Why Healthcare Security Matters

guest · Apr 16, 2019

New Malicious Medical DICOM Image Files Cause HIPAA Headache
April 15, 2019
https://www.bleepingcomputer.com/ne...dical-dicom-image-files-cause-hipaa-headache/

Malicious DICOM files can be crafted to contain both CT and MRI scan imaging data and potentially dangerous PE executables, a process which can be used by threat actors to hide malware inside seemingly harmless files.

Cylera's Markel Picado Ortiz achieved this by taking advantage of a DICOM format design flaw which allows for the "128-byte section at the beginning of the file, called the Preamble," to be modified to add compatibility with non-DICOM image viewers.
Malicious PE/DICOM files can be used by multi-stage malware
However, even though embedding a malicious component into a DICOM is possible as proven by Ortiz, PEDICOM files cannot actually be used to attack healthcare systems on their own, as they cannot be directly executed after being dropped on a healthcare system.

Ortiz also described how PEDICOM polyglot files can be launched from the command-line, using a custom made batch script, or with the help of another program or malicious tool using the CreateProcess API function.
Therefore, using malicious PEDICOM files would only add to the attackers' already established toolkit a new tool, specifically tailored for healthcare systems where CT and MRI imaging data is omnipresent.
Click to expand...

ronjor · Apr 17, 2019

Appalachian Regional Prescription Opioid (ARPO) Strike Force Takedown Results in Charges Against 60 Individuals, Including 53 Medical Professionals Wednesday, April 17, 2019

Charges Involve Over 350 Thousand Prescriptions for Controlled Substances and Over 32 Million Pills; ARPO Strike Force Grows to 10 Districts, Expanding to Include the Western District of Virginia
Click to expand...

xxJackxx · Apr 18, 2019

Ubiquitous Bug Allows HIPAA-Protected Malware to Hide Behind Medical Images
https://threatpost.com/hipaa-protected-malware-medical-images/143890/

Very interesting. But even more so, it made me think about something I had not previously considered... I work for a company that produces medical auditing software. After reading this article and seeing that part of the problem is that HIPAA related data is usually excluded from AV, I am wondering what the potential is for AV to upload PHI from our customers PCs from our software and if we should be recommending that they exclude the data folders from scans. That said, it could have to potential to create the problem in the article, which is that if our software gets infected, it may not be caught.

guest · Apr 18, 2019

Patients to clean up a breach after protective services not offered
April 17, 2019
https://www.information-management....-breach-after-protective-services-not-offered

A virus that prohibited access to files crippled IT systems at Centrelake Medical Group this past February.
It appears the virus was not ransomware, but it did deny access to data, according to executives of the healthcare organization, which has eight locations in California.

“As part of our ongoing investigation, we determined this virus was introduced by an unknown third party that had access to certain servers on our information system, which contain personal and protected health information relating to current and former Centrelake patients,” according to the notification letter, which was sent to patients and business partners.
Centrelake could run afoul of OCR, which is encouraging organizations to offer protective services.
Click to expand...

ronjor · Apr 18, 2019

Study: Health care industry worst at protecting consumer data, federal government is best

by Zlati Meyer April 17, 2019
The federal government is best at protecting consumer data and the health care sector is the worst, according to a new study by the not-for-profit Internet Society's Online Trust Alliance.
Click to expand...

guest · Apr 18, 2019

Acadia Hospital mistakenly released confidential information of 300 Suboxone patients
April 18, 2019
https://bangordailynews.com/2019/04...dential-information-of-300-suboxone-patients/

In addition to their names, the list also contained the identities of the patients’ medical providers, all of which is protected under federal privacy laws that prohibit health care organizations from disclosing personal patient information to the public without permission. Disclosing that a person takes Suboxone effectively outs him or her for seeking treatment for opioid addiction.

The blunder reflects the ongoing vulnerability of sensitive patient information in a digital age, even with rules in place to secure its privacy. It could lead to an audit of the hospital’s privacy and security protocols, and expose it to lawsuits from affected patients. Acadia is required to report the incident to federal regulators.

“For us, this is a huge deal. Three hundred names were shared unintentionally. They were shared nonetheless. This never should have happened,” Oxley said in an interview on Wednesday, a week after the hospital erroneously emailed the list.
Still, Oxley said, Acadia is working with its information technology department to install measures that ensure confidential electronic information doesn’t unintentionally leave the hospital again.
Click to expand...

guest · Apr 19, 2019

Millions of rehab records exposed on unsecured database
Exclusive: The data included patient names and treatments
April 19, 2019
https://www.cnet.com/news/millions-of-rehab-records-leak-from-unsecured-database/

It's some of the most sensitive medical information a person could have. Records for potentially tens of thousands of patients seeking treatment at several addiction rehabilitation centers were exposed in an unsecured online database, an independent researcher revealed Friday.

The 4.91 million documents included patients' names, as well as details of the treatments they received, according to Justin Paine, the researcher. Each patient had multiple records in the database, and Paine estimates that the records may cover about 145,000 patients.
The find is the latest example of a widespread problem: Any organization can easily store customer data on cloud-based services now, but few have the expertise to set them up securely.

