Why Healthcare Security Matters

guest · Aug 4, 2019

District of Columbia Physician Indicted for Alleged Role in $12.7 Million Health Care Fraud Scheme
August 2, 2019
https://www.justice.gov/opa/pr/dist...ged-role-127-million-health-care-fraud-scheme

A physician with a practice in the District of Columbia was charged in an indictment unsealed today for his role in an alleged $12.7 million health care fraud scheme to submit fraudulent claims to Medicare for complicated medical procedures he never provided.
Frederick Gooding, 68, of Wilmington, Delaware, was charged in an indictment filed on July 30 in the District of Columbia with 11 counts of health care fraud.
Click to expand...

guest · Aug 6, 2019

A Model Hospital Where the Devices Get Hacked—on Purpose
August 6, 2019
https://www.wired.com/story/defcon-medical-device-village-hacking-hospital/

But as horror stories about vulnerable pacemakers or insulin pumps persist, and ransomware continues to target hospitals around the world, that more casual approach has felt increasingly insufficient. This year, it's going all out.

"It's a 2,600-square-foot immersive hospital set built by students in the CalPoly theater set design department and they’re bringing it up to Vegas," Woods says.
The Village will supply both new and older devices for hackers to tear apart. And there are still major security issues that arise in the setup and maintenance of medical devices.

He hopes the Village can build general interest in the hacking community and help researchers understand the resources that are available for disclosure.
"The whole ecosystem needs to undergo a change," Alli says.
Click to expand...

guest · Aug 6, 2019

Healthcare is in Cybercriminals’ Crosshairs
August 6, 2019
https://blog.radware.com/security/ddosattacks/2019/08/healthcare-is-in-cybercriminals-crosshairs/

The healthcare industry is a prime target of hackers. According to Radware’s 2018-2019 Global Application and Network Security Report, healthcare was the second-most attacked industry after the government sector in 2018. In fact, about 39 percent of healthcare organizations were hit daily or weekly by hackers and only 6 percent said they’d never experienced a cyber attack.

Case in point: 96% of non-federal acute care hospitals have an EHRS. This is up from 8% in 2008.
The Vulnerabilities
According to the aforementioned Radware report, healthcare organizations saw a significant increase in malware or bot attacks, with socially engineered threats and DDoS steadily growing, as well.
Why Healthcare?
The healthcare industry is targeted for a variety of reasons. For one thing, money. By 2026, healthcare spending will consume 20% of the GDP, making the industry an attractive financial target for cyber criminals
Click to expand...

guest · Aug 7, 2019

mood said: ↑

Meds prescriptions for 78,000 patients left in a database with no password
Database containing 390,000 Vascepa prescriptions for 78,000 patients left open on the internet
June 20, 2019
https://www.zdnet.com/article/meds-...patients-left-in-a-database-with-no-password/
Click to expand...

Notice of Data Breach [August 5, 2019] (PDF): https://oag.ca.gov/system/files/Data%20Issue%20-%20Individual%20Notification.pdf

[...] a third party vendor (the “vendor”) has notified Amarin Pharma, Inc. (“Amarin”) about a security matter involving a database maintained by the vendor that may have contained certain information about you. [...] Vascepa, an Amarin product.
The vendor is an independent company that supports Amarin’s copay assistance programs by providing customer relationship management services relating to Vascepa.
What Happened
On or around June 20, 2019, we became aware of media reports suggesting that a database containing information about consumers who use or have expressed interest in Vascepa may have been subject to unauthorized access.

On July 11, 2019, the vendor informed us that due to a database misconfiguration, information could have been accessed without proper authorization between May 2, 2018, and June 20, 2019. The vendor further informed us that it identified evidence of unauthorized access to and acquisition of information from the database during the period May 29, 2019 to June 20, 2019 [...]
Click to expand...

guest · Aug 7, 2019

Thousands of medical histories exposed in data breach
August 7, 2019
https://www.smh.com.au/business/com...s-exposed-in-data-breach-20190807-p52euq.html

Tens of thousands of Australians have had their medical histories and other private information exposed in a large data breach of a company that enabled them to participate in paid clinical trials.
The database belonging to Neoclinical exposed approximately 37,000 people's contact information and their responses to personal medical questions qualifying them for clinical trials, which included information about diagnoses, illicit drug use and treatments.

