Why Healthcare Security Matters

guest · Oct 3, 2019

Dental Practice Pays $10,000 to Settle Social Media Disclosures of Patients’ Protected Health Information
October 2, 2019
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/elite/index.html

Elite Dental Associates, Dallas (“Elite”) has agreed to pay $10,000 the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services and to adopt a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. Elite is a privately-owned dental practice located in Dallas, Texas, providing general, implant, and cosmetic dentistry.
Click to expand...

Read the HHS Press Release
On June 5, 2016, OCR received a complaint from an Elite patient alleging that Elite had responded to a social media review by disclosing the patient’s last name and details of the patient’s health condition.

“Social media is not the place for providers to discuss a patient’s care,” said OCR Director, Roger Severino. “Doctors and dentists must think carefully about patient privacy before responding to online reviews.”
Click to expand...

guest · Oct 3, 2019

Edmonton medical clinic employee fined after admitting to health data breaches
October 3, 2019
https://www.airdrietoday.com/albert...ter-admitting-to-health-data-breaches-1728040

An office assistant has been fined for snooping into two people's health records while she was an employee at an Edmonton medical clinic.

Glenda Garcia admitted in provincial court last week that she looked at the data on numerous occasions without a valid reason.
Garcia, who was fined a total of just over $4,000, is no longer employed at the Terwillegar Family Clinic.
It is an offence under the Health Information Act to knowingly gain or attempt to gain access to private medical records.
Click to expand...

guest · Oct 3, 2019

Toronto hospital recovering from ransomware attack
October 3, 2019
https://vancouversun.com/technology...tack/wcm/d9b980ac-3673-479c-a88b-99721cc0b496

A Toronto hospital is recovering after being hit last week by a variant of Ryuk ransomware. However, so far it seems the malware was only trying to exfiltrate data instead of demanding money.

Michael Garron Hospital chief executive officer Sarah Downey told CBC News that the hospital’s firewall stopped data from leaving the institution.
The attack started in the early hours of Sept. 25 when what it calls a virus was discovered on one of the IT systems. As a result several systems were closed to prevent the malware, later identified as a Ryuk variant, from spreading.
However, as of this morning it is still in what the institution calls a Code Grey, which means some systems including email are disrupted.

“While we hope these types of situations never take place, our expert hospital teams prepare for all issues and we have extensive processes in place to respond quickly when experiencing disruptions in clinical services,” Downey said in a statement. “We want to reassure our community that all current patients at MGH continue to receive safe, high-quality care from our health care teams.
Click to expand...

guest · Oct 4, 2019

UAB Medicine Data Breach Exposes Patient Info in Phishing Attack
October 4, 2019
https://www.bleepingcomputer.com/ne...each-exposes-patient-info-in-phishing-attack/

UAB Medical is the victim of a phishing attack that targeted the medical center's payroll department. This allowed attackers to gain access to numerous employee emails that contained the health information for 19,557 patients.

On August 7th, 2019, attackers began sending emails to employees that pretended to be an executive asking them to fill out a survey. As part of this survey, it was requested that the employees provide their username and password, which some submitted.
This allowed the attackers to gain access to UAB Medical's payroll system where they were trying to redirect employee payments to bank accounts under the attacker's control.

As for UAB Medical's phishing awareness, they state that employees are continually trained for cyberattacks and have increased employee education in relation to email and data security. They have also introduced MFA for all employee emails.
Click to expand...

guest · Oct 4, 2019

How to secure health data in the cloud
October 4, 2019
https://towardsdatascience.com/how-to-secure-health-data-in-the-cloud-541fbdad811a

Data protection refers to keeping personal data safe. This is done using a combination of organisational measures and data security.

Historically, health data was stored locally. For instance, each hospital had its own server with patient records. However, eHealth applications need the data to be available on the application servers.
Securing this data properly is hard. There are 3 key technologies that are used: encryption, pseudonymisation and anonymisation. Let us look at each of these in detail. [...]
Conclusions
Getting data security right is always important. But health data makes the problem much harder. You can’t just delegate the problem to your cloud provider. Now that you understand the relevant technologies, you know the right questions to ask your tech team to make sure you don’t fall foul of GDPR or HIPAA.
Click to expand...

guest · Oct 4, 2019

Early Analysis of Ransomware Attacks on the Healthcare Industry
October 2, 2019
https://www.recordedfuture.com/healthcare-ransomware-attacks/

This is the second blog in an ongoing series of ransomware analyses.
Click to expand...