A leak of health care data is a significant problem that can trigger requirements under federal law to notify patients of the problem. Paine said he has no indication that patients have been notified of the database exposure and that Steps to Recovery, the Pennsylvania rehab center whose data makes up the bulk of the leak, didn't respond to his messages telling them of the exposure.
Click to expand...

ronjor · Apr 19, 2019

Why a Furniture Maker Had to Report a Health Data Breach

Marianne Kolbasuk McGee (HealthInfoSec) • April 18, 2019
Many Employers Have Health Data That Must Be Protected Under HIPAA
Click to expand...

ronjor · Apr 20, 2019

Doctor-services firm says private data of patients exposed

By The Associated Press April 20, 2019
DALLAS (AP) — Nationwide physician-staffing company EmCare says a breach exposed personal data including Social Security numbers and clinical information about some patients.
Click to expand...

guest · Apr 22, 2019

Bodybuilding.com experiences data security incident
April 19, 2019
https://idahonews.com/news/local/bodybuildingcom-experiences-data-security-incident

Bodybuilding.com announced Friday that some of their employment-related information may have been accessed in a data security incident.

The possible information accessed could have been group health plan subscriber information, such as protected health information of certain employees and former employees.
"While the Company has no evidence that personal information was accessed or misused, Bodybuilding.com is notifying current and former employees who are group health plan enrollees and relevant dependents and beneficiaries, out of an abundance of caution," Bodybuilding.com stated in a press release.
Click to expand...

ronjor · Apr 22, 2019

Michigan Home Health Agency Owner Sentenced to Prison for $8.3 Million Medicare Fraud Monday, April 22, 2019

A Michigan home health agency owner was sentenced to 84 months in prison today for his role in an $8.3 million scheme to defraud Medicare.
Click to expand...

ronjor · Apr 23, 2019

FDA clears first personal ECG device to detect three heart arrhythmias

Jon Fingas, @jonfingas 23 Apr 2019
AliveCor's KardiaMobile has received the first FDA clearance allowing a personal device to detect two other relatively common conditions, bradycardia (where your heart rate dips to 40-50BPM) and tachycardia (a jump to 100-140BPM). While these conditions are sometimes innocuous and might not show symptoms, they can also be representative of issues like heart disease.
Click to expand...

ronjor · Apr 23, 2019

Healthcare has a massive cybersecurity problem, and we’re not doing enough to fix it.

by Larry Alton 23 Apr 2019
In areas like healthcare where privacy is a top priority, cybersecurity shortfalls are widespread and we're not doing enough to fill the gaps.
Click to expand...

guest · Apr 23, 2019

Technology will only transform medicine if we get privacy right
April 23, 2019
https://www.wired.co.uk/article/digital-health-changes-privacy

Healthcare was very slow to digitise compared to other major industries, but it is getting there. A decade ago, only ten per cent of US hospitals had electronic health records. Today, only ten per cent do not.

However, it will be incredibly hard for healthcare to take advantage of the digital revolution if data can’t be shared.
In the next ten years we will have no choice but to develop secure ways to share data between health systems and companies with digital expertise.
Click to expand...

guest · Apr 23, 2019

Protecting Substance Addiction Data: The Challenges
Recent Breaches Call Attention to Complex Privacy Compliance Issues
April 23, 2019
https://www.databreachtoday.com/protecting-substance-addiction-data-challenges-a-12406

Two organizations that provide treatment to patients with substance addictions have recently reported breaches of their patients' sensitive information.
These two breaches of particularly sensitive information serve as a reminder of the extra precautions that certain substance addiction and mental health treatment facilities must take to protect their patients' privacy.

In general, entities must comply with HIPAA as well as a regulation known as 42 CFR Part 2 if they receive federal funding for providing substance use disorder treatment, says privacy attorney Iliana Peters of the law firm Polsinelli.
Under 42 CFR Part 2, healthcare entities are prohibited from disclosing any information that would identify someone as having a substance use disorder unless that individual provides written consent [...]
HIPAA - unlike 42 CFR Part 2 - generally permits the disclosure of protected health information for certain purposes, including treatment, payment or healthcare operations, without patient authorization

Part 2 rules "are one of the most confusing elements of the current debate in healthcare privacy and security," says privacy attorney Kirk Nahra of the law firm WilmerHale.
Click to expand...

ronjor · Apr 23, 2019

London Ambulance Service trials real-time access to patient data

Angelica Mari 23 Apr 2019
The NHS Identity Service pilot enables clinicians to access summary care records on secure iPads
The London Ambulance Service is taking part in an NHS Identity Service pilot aimed at providing real-time information on patients while on the move.
Click to expand...

ronjor · Apr 24, 2019

Acadia Hospital Employee Emails Patient Information

April 24, 2019
A Northern Light Acadia Hospital employee emailed a Bangor Daily News (“BDN”) reporter in response to a request for unrelated information, mistakenly sending an email with an attached file that contained information related to certain patients, Northern Light Acadia Hospital says.
Click to expand...

ronjor · Apr 24, 2019

FTC Charges Surescripts with Illegal Monopolization of E-Prescription Markets

April 24, 2019
Company used its digital platform to impose anticompetitive vertical and horizontal restraints on commerce, leading to higher prices and reduced consumer choice, agency alleges
Click to expand...

guest · Apr 24, 2019

38 patient records viewed ‘inappropriately’ by St. Boniface Hospital employee
April 24, 2019
https://globalnews.ca/news/5197663/...propriately-by-st-boniface-hospital-employee/

St. Boniface Hospital says 38 patients had their records accessed “inappropriately” over a week in March.
The records were looked at between Feb. 28 and March 6 by an employee who had access to the hospital’s record system, they said.