According to US cyber security company UpGuard, which uncovered Neoclinical's unsecured database on the internet, there were 12,388 individuals from NSW and 4916 from Victoria in the exposed database. The rest were from New Zealand or other Australian states and territories.
In a statement to The Sydney Morning Herald and The Age on Wednesday afternoon, Neoclinical admitted to the breach but said the disclosure of it "was an exercise by a cyber security company demonstrating their expertise for marketing purposes".
Click to expand...

guest · Aug 9, 2019

Lawsuit against UnityPoint Health partly dismissed, but Wisconsin plaintiffs can move forward on claims of negligence
August 7, 2019
https://wkow.com/news/top-stories/2...ffs-can-move-forward-on-claims-of-negligence/

UnityPoint Health, which operates Meriter Hospital in Madison, alerted the public in 2018 about two security breaches where patient information was compromised. A lawsuit was filed shortly after by four patients, including two who live in Wisconsin. The other plaintiffs are from Iowa and Illinois.

UnityPoint Health filed a motion to dismiss the lawsuit, which was recently ruled on by U.S. District Court judge for the Western District of Wisconsin, James D. Peterson. Even though the lawsuit was filed in the Western District of Wisconsin, Judge Peterson made decisions for each plaintiff based on where they live and each state’s laws.
Peterson dismissed the plaintiff’s claims for invasion of privacy, misrepresentation, violation of data breach notifications statutes (in Wisconsin) and violation of consumer fraud statutes.
Click to expand...

guest · Aug 9, 2019

NT police chief admits officers breached privacy of public servant's medical records
August 8, 2019
https://www.abc.net.au/news/2019-08-08/nt-police-admit-breaching-public-servant-privacy/11392444

But NT Police won't say if the department the man worked for was involved, nor if the officers responsible have been disciplined.

He accidentally discovered the gym's committee members — comprised of senior police and public servants — discussing his health issues after he went to the Alice Springs emergency department early one morning.
"I was accidentally [copied] in on the email chain about my gym membership, and I was barred basically for being psychotic, schizophrenic, all sort of diagnoses that weren't my medical diagnoses."
'Apology not enough'
In a letter to Mr Horsfall, Mr Kershaw conceded an internal investigation by the Special References Unit found Mr Horsfall's privacy had been breached.
"The investigation established a breach of your privacy and as such the complaint is sustained," he wrote.
Click to expand...

guest · Aug 9, 2019

Allscripts Faces $145 Million Settlement With DOJ
At Issue: HIPAA, HITECH Act, Anti-Kickback Statute Compliance of Company It Acquired
August 9, 2019
https://www.inforisktoday.com/allscripts-faces-145-million-settlement-doj-a-12900

Health IT vendor Allscripts says it has reached a preliminary $145 million settlement with the Department of Justice related to the business practices of Practice Fusion, an electronic health record vendor the company acquired last year.
Although details of the settlement are sketchy, it involved compliance with HIPAA, the HITECH Act electronic health record incentive program and the Anti-Kickback Statute.
What's Behind the Settlements?
There seem to be two major thrusts involving whether the EHR had met the HITECH standards set to be eligible as certified electronic health record technology and a violation of the federal kickback standards governing anti-competitive behavior in healthcare."

