Why Healthcare Security Matters

guest · Jan 31, 2020

Wheat Ridge clinic reports potential breach of 1,300 patients’ information following burglary
January 30, 2020
https://kdvr.com/2020/01/30/wheat-r...1300-patients-information-following-burglary/

A local mental health clinic says 1,319 patients’ information was possibly accessed during a burglary in November 2019.

“No medical records were taken; however, the thieves had an opportunity to access the paper medical records kept there. The extent to which they accessed protected health information is thus unknown. The types of personal information potentially accessed include patient demographics and treatment information,” the Jefferson Center said in a statement.
The burglary is being investigated by Wheat Ridge police and the Jefferson Center.
The Jefferson Center says it has since improved the security of its offices.
Click to expand...

guest · Feb 1, 2020

Clinic worker pleads guilty to identity theft
January 31, 2020
https://www.dailycommercial.com/news/20200131/clinic-worker-pleads-guilty-to-identity-theft

A 49-year-old Leesburg woman pleaded guilty in the federal courthouse in Ocala Thursday to charges of aggravated identity theft and wire fraud.

Stacey Lavette Hendricks faces up to 20 years behind bars on the wire fraud charge, followed by a mandatory two-year term for identity theft, according to federal authorities.
According to a plea agreement, Hendricks worked in administration at several state medical clinics, a job that gave access to patient medical records. She sold patient information — birth dates and Social Security numbers — for cash and used the stolen identities to defraud.

A search of her home and vehicle turned up stolen identity-related information on 113 patients.
Click to expand...

DoJ: Medical Clinic Worker Pleads Guilty To Aggravated Identity Theft And Wire Fraud

guest · Feb 2, 2020

United Healthcare reports breach affecting undisclosed number of SC customers
January 31, 2020
https://www.postandcourier.com/busi...cle_30a42b9c-446a-11ea-b592-3f73018788bf.html

United Healthcare customers in South Carolina may have seen their private information exposed in a data breach that happened last year, the company said in a disclosure Friday.

First and last names, health plan information and private medical claims data all could have been compromised, United said. The health insurance company did not disclose how many of its customers' information was exposed.
Someone without permission gained access to member health information through a health care provider's portal.

"Upon discovery, we took prompt action to investigate the matter and put additional protections in place to prevent the occurrence of similar incidents in the future," the company said in a statement.
Click to expand...

guest · Feb 4, 2020

Medtronic Patches Implanted Device, CareLink Programmer Bugs
The medical device giant has issued fixes for bugs first disclosed in 2018 and 2019
February 4, 2020
https://threatpost.com/medtronic-patches-implanted-device-carelink/152533/

Medtronic has released updates to address known vulnerabilities in its line of connected medical devices that were initially disclosed last year and in 2018.

The vendor has addressed two sets of bugs. The first group, disclosed in March of last year, is found in a range of Medtronic implanted cardiac resynchronization therapy with defibrillation (CRT-D) devices; and in multiple implantable cardioverter defibrillators (ICDs). An ICS-CERT advisory last week gives the most severe of the flaws a CVSS “critical” severity rating of 9.3.
The second group impacts the CareLink 2090 CareLink Encore 29901 programmers, and their accompanying Software Deployment Network (SDN).

For both groups of bugs, to date, Medtronic said that “no cyberattack, privacy breach, or patient harm has been observed or associated with these vulnerabilities.”
Click to expand...

guest · Feb 5, 2020

Malware Attack 'Damages' Patient Records
Orthopedic Clinic in Houston Tight-Lipped About Malware Attack Details
February 5, 2020
https://www.databreachtoday.com/malware-attack-damages-patient-records-a-13690

A Texas orthopedic practice says a recent malware attack "permanently damaged" thousands of electronic patient records. It's the latest in a string of healthcare incidents in which various forms of malware rendered records inaccessible.

In a statement posted on its website, Houston-based Fondren Orthopedic Group says a malware incident that occurred on Nov. 21, 2019, affected "certain parts" of the practice's information systems.
The group practice says the malware attack "damaged" some of the medical records in its systems, affecting current and former patients of one of its physicians, K. Mathew Warnock, M.D.

The Department of Health and Human Services' HIPAA Breach Reporting website shows that Fondren Orthopedic Group reported the incident on Jan. 17 as a hacking/IT incident affecting more than 30,000 individuals.
In its statement, Fondren Orthopedic Group does not specify whether ransomware was involved in the incident.
Click to expand...

guest · Feb 5, 2020

Medicaid CCO Vendor Breach Exposes Health, Personal Info of 654K
February 5, 2020
https://www.bleepingcomputer.com/ne...-breach-exposes-health-personal-info-of-654k/

Medicaid coordinated care organization (CCO) Health Share of Oregon today disclosed a data breach exposing the health and personal info of 654,362 individuals following the theft of a laptop owned by its transportation vendor GridWorks IC.

