, March 21, 2019

MedStar Health to Pay U.S. $35 Million to Resolve Allegations that it Paid Kickbacks to a Cardiology Group in Exchange for Referrals

MedStar Health Inc. (MedStar) in Columbia, Maryland., MedStar Union Memorial Hospital, and MedStar Franklin Square Medical Center, both in Baltimore, have agreed to pay the United States $35 million to settle allegations under the False Claims Act that it paid kickbacks to MidAtlantic Cardiovascular Associates (MACVA), a cardiology group based in Pikesville, Maryland, in exchange for referrals, through a series of professional services contracts at Union Memorial and Franklin Square Hospitals in Baltimore.
Click to expand...

ronjor · Mar 22, 2019

What you don’t know about your health data will make you sick

By Jeanette Beebe 03.22.19
Every time you shuffle through a line at the pharmacy, every time you try to get comfortable in those awkward doctor’s office chairs, every time you scroll through the web while you’re put on hold with a question about your medical bill, take a second to think about the person ahead of you and behind you.
Chances are, at least one of you is being monitored by a third party like data analytics giant Optum, which is owned by UnitedHealth Group, Inc. Since 1993, it’s captured medical data—lab results, diagnoses, prescriptions, and more—from 150 million Americans. That’s almost half of the U.S. population.
Click to expand...

ronjor · Mar 22, 2019

Warnings of a Dark Side to A.I. in Health Care

By Cade Metz and Craig S. Smith March 21, 2019
In a paper published on Thursday in the journal Science, the researchers raise the prospect of “adversarial attacks” — manipulations that can change the behavior of A.I. systems using tiny pieces of digital data. By changing a few pixels on a lung scan, for instance, someone could fool an A.I. system into seeing an illness that is not really there, or not seeing one that is.
Click to expand...

guest · Mar 22, 2019

Navicent Health announces cyber attack targeting its email system
March 22, 2019
https://www.macon.com/news/local/crime/article228281814.html

Navicent Health, one of Middle Georgia’s largest employers and healthcare providers, announced Friday morning it was the victim of a cyber attack that targeted its email system last July.

The announcement comes two months after the hospital system determined that names, social security numbers, dates of birth and medical information such as billing and appointment scheduling were among personal information that could have been compromised as a result of the hack, Navicent Health said in a statement on its website.
There is no evidence that the cyber attack affected the hospital system’s computer networks or its electronic medical record systems, according to the release.

The hospital system is evaluating its platforms for educating staff on cyber security and “reviewing technical controls” to help prevent future hacks, according to Navicent’s online statement: https://www.navicenthealth.org/notice-of-data-security-incident.html .
Click to expand...

ronjor · Mar 25, 2019

United States Files Lawsuit Against West Virginia Hospital, Its Management Company, and Its CEO Based on Kickbacks and Other Improper Payments to Physicians

Monday, March 25, 2019
The United States filed a complaint under the False Claims Act against Wheeling Hospital Inc., R & V Associates Ltd. (R & V), and Ronald Violi in the U.S. District Court for the Western District of Pennsylvania, the Department of Justice announced today. The government alleges that Wheeling Hospital, which is located in Wheeling, West Virginia, violated the Stark Law and Anti-Kickback Statute, and that those violations were caused by R & V, Wheeling’s contracted management consultant, and Violi, Wheeling’s CEO.
Click to expand...

ronjor · Mar 26, 2019

Tuesday, March 26, 2019
Mississippi Man Pleads Guilty to Health Care Fraud, Money Laundering and Tax Evasion Charges for Role in $200 Million Compounding Pharmacy Scheme

A Hattiesburg, Mississippi man pleaded guilty today for his role in a $200 million compounding pharmacy scheme to defraud health care benefit programs, including TRICARE, which is the program that covers U.S. military service members and their families.
Click to expand...

guest · Mar 26, 2019

mood said: ↑

UConn Health: 326,000 could be impacted by recent email breach
February 22, 2019
http://www.hartfordbusiness.com/article/20190222/NEWS01/190229955/1002
Click to expand...

Class Action Lawsuit Filed Over UConn Health Phishing Attack
March 26, 2019
https://www.hipaajournal.com/class-action-lawsuit-filed-over-uconn-health-phishing-attack/

A class action lawsuit has been proposed which seeks to recover damages for patients whose protected health information (PHI) was exposed in the UConn Health phishing attack that was discovered on December 24, 2018.
The lawsuit has been filed against the University of Connecticut and UConn Health and seeks damages, equitable, declaratory, and injunctive relief to prevent a recurrence of a data breach. A jury trial is being sought.

For four months the attackers had access to the accounts and could have viewed and stolen patient information. “UConn failed to recognize its systems had been breached and that intruders were stealing data on hundreds of thousands of current and former patients. Timely action by UCONN would likely have significantly reduced the consequences of the breach,” states the lawsuit.
Click to expand...

guest · Mar 26, 2019

Butler County employee suspended after emailing spreadsheet with personal information
March 26, 2019
https://www.daytondailynews.com/new...-personal-information/O0GOwcyzYkuB7qyzxEg7SJ/

The Butler County commissioners approved a two-day, unpaid suspension for an employee who inadvertently sent out an email with wellness information regarding the county’s health insurance, which might have violated HIPAA laws.