HHS will determine what direction to take concerning those who received HITECH Act incentive payments as a result of implementing the Practice Fusion EHR, Holtzman says.
"It remains to be seen if healthcare professionals or facilities will be held accountable for business practices that are deemed in violation of the anti-kickback standards."
Click to expand...

guest · Aug 9, 2019

Pen Testing Stories: How an X-Ray Machine Unlocked the Network
This One Time on a Pen Test: Paging Doctor Hackerman
August 9, 2019
https://blog.rapid7.com/2019/08/09/this-one-time-on-a-pen-test-paging-doctor-hackerman/

I was testing wireless and internal network vulnerabilities in a system of eight hospitals, and the wireless network specifically seemed to be fairly locked down. They had employed EAP-TLS [...] This high-security configuration is still fairly unusual to see implemented consistently, since not every wireless device is technically capable of complying with it.

While walking past the entrance to the Intensive Care Unit (ICU) in a particular hospital, I saw MAC addresses matching that of pagers (presumably used by the nurses and doctors) connecting and interacting with the corporate WiFi.
I returned to a desk to discover the domain user and password hash leveraged by the pagers for authentication. This captured hash turned out to be pretty quick to crack, so with the cleartext password and username in hand, I was on the corporate network.

The internal network had a large amount of non-standard devices—namely, networked medical equipment. One of these medical devices, an unused X-ray machine, was running an outdated version of Windows.
That X-ray machine gave us the keys to the entire network.
Click to expand...

guest · Aug 10, 2019

FDNY EMS Notifies More Than 10,000 Patients of Possible Data Breach
August 9, 2019
https://www.nbcnewyork.com/news/loc...Patients-Possible-Data-Breach--530768631.html

More than 10,000 patients whom the FDNY EMS had previously treated and or transported were notified that their personal information may have been compromised after an employee’s personal external hard drive was lost last March, according to officials.
The employee, who was authorized to access the records, uploaded the information onto their personal external device, which was subsequently reported missing, the FDNY said.

In the letter sent to the patients who were possibly impacted in this potential breach, the FDNY says that it was notified March 4 that the employee’s personal portable hard drive was reported missing from an FDNY facility.
Now that the investigation is complete, FDNY is contacting all individuals whose PHI was contained on the missing hard drive,” the letter reads in part.
In the notice sent, the FDNY says names, addresses, gender information, telephone numbers, dates of birth, insurance information number and health information related to the reason for the ambulance call may have been compromised given that when FDNY operates emergency ambulances in the New York City 911 System.
Click to expand...

guest · Aug 10, 2019

Further 185,000 Individuals Affected by AMCA Data Breach
August 8, 2019
https://www.hipaajournal.com/further-185000-individuals-affected-by-amca-data-breach/

Three more healthcare organizations have announced they have been affected by the data breach at American Medical Collection Agency (AMCA): West Hills Hospital & Medical Center in California, Inform Diagnostics, and CompuNet Clinical Laboratories.

The latest announcements bring the total number of companies known to have been affected to 21. It is not yet known how many patients of West Hills Hospital and Medical Center have been affected, but as it stands, the total victim count is at least 24,390,307. It may take several weeks before the final victim count is known and all of those individuals receive their breach notification letters.
AMCA has sent breach notification letters to all individuals whose financial information was exposed. All other affected West Hills patients are being notified by the hospital. West Hills Hospital and United WestLabs have now stopped using AMCA’s services.
Click to expand...

guest · Aug 10, 2019

Email Security Breaches Expose PHI of Seattle Community Psychiatric Clinic Patients
August 9, 2019
https://www.hipaajournal.com/email-...eattle-community-psychiatric-clinic-patients/

Community Psychiatric Clinic in Seattle, WA, a provider of accredited outpatient, mental health treatment, and counselling services, has experienced two security breaches in which patient information may have been compromised. In both cases, an unauthorized individual gained access to an employee’s Microsoft Office 365 account.

The first security breach was detected on March 12, 2019 when an employee’s account was subjected to unauthorized access.
The investigation did not uncover any evidence to suggest that patient data had been stolen.
Around two months later on May 8, 2019, a second email account was discovered to have been compromised in a separate attack. The attacker used the email account to send a fraudulent wire transfer request to another member of staff.