“This is a breach of the Personal Health Information Act (PHIA), which strictly limits the use of personal health information by Hospital employees to only that information they need to perform their job.
“We deeply regret this matter and want to assure the public that we take such matters and our role in protecting our patients’ privacy very seriously,” said Bouchard.
Click to expand...

guest · Apr 24, 2019

IoT devices put healthcare networks at risk
April 24, 2019
https://betanews.com/2019/04/24/iot-healthcare-security/

The proliferation of healthcare Internet-of-things devices, along with unpartitioned networks, insufficient access controls and the reliance on legacy systems, has exposed a vulnerable attack surface that can be exploited by cybercriminals, according to a new report.

Examples of these errors include improper handling and storage of patient files, which is a soft spot for cybercriminals when they target global organizations and industries looking for weaknesses to exploit.
"Healthcare organizations struggle with managing legacy systems and medical devices that traditionally have weak security controls, yet both provide critical access to patient health information," says Chris Morales, head of security analytics at Vectra.

Botnet attacks are a problem too, but tend to be opportunistic and not targeted at specific organizations. While botnet attacks persist everywhere, their rate of occurrence in healthcare is lower than other industries.
You can read more about the findings in the full report available from the Vectra site.
Click to expand...

ronjor · Apr 25, 2019

Sizing Up Revised Model for National Health Data Exchange

Marianne Kolbasuk McGee (HealthInfoSec) April 24, 2019
Healthcare stakeholders and security and privacy experts are sizing up the second draft of the government's proposed Trusted Exchange Framework and Common Agreement, which is designed to promote secure, interoperable nationwide health data exchange.
Click to expand...

guest · Apr 25, 2019

GandCrab ransomware claims another healthcare firm
April 25, 2019
https://hotforsecurity.bitdefender....are-claims-another-healthcare-firm-21105.html

A medical billing service headquartered in Massachusetts has notified patients of a data breach, saying hackers may have exposed their data. The attack involved the infamous GandCrab ransomware.

Cyber crooks have developed a taste for healthcare institutions and their affiliates in recent years, infecting their systems with ransomware or injecting code designed to steal data for future fraud operations. One of the latest reports of a ransomware infection comes from medical billing company Doctors’ Management Service, Inc., which fell victim to GandCrab operators.

The breach, according to the DMS notice (obtained by databreaches.net), occurred in April of 2017. The organization only discovered the breach in December last year, when the attackers deployed ransomware on a vulnerable workstation via Remote Desktop Protocol (RDP).
DMS refused to pay the attackers’ ransom demand and recovered its data from backup. Since it can’t be ruled out that the attackers also accessed and stole patient information, though, the company is notifying everyone who may have been affected
Click to expand...

ronjor · Apr 25, 2019

'Virus Infection' Prohibits Access to Patient Records

Marianne Kolbasuk McGee (HealthInfoSec) April 25, 2019
Attack on a California Medical Group Affects Nearly 198,000 Individuals
Click to expand...

guest · Apr 26, 2019

mood said: ↑

Baystate Health suffers data breach
April 8, 2019
https://www.gazettenet.com/Hospital-says-patient-info-exposed-after-phishing-incident-24715494
Click to expand...

Class-action lawsuit filed against Baystate Health over data breach
April 25, 2019
https://www.masslive.com/business/2...against-baystate-health-over-data-breach.html

A class action suit has been filed against Baystate Health after the data of 12,000 patients was left vulnerable following a February phishing attack.

A class action suit means Chrisanthopoulos is looking for more plaintiffs to add to the suit seeking monetary damages all the eventual plaintiffs would share.
The information compromised in the hack includes patient names, dates of birth, health information (such as, diagnoses, treatment information, and medications), and in some instances, health insurance information, and a limited number of Medicare numbers and Social Security numbers.
Click to expand...

ronjor · Apr 26, 2019

Legacy systems, employee error leave hospitals, devices vulnerable to cyberattacks

Meg Bryant April 26, 2019
Between July and December of last year, the most common approach to hide command-and-control communications in healthcare was via hidden HTTPS tunnels, according to Vectra. The traffic represents outside communications spanning multiple sessions over long periods that appear to be normal encrypted web traffic. The next most common method attackers employed was external remote access tools, which can be used when healthcare organizations communicate with external service providers such as independent labs and imaging centers.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

ronjor Global Moderator

xxJackxx Registered Member

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

Log in or Sign up

Why Healthcare Security Matters

guest Guest

ronjor Global Moderator

xxJackxx Registered Member

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

Useful Searches