For more than six years, ransomware attacks have continued to grab headlines by targeting local governments and organizations. Another often targeted sector, which we’re beginning to take a closer look at, is healthcare.
These attacks can disrupt patient services, create confusion, and in 2019, have forced at least two healthcare providers to shut down. Given that these attacks are such a persistent concern, I was surprised that no one had looked at the scope of ransomware attacks against healthcare providers. It turns out that collecting data on these attacks is more complex than it first appears.

We will continue to analyze the data collected and refine the data set as we uncover additional incidents and flesh out information about existing incidents. In the meantime, ransomware attacks against healthcare providers continue to be a problem that is not going away.
Click to expand...

All tracked ransomware incidents and associated data - Report: (PDF) https://go.recordedfuture.com/hubfs/reports/cta-2019-1002-appendix.pdf

guest · Oct 5, 2019

St. Mary's Hospital Still Won't Say Whether It Notified Patients Of 'Wall Of Shame'
October 5, 2019
https://www.mainepublic.org/post/st...t-say-whether-it-notified-patients-wall-shame

Since news broke this week that employees at St. Mary’s Regional Medical Center in Lewiston created a “wall of shame” of patients with disabilities in 2015 and 2016, the hospital’s parent companies have issued an apology and said those involved were disciplined. But they have been silent on steps they may have taken to notify regulators and affected patients.
Federal law requires health care organizations to tell patients when their information is inappropriately disclosed.

MyKayla McCann, who worked at the hospital as a laboratory technician assistant starting in June 2015, later reported the wall, in addition to the inappropriate disclosure of her own private medical information, to administrators in 2016.
There are some exceptions that allow providers to use patients’ information without their authorization, such as to further their treatment, but they don’t apply to a wall of shame, said Ezra Reinstein, founder of The Reinstein Law Firm in Framingham, Massachusetts, which represents medical professionals and practices.
Click to expand...

guest · Oct 5, 2019

Humana notifying some Lafayette customers of possible involvement in privacy breach
October 4, 2019
https://www.theadvocate.com/acadiana/news/article_019f0cdc-e6f4-11e9-a52a-434b799a6bc5.html

Humana is notifying about 500 Lafayette customers that their information may have been included in a former employee's solicitations.

In December, Humana terminated a sales agent for violating company policy by emailing his Humana client list to his personal email account. After he was fired, the company says they believe he shared the information with his wife and that they used the information to contact individuals to solicit them as future customers of their own insurance brokerage.
The solicitations occurred during April and May. On July 10, the former employee's wife provided a statement confirming that she and her husband had solicited his former clients to become customers of their brokerage.
Click to expand...

guest · Oct 6, 2019

Hospitals face complex web of cybersecurity risks
October 6, 2019
https://www.crainsdetroit.com/special-report/hospitals-face-complex-web-cybersecurity-risks

Nonprofit hospitals face greater fiscal and credit risks from cyberattacks than any other sector due to the increasingly interconnected nature of hospital operations and information technology, according to a recent report from Moody's Investor Services.

At Henry Ford Health System, Christine Wheaton, chief privacy and security officer, said the five-hospital system has taken steps in recent years to protect patient data, educate its workforce and prevent and contain potential intrusions from ransomware attacks.

"The health care industry, everything in this space, is transforming to improve patient safety" and ensure privacy is protected.
But Wheaton said an even more serious patient safety threat is if a device is hacked and instructed to turn off or to change how it functions. Or if the hacking changes the patient's electronic medical record in a way that causes a doctor or nurse to misdiagnose or prescribe the wrong medication, she said.
Click to expand...

guest · Oct 6, 2019

Minimalist said: ↑

Ransomware forces 3 hospitals to turn away all but the most critical patients

https://arstechnica.com/information...-10-hospitals-are-turning-away-some-patients/
Click to expand...

DCH Healthcare Systems pays hacker to end ransomware attack
October 6, 2019
https://www.apr.org/post/dch-healthcare-systems-pays-hacker-end-ransomware-attack

The DCH Hospital system in west central Alabama may be accepting new patients as soon as Monday after resolving a ransomware attack. The Associated Press and the Tuscaloosa News report the three-hospital network paid a ransom to a hacker over the weekend to get a key to unlock its system.
Click to expand...