A forensic investigation revealed that in addition to the above two accounts, a further two accounts had also been compromised. The investigators note that since the attackers accessed the mailboxes through Outlook Web Access, it significantly reduced the potential for large scale data exfiltration.
Click to expand...

guest · Aug 10, 2019

Anger after confidential medical records found dumped in shed
August 10, 2019
https://www.devonlive.com/news/local-news/anger-after-confidential-medical-records-3196374

Medical records and personal information regarding dozens of patients has been dumped in a shed in Tiverton.
The details of patients at the former Post Hill care home include names, photos, eating habits, behaviour details, addresses of next of kin.

A resident, who stumbled across hundreds of pages of the records said he was “dumbfounded” that such sensitive data could be left for people to come across.

“I was absolutely dumbfounded at how much detail has been left out for what must be more than a decade. If I was a family member of a patient here, I would be mortified and very upset.
Click to expand...

Minimalist · Aug 11, 2019

AI researchers have a plan to pay patients for data

Robert Chang, a Stanford ophthalmologist, normally stays busy prescribing drops and performing eye surgery. But a few years ago, he decided to jump on a hot new trend in his field: artificial intelligence. Doctors like Chang often rely on eye imaging to track the development of conditions like glaucoma. With enough scans, he reasoned, he might find patterns that could help him better interpret test results.
Click to expand...

https://arstechnica.com/tech-policy/2019/08/ai-researchers-have-a-plan-to-pay-patients-for-data/

guest · Aug 11, 2019

Patient sues LVHN saying doctor illegally tapped his medical records and shared them with business associates
August 11, 2019
https://www.mcall.com/health/mc-hea...0190811-zr4paw5sgzea7lpuyo4ps77twu-story.html

A man who spent a couple months in Lehigh Valley Hospital claims in a lawsuit that a doctor who wasn’t treating him and with whom he had a contentious business relationship illegally tapped into his medical records a dozen times, a claim Lehigh Valley Health Network and the state Health Department acknowledged in letters to the patient.

The case apparently led the Health Department recently to cite Lehigh Valley Health Network for not protecting confidential patient information.

The department concluded “the facility failed to maintain a medical record in a confidential manner and failed to safeguard the access to confidential patient information.”
A central dispute in Kahlon’s lawsuit is whether LVHN knowingly ignored Kahlon’s complaints of privacy violations and, through inaction, failed to prevent inappropriate access of his health information for months. The case shows the vulnerability of patient data as technology makes it easier for more people to see patient information across an increasingly consolidated health industry.
Click to expand...

guest · Aug 12, 2019

Patients file lawsuit over data breach at MU Health Care
August 8, 2019
https://www.columbiamissourian.com/...cle_1f62d802-b9f4-11e9-8510-47b5147733e9.html

A class-action lawsuit filed Tuesday demands a jury trial and seeks compensatory damages and other relief after an MU Health Care data breach left public health information of thousands of patients vulnerable.

On Friday, MU Health Care revealed that around 14,400 patients’ personal information was accessed through the email accounts of at least two employees between April 23 and May 1. Some Social Security numbers, health insurance, medical and other protected health information were compromised.
Attorney A.W. Smith said at least 20 other claimants have already joined in the class action.

The plaintiffs are asking that MU Health Care strengthen its data security systems and monitoring procedures, [...] Class members believe they were overpaying for services that were intended to be paired with adequate data security.

“On the black market, PHI is much more valuable” than other types of personal information, Smith said.
He said that once personal information is breached, it can cause long-term problems for affected patients.
Click to expand...

guest · Aug 12, 2019

Renown Health warns lost thumb drive could put some patient information at risk
August 12, 2019
https://eu.rgj.com/story/news/2019/08/12/renown-warns-lost-thumb-drive-held-patient-info/1988174001/

Northern Nevada’s largest health care provider is still looking for a thumb drive containing patient information that first went missing in June.

Renown Health on Friday announced it was mailing letters to patients whose information may have been stored on the data storage device. An unnamed Renown employee first reported the thumb drive missing on June 30, according to a statement from the company.
Renown said investigators determined the drive contained patient and doctors’ names, medical record numbers, diagnoses and clinical information.