“It was just an error, but nonetheless information was distributed that should not have been, to parties that should not have received it,” Boyko said. “Nothing malicious or anything like that happened, but there need to be controls in place and systems in place that this information is not inadvertently nor maliciously distributed. The commissioners’ position was they needed to take some action.”
Boyko said the human resources department is working to make sure it has the systems in place to ensure this doesn’t happen again.
Click to expand...

ronjor · Mar 26, 2019

Demanding privacy, and establishing trust, in digital health

Sean Duffy 26 Mar 2019
But the dangers in digital health aren’t limited to rogue SDKs; three days after the Facebook news broke, yet another large health system announced the personal information of more than 325,00 patients had been exposed. All this comes as big tech companies like Apple, IBM and Amazon begin to enter the same space, with plans for huge impact. But even these well-established names enter healthcare with a trust deficit; Rock Health’s 2018 National Consumer Health Survey found that just 11 percent of respondents said they’d be willing to share health data with tech companies.
Click to expand...

guest · Mar 27, 2019

Who Owns Your Health Data?
March 27, 2019
https://onezero.medium.com/whose-health-data-is-it-anyway-c06234e8f870

Cybersecurity researchers recognize the potential for hackers to cause harm to patients through their devices. Although to date there have been no documented cases of hackers hijacking personal medical devices, it is possible.
While some users can put themselves at risk of outside attacks, all users are still at risk because the data from their devices isn’t fully secured.

Currently, there is no omnibus privacy legislation in the United States to prevent third parties like insurance companies, employers, and credit card companies from discriminating against people whose data they gain access to.
Even if some people can make it work, revealing our health information through our devices has continuing consequences for us in this industry built on exploiting our data.
Click to expand...

ronjor · Mar 27, 2019

Most mental health apps lack any scientific backing

By Rina Raphael 03.26.19
Apps and AI-enabled digital tools were hailed as the long-sought solution to the mental health crisis, but how do they actually measure up?
A new study published in Nature Digital Medicine argues that modern tech alternatives might be overplaying their efficacy to consumers. In fact, most apps don’t have any scientific evidence or peer-reviewed studies to back up their promises.
Click to expand...

guest · Mar 28, 2019

Sunniva reports filing of class action lawsuit regarding privacy breach
March 28, 2019
https://www.cisomag.com/sunniva-reports-filing-of-class-action-lawsuit-regarding-privacy-breach/

Sunniva Inc. recently reported that it has been named in a class action lawsuit, along with its wholly owned subsidiary, Natural Health Services Ltd. (“NHS”), in connection with a privacy breach of the Electronic Medical Record (“EMR”) system used by NHS.

NHS identified that there was a data breach in the EMR system between December 4, 2018 and January 7, 2019, during which period NHS records containing personal health information of approximately 34,000 patients were accessed without authorization.
NHS has been working with privacy protection and law enforcement authorities to investigate and respond to this breach.

NHS has taken the following steps to protect personal health information in its care from further harm or similar circumstances
Click to expand...

ronjor · Mar 29, 2019

Data breach exposes diagnosis data of 34,000 medical marijuana patients

By Charlie Osborne for Zero Day | March 29, 2019
An electronic system used by a Canadian service and its parent company was compromised.
Click to expand...

guest · Mar 29, 2019

OCR Acting Deputy Director Talks Risk Management at Advocacy Summit
March 26, 2019
https://journal.ahima.org/2019/03/2...tor-talks-risk-management-at-advocacy-summit/

For several years, OCR has been conducting audits of HIPAA-covered entities and business associates to better understand what organizations are doing well and where they can improve. An update and summary of the findings will be published this year, he said.
Noonan also gave an overview of the varieties of complaints and investigations OCR’s enforcement program performs. The health information privacy division annually receives 25,000 complaints, with 350 breach reports investigated in 2018, Noonan said.

So far in 2019, according to OCR data, 41 percent of breaches were related to email activity such as phishing. Laptops continue to be a concern as well. “If it’s mobile, your data will walk,” Noonan said. Hacking was the most common type of breach in the first two months of 2019.

Healthcare organizations should not only have good defenses to prevent hackers from getting in, he advised; they should also have safeguards to make it difficult for hackers to get around a system if they do get in. “Once somebody has broken in, you [should be] making it as hard as possible for them to access the data or extract the data,” Noonan said.
Click to expand...

guest · Mar 30, 2019

mood said: ↑

HIV data leak: Mikhy Farrera Brochez pleads not guilty in US court
March 20, 2019
https://www.channelnewsasia.com/new...rera-brochez-pleads-not-guilty-in-us-11361180
Click to expand...