The non-profit organization is Oregon's largest Medicaid CCO and it serves the Oregon Health Plan (Medicaid) members in Clackamas, Multnomah, and Washington counties.

"On January 2, 2020, Health Share of Oregon learned that the personal information of its members was located on a laptop stolen from GridWorks IC, Health Share's contracted non-emergent medical transportation (Ride to Care) vendor," says the CCO in a statement issued today.
Data breach exposes personal and health information
The stolen laptop includes several types of member information including members' names, addresses, phone numbers, dates of birth, Social Security numbers, and Medicaid ID numbers.
Click to expand...

Health Share of Oregon transportation vendor, GridWorks, confirms data breach

guest · Feb 6, 2020

One in three NHS computers still running Windows 7
NHS plans to upgrade its PCs before Microsoft's extended support period ends
February 5, 2020
https://www.techradar.com/news/one-in-three-nhs-computers-still-running-windows-7

Despite the government's target of upgrading all PCs and laptops to Windows 10 by January of this year, close to half a million NHS computers are still running Windows 7.

Back in April 2018, the UK's Department of Health and Social Care signed a deal with Microsoft which allowed NHS organizations to upgrade to Windows 10 for free.
That deadline has come and gone but according to government figures, at least a third of NHS PCs are still running Windows 7.

In a statement, NHS Digital explained that its remaining devices running Windows 7 will be upgrade before Microsoft's extended support period comes to an end in 2021, saying:

"[...] We are working closely with the NHS to offer support to migrate to Windows 10 and are on target to complete this before the extended support period ends."
Click to expand...

guest · Feb 6, 2020

mood said: ↑

Medicaid CCO Vendor Breach Exposes Health, Personal Info of 654K
February 5, 2020
https://www.bleepingcomputer.com/ne...-breach-exposes-health-personal-info-of-654k/

Health Share of Oregon transportation vendor, GridWorks, confirms data breach
Click to expand...

Breach Report: Sometimes, Encryption Is Still Overlooked
Stolen Laptop Contained Patient Data on Thousands
February 6, 2020
https://www.databreachtoday.com/breach-report-sometimes-encryption-still-overlooked-a-13696

In the first years following implementation of the HIPAA Breach Notification Rule in 2009, incidents involving lost or stolen unencrypted devices dominated the health data breach tally. But in recent years, such cases have been relatively rare.
This week, however, a Medicaid coordinated care organization in Oregon reported the theft of an unencrypted laptop containing information on more than 654,000 of its members, offering a stark reminder that after all these years, encryption sometimes is still overlooked.
Major Breach
If HHS' Office for Civil Rights confirms the details of the incident and posts it on its website, it will be the seventh largest breach since 2009 involving a lost or stolen unencrypted computing device. It also would be the largest breach of its kind reported since 2014.
If an encrypted device containing patient data is lost or stolen, that's not considered a reportable breach under HIPAA as well as many state breach reporting rules.
Click to expand...

Vendor Risks
In statements posted on GridWorks' website, the transportation firm indicates that it has been struggling financially for about two years and has been under court appointed receivership since Dec. 18.

"This is a discouraging breach, since it seems as though it could easily have been avoided by applying common security controls."
—Kate Borten, The Marblehead Group
Click to expand...

ronjor · Feb 9, 2020

Why is the healthcare industry still so bad at cybersecurity?

Yael Grauer - 2/9/2020
This demanded a cross-industry summit—so now medical, security pros attend CyberMed.
Click to expand...

guest · Feb 10, 2020

mood said: ↑

Nearly 200,000 Patients Impacted by PIH Health Phishing Attack
January 24, 2020
https://www.hipaajournal.com/nearly-200000-patients-impacted-by-pih-health-phishing-attack/
PIH Health: Notification of Data Security Incident
Click to expand...

Law Firms Race to File Phishing Breach Lawsuits
February 10, 2020
https://www.databreachtoday.com/law-firms-race-to-file-phishing-breach-lawsuits-a-13707

Several law firms are racing to be among the first to file class action lawsuits against PIH Health in the wake of the California-based regional healthcare network reporting last month that a 2019 phishing breach affected nearly 200,000 individuals.

Since Jan. 30, at least three law firms have issued public statements announcing they are "investigating" the data breach reported on Jan. 10 by PIH Health and inviting victims of the incident to contact the firms with information about the impact.
PIH Health and the three law firms issuing statements did not immediately responded to Information Security Media Group's requests for comment.