“To help prevent something like this from happening in the future, Renown is reviewing its policy on portable devices, such as thumb drives, and providing additional employee education on safeguarding patient information,” Renown added in a statement.
Click to expand...

Minimalist · Aug 12, 2019

A New Credential for Healthcare Security Leaders

A new professional credential aims to help healthcare organizations bolster their security leadership bench strength, says William Brad Marsh, co-chair of a committee that developed the certification.

The Certified Healthcare Information Security Leader - or CHISL - credential was created by the Association of Executives in Healthcare Security, a subgroup of the College of Healthcare Information Management Executives.
Click to expand...

https://www.databreachtoday.com/interviews/new-credential-for-healthcare-security-leaders-i-4415

guest · Aug 13, 2019

Health Data Breaches Involving Unencrypted Devices Reported
Despite the Decline of Such Incidents, Recent Breaches Serve as Reminders of Risks
August 13, 2019
https://www.inforisktoday.com/health-data-breaches-involving-unencrypted-devices-reported-a-12912

While health data breaches stemming from the loss or theft of unencrypted devices have nosedived in recent years, a handful of recent incidents serve as a reminder that these devices still can pose risks to patient data.
For example, the New York City Fire Department and Renown Health, a healthcare network in Nevada, both recently reported breaches tied to lost or stolen devices.
Declining Incidents
So far this year, only 16 incidents involving the loss or theft of unencrypted devices have been added to the tally. Those incident have affected a total of about 146,000 individuals.
That's a tiny fraction of the 276 health data breaches impacting nearly 33 million individuals that have been added to the tally this year. That's also a big decline from a few years ago, when the loss or theft of unencrypted devices was the most common cause of major health data breaches.

"In my opinion, most organizations have not purchased encrypted portable media - encrypted USB flash drives, jump drives, external drives, etc. - for their employees to use," notes Tom Walsh, president of consulting firm tw-Security.
Click to expand...

guest · Aug 14, 2019

Intraprise Health platform strengthens healthcare security
August 13, 2019
https://searchhealthit.techtarget.c...alth-platform-strengthens-healthcare-security

To help healthcare organizations manage and automate security programs, Intraprise Health introduced BluePrint Protect Security Risk Management Software. The software service intends to provide users with a dynamic view of third-party enterprise risks to prevent healthcare security breaches.

Aimed at hospitals, health systems and pharma companies, BluePrint Protect automates third-party risk management (TPRM) processes and uses Intraprise's Third-Party Assessment Cloud, the vendor's third-party knowledge base, to improve workflow and security visualization.
Hospitals and healthcare organizations are often the target for hackers as other industries -- like retail and banking -- up their security.
If security measures aren't thoroughly vetted or resources aren't sufficient for the amount of data, it's easy for any number of systems to become vulnerable to attack.
Click to expand...

guest · Aug 15, 2019

mood said: ↑

Hospital still mum on ransomware attack
July 24, 2019
https://www.thedailyworld.com/news/hospital-still-mum-on-ransomware-attack/
Click to expand...

Aberdeen hospital's computers struck by ransomware hack attack
August 14, 2019
https://komonews.com/news/local/aberdeen-hospitals-computers-struck-by-ransomware-hack-attack

A ransomware attack by hackers has scrambled data on computer systems at Grays Harbor Community Hospital in Aberdeen, including patient health information, officials said Wednesday.
The attack, which is designed to block the hospital's access to its computer systems until a sum of money is paid, was originally discovered in June. The same attack also struck Harbor Medical Group in Grays Harbor County.