Report: Alabama hospitals pay hackers in ransomware attack

An Alabama hospital system that quit accepting new patients after a ransomware attack said Saturday it had gotten a key to unlock its computer systems.

A statement from DCH Health Systems didn't say how the three-hospital system got the information needed to unlock its data. But The Tuscaloosa News quoted spokesman Brad Fisher as saying the hospital system paid the attackers.
The hospitals said hackers used the ransomware variant Ryuk to lock its files, but the hack didn't compromise the care of patients. Workers reverted to using paper files.
Click to expand...

guest · Oct 6, 2019

Smaller Medical Providers Get Burned by Ransomware
Cyberattacks are pummeling doctors, dentists and community hospitals around the U.S.
October 6, 2019
https://www.wsj.com/articles/smaller-medical-providers-get-burned-by-ransomware-11570366801

Smaller health-care organizations are at greater risk because they generally don’t have the resources for robust security tools and might not have a dedicated cybersecurity specialist to monitor and patch their systems, Ms. Barr said.
Last year, about 57% of medical practices in the U.S. had 10 or fewer physicians and about 15% were run by solo practitioners, according to the American Medical Association.

Some small health-care organizations don’t have the money to bounce back from a cyberattack, said Linn Freedman, head of the privacy and cybersecurity practice at law firm Robinson & Cole LLP.
A Wisconsin dentist who asked not to be named said she has been “overwhelmed dealing with the incident [and] there are more repercussions than one might assume.” She declined to give details.
Click to expand...

guest · Oct 6, 2019

Hundreds of Greater Manchester children's details lost in data breach
October 5, 2019
https://www.bbc.com/news/uk-england-manchester-49945121

A missing document contains the details of all Year 7 pupils in two Greater Manchester secondary schools.
Bolton NHS Foundation Trust has launched an internal investigation after the school nursing team lost the list with details of 425 children.
'Commitment to transparency'
To make sure school nursing care continues efficiently, the trust receives a document listing pupils in each class.
Medical director Francis Andrews said managers were taking the data breach "very seriously" and apologised for the error.

He said: "Regretfully, during the transfer of records this year, a list of 425 pupil names, dates of birth, address and schools has been misplaced. The records do not include any health information. [...]"
A spokesman for the information commissioner said the office would assess the case.
Click to expand...

guest · Oct 7, 2019

Man In Disbelief After Requesting His Medical Records From Advocate Christ Medical Center, Getting Somebody Else’s
Advocate Christ Medical Center demonstrates how NOT to respond to a HIPAA breach
October 3, 2019
https://chicago.cbslocal.com/2019/10/03/man-gets-somebody-elses-medical-records-advocate-christ/

Darnell Payne requested his medical records and got someone else’s – and now he wants to know why Advocate Christ Medical Center in Oak Lawn is giving him the runaround.

When CBS 2 came to meet him, Payne was sitting in front of a complete medical history that was not his.

“I just want to make sure that this don’t happen to nobody else!” Payne said.
“If I have someone else’s records, who has mine?” Payne said.
And when he followed up on the error, re-requesting his own documents? The hospital sent him a bill.
But when we talked to Payne on Thursday afternoon, he said: “To this day I still haven’t heard from Christ, I still have not heard from Christ – even with messages, emails, contacting their managers, supervisors – no one has gotten back to me.”
Click to expand...

guest · Oct 7, 2019

CHI Health says ransomware incident may have exposed info of patients at orthopedic clinic
October 7, 2019
https://www.omaha.com/livewellnebra...cle_f59a56f7-f789-55bb-a6ae-9003e54d4533.html

A CHI Health clinic sent letters to patients Friday informing them that their personal information may have been exposed during a ransomware incident, according to a statement from CHI Health.

CHI Health’s orthopedic clinic at Lakeside Hospital, 16909 Lakeside Hills Court, found on Aug. 1 that a database containing electronic health records had been locked by ransomware, a sophisticated software that blocks access to a computer system or data.
The clinic said the incident was limited to an older electronic health record system that contains old records and patient information for some patients who were seen at Lakeside Orthopedic Clinic PC before April 2016.

The information could include patients’ names, dates of birth, Social Security numbers, phone numbers, address and medical information, including diagnosis and treatment.
Click to expand...

guest · Oct 7, 2019

‘It just makes me sick’: Shuswap patient receives someone else’s medical records
October 6, 2019
https://globalnews.ca/news/5997925/healthcare-privacy-breach/

A Shuswap woman was stunned when her husband received an envelope from Interior Health with somebody else’s medical records inside.