In its Jan. 30 statement, Oklahoma City-based Federman & Sherwood, said it was investigating the PIH Health breach because "malicious actors often target healthcare companies, such as PIH Health, to obtain patients' sensitive heath and personal information, which can be used to commit identity theft, blackmail and other crimes against patients."
After large data breaches, Hales says, many law firms race to quickly file lawsuits.
Click to expand...

ronjor · Feb 11, 2020

Google Health, the company’s newest product area, has ballooned to more than 500 employees

Christina Farr@chrissyfarr Feb 11 2020
More than 500 people now work at Google Health, mostly out of the Palo Alto offices formerly occupied by smart home group Nest.
It’s led by former Geisinger CEO David Feinberg, who reports to Google AI chief Jeff Dean, and key players include Google veteran Paul Muret, who runs product, and Chief Health Officer Karen DeSalvo.
Former Nest CTO Yoky Matsuoka, who oversaw a small team under Feinberg looking at home-health monitoring, has left the company.
Click to expand...

guest · Feb 12, 2020

Exposure of PHI at Drug and Alcohol Addiction Rehabilitation Center
January 27, 2020
https://www.jdsupra.com/legalnews/exposure-of-phi-at-drug-and-alcohol-96796/

Sunshine Behavioral Health, LLC, is a network of drug and alcohol addiction rehabilitation centers based in San Juan Capistrano, California. According to Dissent of the website databreaches.net, an AWS (Amazon Web Services) S3 storage bucket has been misconfigured. The misconfiguration, notes Dissent, resulted in online exposure of PHI.
Amazon S3 buckets are public cloud storage resources. These buckets, which are essentially the online equivalent of file folders, store objects that consist of data and its descriptive metadata.

In the case of Sunshine Behavioral Health, after the initial report to databreaches.net, Sunshine Behavioral Health was contacted. As a result, in August of 2019, Sunshine secured the buckets, by limiting access controls.
Moreover, Dissent followed up on the breach in November of 2019, and discovered that files were still exposed.

Since then, Dissent attempted to contact Sunshine Behavioral Health, but did not receive a reply.
Click to expand...

guest · Feb 12, 2020

Hospital Sisters Health System Email Breach Impacts 16,167 Patients
February 12, 2020
https://www.hipaajournal.com/hospital-sisters-health-system-email-breach-impacts-16167-patients/

Hospital Sisters Health System has recently discovered an email security breach in August 2019 potentially resulted in unauthorized individuals gaining access to access emails and email attachments containing the protected health information of 16,167 patients.

On December 2, 2019, Hospital Sisters Health System was informed that patient information had potentially been accessed by the attackers. The compromised email accounts were found to contain patient names, birth dates, and a limited amount of clinical information. Some patients also had their health insurance information, Social Security number, and/or driver’s license number exposed.
Hospital Sisters Health System has already taken steps to improve email security to prevent similar breaches from occurring in the future.
Click to expand...

guest · Feb 13, 2020

After Malware Attack, Doctor Network Has Widespread Outage
Electronic Health Records System Inaccessible
February 13, 2020
https://www.databreachtoday.com/after-malware-attack-doctor-network-has-widespread-outage-a-13720

Hundreds of pediatric healthcare providers in Massachusetts were still unable to access their electronic health records systems Thursday after a malware attack earlier this week targeted a large physician network affiliated with Boston Children's Hospital.
The system outage affecting Brookline, Mass.-based Pediatric Physicians Organization at Children's started on Tuesday; the malware attack was discovered on Monday afternoon.

A hospital spokeswoman tells Information Security Media Group that the malware attack did not involve ransomware and it did not affect the hospital's systems.

"The PPOC is a separate network of more than 500 primary care pediatricians, nurse practitioners and physician assistants across Massachusetts affiliated with Boston Children's," the spokeswoman says.
PPOC uses an electronic health record platform from Epic Systems Corp.

" Since Monday, the electronic medical record system that we use to schedule appointments and manage our patients' medical information has been offline as the result of a malware attack," says a statement on the website of Chestnut Hill Pediatrics.
Click to expand...

Back to Paper
Roslindale Pediatrics, another affected PPOC practice, notes on its website: "We are still trying to make appointments and taking messages over the phone and using pen and paper to see our patients."
Gaining a Foothold
Some security experts note that the situation illustrates the widespread threat a malware attack can pose to healthcare entities.