The hospital and medical group immediately launched an investigation as soon as the attack was discovered, with support from forensics and technical consultants. The FBI also was notified.
She said said patient care was never compromised by the ransomware attack at any time. She also said officials don't believe any personal information was ever released to unauthorized persons.
Click to expand...

guest · Aug 14, 2019

AMCA Breach Victim Count Continues to Grow
More Affected Labs Revealed; Several Breach Reports Show Up on Federal Tally
August 14, 2019
https://www.inforisktoday.com/amca-breach-victim-count-continues-to-grow-a-12917

The American Medical Collection Agency breach continues to grow messier, with more lab companies being added to the victim count.
Meanwhile, victim companies' breach reports are starting to show up on the federal health data breach tally.

Based on announcements made so far, it appears that more than 21 companies and at least 24 million individuals were affected by the AMCA breach, which apparently makes it the largest health data breach reported this year. And it's likely that more victim companies will be revealed in the weeks to come.
Far-Reaching Impact
The AMCA breach will have an impact far beyond the organizations directly affected, says independent health information privacy and security attorney Paul Hales.

"The dramatic increase in breaches drives up healthcare costs," he says. "Investigations, legal fees, mitigation and other covered entity expenses add to the cost of care paid by or for patients."
Click to expand...

Krusty · Aug 14, 2019

Sensitive personal data of hundreds of visa applicants accidentally leaked in email mishap

The personal health information of 317 people applying for Australian visas was accidentally emailed to a member of the general public, an ABC investigation has revealed.

The security bungle occurred when a spreadsheet was sent by mistake to an unknown individual's email address, because of a typo.

The privacy breach, which happened in 2015, occurred under the watch of Australia's largest health insurance company, Bupa, and one of its subcontractors, Sonic HealthPlus (SHP).

Bupa is contracted by the Department of Home Affairs to assess the health of people applying for visas and permanent residency in Australia.

Documents obtained under a Freedom of Information request by the ABC reveal that in August 2015, an SHP employee accidentally sent the names, dates of birth, and passport numbers of 317 people, along with "brief notes, summaries and comments about the status of the medical tests being conducted" to an unknown Gmail address.

It was a mistake that would eventually lead Google Australia to intervene.
Click to expand...

https://www.abc.net.au/news/health/2019-08-15/bupa-immigration-medical-data-breach/11413740

guest · Aug 15, 2019

Eye Care Associates Hit by Ransomware Attack
August 14, 2019
https://businessjournaldaily.com/eye-care-associates-hit-by-ransomware-attack/

Eye Care Associates Inc., the largest ophthalmology and optometry practice in the region, was the victim of a ransomware attack two weeks ago that locked – and still locks – its computer systems.
As of this posting, the computer system is still down, although operations should be fully restored in “the next day or two,” Mary Jo Sierra, director of operators, said Tuesday.

At 4 a.m. July 28 an “unknown computer hacking software had taken control of the entire Eye Care Associates computer system and locked them out until [an] unknown ransom was paid,” states the incident report filed Monday with the Beaver Township Police Department. “Sierra stated that she had reported the intrusion of the computer software to her board of directors and the third-party IT business, GBS, who Eye Care currently uses for backing up files and storing data.”
Click to expand...

guest · Aug 15, 2019

Bayview Dental Notice of Data Privacy Incident
August 13, 2019
https://www.prnewswire.com/news-rel...otice-of-data-privacy-incident-300901000.html

Bayview Dental ("Bayview") recently discovered an event that may affect the security of certain patients' personal information.
What Happened: On May 28, 2019, Bayview became aware of unusual activity on its servers. Bayview immediately launched an investigation, with the aid of forensic experts, to determine the nature and scope of the activity. On July 4, 2019, Bayview learned that an unauthorized actor potentially had access to the servers, and through that, to certain personal information.

What Information Was Involved: Though the investigation is ongoing, Bayview has determined that the information that may have included patient names, addresses, phone numbers, dates of birth, dental insurance information, medical/dental history information and potentially Social Security numbers. We are unaware of any attempted or actual misuse of the information.
[...] we immediately secured the impacted servers and began working to implement additional safeguards and continue to provide training to our employees on data privacy and security.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Krusty Registered Member

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Krusty Registered Member

guest Guest

guest Guest

Useful Searches