Johnston said her husband had been waiting for a specialist’s referral and needed to fill out some forms.

“It looks like somebody’s taken another person’s file and stapled it to the cover letter for my husband,” she said.
“Including date of birth, address, medications for whatever ailments this person is suffering from, a lot of personal information,” she said. “It’s seven pages altogether.”
Interior Health refused to do an interview but sent an email saying there have been 22 confirmed privacy breaches in the first six months of this fiscal year.

“As with any people-based system, errors can occur – our priority is to work with our staff on an ongoing basis to avoid this from happening,” Hardt said.
Click to expand...

guest · Oct 8, 2019

Records of 650 patients on missing computer hard drive: Alberta Health Services (AHS)
October 8, 2019
https://www.660citynews.com/2019/10/08/records-of-650-patients-on-missing-computer-hard-drive-ahs/

Alberta Health Services (AHS) says a computer hard drive that contained the personal health information of about 650 patients has been missing since August.
The agency says the external drive vanished from a cardiac outpatient clinical lab at the Mazankowski Alberta Heart Institute in Edmonton.

It says the disappearance could be linked to a theft at the lab on Aug. 5, a holiday Monday, but the drive wasn’t discovered missing until a few weeks later.
The external drive was not encrypted, as mandatory, and did not have password protection.
AHS says information includes patient names, gender, dates of birth, physician names and medical record numbers.
Click to expand...

ronjor · Oct 8, 2019

UT Austin launches first ever healthcare cybersecurity leadership program in the US

by Macy Bayern October 8, 2019
With the shortage of cybersecurity professionals in the US, UT's program aims to develop individuals who can mitigate security risks in healthcare.
Click to expand...

guest · Oct 8, 2019

Health Data Breach Tally: Ransomware Proliferates
Here's An Update on Additions to the 'Wall of Shame'
October 8, 2019
https://www.inforisktoday.com/health-data-breach-tally-ransomware-proliferates-a-13222

Ransomware attacks are among the largest incidents added to the federal tally of major health data breaches in recent weeks. Attacks on a variety of clinics affected a total of more than 1 million individuals.

A Tuesday snapshot of the U.S. Department of Health and Human Services' HIPAA Breach Reporting Tool website shows 371 breaches affecting a total of more than 39 million individuals have been added to the tally so far this year.
Of those, 229 breaches - or about 62 percent - were reported as "hacking/IT incidents." Those incidents affected a total of about 34 million individuals, or the vast majority of victims of the breaches added to the tally this year.

Some 2,926 breaches affecting more than 231 million individuals have been posted on the HHS health data breach website since 2009. Commonly called the "wall of shame," the website lists breaches affecting 500 or more individuals.
Ransomware Attacks Surge
Click to expand...

guest · Oct 9, 2019

Intimate Details on Healthcare Workers Exposed as Cloud Security Lags
October 8, 2019
https://threatpost.com/intimate-details-healthcare-workers-exposed-cloud-security/149007/

Yet another non-password protected cloud database has come to light, this time exposing a raft of highly personal information on healthcare workers and traveling nurses – including drug tests and arrest records. The incident showcases the unfortunate reality that cloud data security remains a persistent challenge for businesses of all kinds.

Jeremiah Fowler, a researcher at Security Discovery, found the database, which he said contains 957,000 records from Freedom Healthcare Staffing in Aurora, Colo. Included was “intimate” details on employees, various internal communications, job seeker and recruiter data, IP addresses, ports, pathways and storage data that cybercriminals could exploit to move deeper into the network.

“In a sampling of the documents I read for verification purposes, I saw failed drug tests (without prescriptions for those drugs), a nurse being accused of taking a patient’s painkillers, complaints about a hospital’s illegal interference in nurses trying to unionize and many more complicated situations,” he wrote in a posting on Tuesday.
Click to expand...

Security Discovery: Freedom Healthcare Staffing Exposed Nearly a Million Records Online

guest · Oct 9, 2019

68,000 Patients of Methodist Hospitals Impacted by Phishing Attack
October 9, 2019
https://www.hipaajournal.com/68000-patients-of-methodist-hospitals-impacted-by-phishing-attack/

In June 2019, Gary, Indiana-based Methodist Hospitals discovered an unauthorized individual had gained access to the email account of one of its employees following the detection of suspicious activity in the employee’s email account.
The investigation revealed two email accounts had been compromised as a result of employees responding to phishing emails.