"If an attacker can gain a foothold in one segment of a larger, interconnected healthcare provider network, it can potentially result in the compromise of other networks. This depends on several variables," says Luke Willadsen, security consultant at cybersecurity services firm EmberSec.
Click to expand...

guest · Feb 14, 2020

Plastic surgery images and invoices leak from unsecured database
The images, many of them graphic, came from a French imaging company called NextMotion
February 13, 2020
https://www.cnet.com/news/plastic-surgery-images-and-invoices-leak-from-unsecured-database/

Thousands of images, videos and records pertaining to plastic surgery patients were left on an unsecured database where they could be viewed by anyone with the right IP address, researchers said Friday. The data included about 900,000 records, which researchers say could belong to thousands of different patients.

The data was generated at clinics around the world using software made by French imaging company NextMotion. Images in the database included before-and-after photos of cosmetic procedures.
Rotem said he sees exposed health care databases all too often as part of his web-mapping project, which looks for exposed data.

"The state of privacy protection, especially in health care, is really abysmal," Rotem said.
NextMotion, which says on its website that it has 170 clinics as customers in 35 countries, said in a statement to its clients that it had addressed the problem."We immediately took corrective steps and this same company formally guaranteed that the security flaw had completely disappeared," said NextMotion CEO Emmanuel Elard in the statement.
Click to expand...

vpnMentor: Report: 1,000s of Plastic Surgery Patients Exposed in Massive Data Leak

guest · Feb 14, 2020

Patients records from NI hospital found on public road
February 13, 2020
https://www.newsletter.co.uk/news/people/patients-records-ni-hospital-found-public-road-1557560

Shocked by the level of detail on the paper, which is dated January 17, 2020, the man contacted the Portadown Times and handed over the document.
It outlined in detail the patient, their age, social history as well as a brief medical history and why they had been admitted to hospital.

A spokesperson for the Southern Health Trust, which oversees Craigavon Hospital, admitted that confidential documents such as this should not have left the hospital site.
“We will be reviewing our procedures to ensure that information about patients is stored safely at all times and these breaches are avoided in future.”
Click to expand...

guest · Feb 14, 2020

Report Reveals Worst State for Healthcare Data Breaches in 2019
February 14, 2020
https://www.infosecurity-magazine.com/news/report-healthcare-data-breaches-in/

A report into the spate of data breaches that ripped through America's healthcare industry last year has revealed that more breaches happened in Texas than in any other state.

The "2019 Healthcare Data Breach Report" published yesterday by HIPAA Journal shows that healthcare data breaches involving the exposure of 500 or more records occurred in every state with the exception of North Dakota and Hawaii. The Lone Star State was the worst hit, with 60 breaches recorded, followed by California, which suffered 42.

The report found that 510 healthcare data breaches in which 500 or more records were exposed were reported in 2019, representing a 37.4% increase over the 371 such breaches reported in 2018. The total number of patient records exposed shot up from 13,947,909 in 2018 to 41,335,889 in 2019.
Shockingly, the report disclosed that in 2019 alone, the healthcare records of 12.55% of the population of the United States were exposed, impermissibly disclosed, or stolen.
Click to expand...

guest · Feb 14, 2020

Class action lawsuit filed against two Puerto Rican hospitals for alleged ransomware attacks
February 13, 2020
https://www.cyberscoop.com/hospital-pavia-class-action-lawsuit-ransomware/

A class action lawsuit was filed earlier this week in the U.S. District Court for the District of Puerto Rico against two hospitals for what plaintiffs are calling “reckless and negligent violation of patient privacy rights” in light of alleged ransomware attacks that hit the hospitals last year.

The alleged ransomware attacks, which took place in February last year at the Pavía Hospital Santurce and Pavía Hospital Hato Rey hospitals, affected 305,737 people, according to Department of Health and Human Services records.
The plaintiffs, both former patients of the hospitals, allege patients’ personal identifying information, including full names, addresses, dates of birth, gender, financial information, and social security numbers, were exposed as a result of the attacks.

“These patients reasonably expect the highest level of protection for their private identifiable information, when giving highly sensitive information such as their Social Security numbers and medical information to medical providers and insurers,” the complaint says.
The hospitals failed to properly protect victims’ PII, the complaint claims.
Click to expand...

Puerto Rico Hospital Operators Hit with Class Action Over February 2019 Data Breach

Minimalist · Feb 16, 2020

Our personal health history is too valuable to be harvested by the tech giants

Health data paints a rich picture of our lives. Even if you remove your name, date of birth and NHS number to “anonymise” yourself, a full health history will reveal your age, gender, the places where you have lived, your family relationships and aspects of your lifestyle.
Click to expand...

https://www.theguardian.com/comment...s-too-valuable-to-be-harvested-by-tech-giants

guest · Feb 18, 2020

mood said: ↑

Phishing Attack Aimed at Stealing Payroll Deposits
Healthcare System's Procedures Helped Prevent the Crime
July 19, 2019
https://www.databreachtoday.com/phishing-attack-aimed-at-stealing-payroll-deposits-a-12804
Click to expand...