HIV data leak: Farrera-Brochez tells US court he has complied with order to delete stolen data
March 30, 2019
https://www.straitstimes.com/world/...-tells-us-court-he-has-complied-with-order-to

Mikhy Farrera-Brochez, the American at the centre of Singapore's HIV registry leak, has promised to delete all information obtained from the Singapore Government in accordance with a court order granted to the Ministry of Health (MOH).

The 34-year-old also swore, in a written statement filed with a US court on Friday (March 29), that he had removed or would remove all online posts and references related to any information from the Singapore government.
He said that since the court order had been granted, he had been in federal custody and did not have access to or control over the confidential data.

Farrera-Brochez, who sent e-mails from Kentucky threatening to release the information after he was deported to the US in April 2018, had until Friday to certify that he had made the deletions. Had he not complied, he could have been held in contempt of court and jailed.
Click to expand...

guest · Mar 30, 2019

DePaul experienced data breach, clients' Social Security numbers exposed
March 30, 2019
https://eu.democratandchronicle.com...-numbers-other-client-information/3311629002/

Local housing and health provider DePaul experienced a data breach in February that exposed some clients' sensitive information, the organization announced Friday.

The incident was deemed a “phishing scam” — a hacking tactic meant to obtain sensitive information, typically via email — that involved one employee email account. Since learning of a potential breach on Feb. 1, DePaul evaluated 41,000 emails that could have been affected.
A small percentage of the emails involved in the incident contained Social Security numbers, dates of birth and/or full names of individuals participating in DePaul’s behavioral health program.
Click to expand...

guest · Apr 1, 2019

Indian govt agency left details of millions of pregnant women exposed online
Medical records removed from leaky server after more than three weeks
April 1, 2019
https://www.zdnet.com/article/india...of-millions-of-pregnant-women-exposed-online/

A database managed by an Indian government healthcare agency was left connected to the Internet without a password, where it exposed more than 12.5 million medical records for pregnant women, ZDNet has learned.
THE DATABASE'S OWNER
The database belonged to the Department of Medical, Health and Family Welfare of a state in northern India. ZDNet has refrained from naming the state.
The reason is that the database is still available online without a password. The good news is that the medical records have been removed from the database.

A separate database showed the progress of some of these user reports and contained information about the legal status of some complaints that have gone to court following a government's investigation.
Leaving such sensitive information inside a passwordless MongoDB server is akin to breaking doctor-patient confidentiality.
Click to expand...

ronjor · Apr 1, 2019

Tracking Common Causes of Recent Health Data Breaches

Marianne Kolbasuk McGee (HealthInfoSec) April 1, 2019
Analyzing Trends Reflected on 'Wall of Shame' Tally So Far This Year
Click to expand...

guest · Apr 2, 2019

Ransomware forces Michigan medical practice to close shop
April 2, 2019
https://hotforsecurity.bitdefender....gan-medical-practice-to-close-shop-21040.html

A doctor’s office in Battle Creek, Michigan was forced into closure after hackers infected its systems with ransomware, compromising everything from patient records to billing information.

Doctors William Scalf and John Bizon reportedly told local TV station Newschannel 3 that ransomware locked up the systems at their co-owned Brookside ENT and Hearing Center. The attackers demanded $6,500 for the decryption keys.
The duo refused to pay the relatively low ransom demand, claiming there was no guarantee the attackers would stick to their end of the bargain, or that they wouldn’t strike again. Instead, they decided to close the clinic.

The Newschannel 3 report also reveals a worrying case involving a 13-year old patient whose mother is devastated that her daughter’s medical records are gone.
This just goes to show, again, how big an impact ransomware can have on healthcare institutions and patients.
Click to expand...

guest · Apr 2, 2019

US healthcare IoT security rules are not being heeded
April 2, 2019
https://portswigger.net/daily-swig/us-healthcare-iot-security-rules-are-not-being-heeded

US regulations for internet of things (IoT) devices in medical environments are adequate – it’s just that too many hospitals and doctors aren’t following them, according to a leading US infosec strategist.

Josh Corman told The Daily Swig that too many doctors and hospitals have failed to to embrace changes in device cybersecurity introduced through the Health Information Technology for Economic and Clinical Health Act (HITECH).
Enacted in 2009, and amended and updated since, HITECH was designed to encourage hospitals to adopt electronic health records and health information technology.

Change is slow. Part of the reason for this is that it takes six years for a medical device to come to market. The service life of medical devices can last as long as 30 years.
“In spite of good progress and recall provisions, hospitals and physicians are yet to heed the threat from cybersecurity,” Corman explained.
Click to expand...

ronjor · Apr 3, 2019

Dallas-Area Home Health Care Employee Sentenced to Five Years in Prison for His Role in a $3.7 Million Health Care Fraud Scheme

Tuesday, April 2, 2019
A Collin County, Texas man was sentenced to 60 months in prison today following his trial conviction for conspiracy to commit health care fraud.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

Log in or Sign up

Why Healthcare Security Matters

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

Useful Searches