The types of information potentially compromised in the phishing attacks varied from patient to patient. In addition to patient names, the following information may have been compromised: Address, date of birth, Social Security number, driver’s license number, state ID number, passport number, medical record number, [...]
Methodist Hospitals is reviewing its policies and procedures and will be implementing additional safeguards to improve defenses against phishing attacks in the future.
Click to expand...

guest · Oct 9, 2019

Patient’s claim her x-rays were wrongly shared reinstated
October 8, 2019
https://www.theindianalawyer.com/articles/patients-claim-her-x-rays-were-wrongly-shared-reinstated

A Lake County woman whose medical records were unknowingly shared with her employer by a Community Hospital worker in Munster who took her x-rays has won a reversal of her dismissed complaint against the hospital.

The appellate court reversed in Amanda Henry v. Community Healthcare System Community Hospital, 19A-CT-01256, noting an “age-old recognition that medical providers owe a duty of confidentiality to their patients.”

“Having found that a common law duty exists, we have little trouble agreeing with a sister court that ‘HIPAA and its implementing regulations may be utilized to inform the standard of care’ in tort claims related to alleged breaches of the duty of confidentiality owed by medical providers to their patients,” Baker continued, citing to a Connecticut Supreme Court ruling.
Click to expand...

guest · Oct 9, 2019

mood said: ↑

Ransomware attack still causing problems at Wyoming hospital
September 23, 2019
https://www.miamiherald.com/news/article235390757.html
Click to expand...

Campbell County Health Ransomware Update

Campbell County Health was forced into downtime procedures at the end of September after a ransomware attack crippled its computer system. Patient care was disrupted, outpatient labs were unable to operate, and some surgeries were canceled.

By October 7, all CCH providers, clinics, lab, and radiology were back to fully functioning. The clinics and other care areas were calling patients who needed to reschedule appointments.
However, CCH respiratory therapy and its Sleep Center remain closed more than two weeks after the intial cyberattack.
Click to expand...

guest · Oct 11, 2019

Prairieville pediatrics clinic working with FBI, notifying patients after computer attack
October 10, 2019
https://www.theadvocate.com/baton_r...cle_b6194b7a-eba2-11e9-a388-5b6eedc7c596.html

A pediatrics practice in Prairieville is working with the FBI and has notified its patients' families of a ransomware virus that in August attacked the computer network of the information technology company that provides IT services for the clinic.

A ransomware virus stops users from getting into their computer system and demands a payment before they can get back in.

"It hit our IT company and came in through their system into ours," said Lisa Hamner, the office administrator for Magnolia Pediatrics on Commerce Centre Drive.
The patient data that was encrypted from Magnolia Pediatrics included names, dates of birth, Social Security numbers, addresses, phone numbers, insurance information, medical record numbers and other clinical information that includes the names of treating physicians, diagnoses, lab results and medication, the clinic said.
Click to expand...

guest · Oct 11, 2019

mood said: ↑

DCH Healthcare Systems pays hacker to end ransomware attack
October 6, 2019
https://www.apr.org/post/dch-healthcare-systems-pays-hacker-end-ransomware-attack

Report: Alabama hospitals pay hackers in ransomware attack
Click to expand...

Hospitals Resume Accepting Patients After Malware Attack
October 11, 2019
https://www.securityweek.com/hospitals-resume-accepting-patients-after-malware-attack

The DCH Health System said its hospitals in the west Alabama cities of Tuscaloosa, Northport and Fayette resumed admitting patients Thursday, and its imaging and patient scheduling services were going back online Friday.
The company hasn't said how much ransom it paid to regain control of its systems, but an executive said insurance covered the cost.

"We had to gain access to our system quickly and gain the information it was blocking," chief operating officer Paul Betz told a news conference. "As time goes by, and we determine the full impact of this, we will be very grateful we had cyber insurance in place."
A statement from the system said workers were still restoring some nonessential systems including email and were trying to get programs operating at full speed.
Click to expand...

ronjor · Oct 11, 2019

MITA Releases National Standard for Medical Device Security

October 11, 2019
The Medical Imaging & Technology Alliance (MITA) announced the publication of a voluntary standard that supports security risk management within healthcare organizations by providing standardized information on security control features integrated within medical devices.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Useful Searches