Wise Health System Notifies 66,934 Patients of Phishing Attack
February 18, 2020
https://www.hipaajournal.com/wise-health-system-notifies-66934-patients-of-phishing-attack/

Wise Health System in Decatur, TX, is notifying 66,934 patients that some of their protected health information was potentially compromised in a phishing attack that occurred on March 14, 2019.

Wise Health System previously reported the phishing attack to the Department of Health and Human Services’ Office for Civil Rights on July 13, 2019 as having affected 35,899 individuals. That total has now been updated following the completion of a data audit. The data audit commenced in June 2019 and has only just been completed. New notifications started to be sent to affected patients on February 13, 2020.

Following the breach, Wise Health System implemented measures to improve its cybersecurity posture.
Click to expand...

guest · Feb 18, 2020

Data breach leads to unauthorized access to information for 7,500 patients, Iowa health care company says
February 17, 2020
https://eu.desmoinesregister.com/st...ital-patients-data-breach-victims/4790481002/

More than 7,000 patients of a south-central Iowa medical system have been notified that their personal information may have been leaked in a data breach.

Monroe County Hospital & Clinics said in a news release Monday that approximately 7,500 people were notified that the breach may have led to unauthorized access of their individual health information.
Officials learned that "one or more unauthorized individuals" outside the health care organization had access to several employees’ email accounts between Oct. 28, 2019, and Jan. 20, 2020.

As a result of the breach, all MCHC employees had to reset their email account passwords and undergo new cybersecurity training.
Officials notified patients by mail, the release states.
Click to expand...

Monroe County Hospital & Clinics: Notice Regarding Recent Security Incident

guest · Feb 18, 2020

Breached Patient Records Tripled in 2019 as Malicious Actors Create New Problems for Patients
Another year of increased health data breaches, with over 40 million affected patient records
February 18, 2020
https://www.prnewswire.com/news-rel...eate-new-problems-for-patients-301003328.html

Over 40 million patient records were breached in 2019, according to new data released today in the Protenus Breach Barometer®. Published by Protenus, a healthcare compliance analytics platform that protects patient data for the nation's leading health systems, the Breach Barometer is the industry's definitive source for health data breach reporting.

There has been a continuous increase in the number of health data breaches since the first Breach Barometer report. In 2016, the healthcare industry suffered 450 incidents, and it has steadily increased to 572 in 2019. The number of affected patient records almost tripled from 15 million in 2018 to 41 million in 2019. Also first reported in 2016, a trend of at least one health data breach per day remains.
The single largest breach reported in 2019 was the result of the hacking of a Business Associate (BA). It involved one of the country's largest patient collections recovery agencies that had its patient information accessed by an unauthorized party.
Click to expand...

To download the full report, or for more information, please visit:
https://www.protenus.com/resources/2020-breach-barometer
Click to expand...

guest · Feb 18, 2020

mood said: ↑

NCH Healthcare System faces email phishing attack; hires investigator
August 15, 2019
https://eu.naplesnews.com/story/new...email-phishing-attack-warns-staff/2012539001/
Click to expand...

NCH Healthcare (finally) sends breach notification letters for June, 2019 breach
Third Party Forensic Investigators Conclude Their Investigation into the June 2019 Data Incident at NCH
February 17, 2020
https://www.prnewswire.com/news-rel...june-2019-data-incident-at-nch-301005422.html

Cybersecurity specialists hired by NCH recently wrapped up their investigation into an email phishing attack against NCH.

On or around June 14, 2019, NCH became aware of suspicious activity related to its human resources, timekeeping, and payroll system. NCH immediately launched an investigation into this suspicious activity and determined that certain employees fell victim to an email phishing scheme that allowed an unauthorized actor (hacker) to gain access to the employee's payroll records as well as their email accounts.
Importantly, NCH patient medical record systems were not affected by this incident, and the sole purpose of the attack appears to have been to reroute direct deposit payroll funds; however, the stolen credentials would have allowed access to employee email accounts.

On February 14, 2020, NCH began mailing notice letters to individuals whose information may have been present in the affected accounts.
Click to expand...

guest · Feb 18, 2020

mood said: ↑

Hackensack Meridian: We paid ransom to hackers to stop hospital cyber-attack
December 13, 2019
https://eu.app.com/story/news/healt...om-hackers-cyber-attack-hospitals/2638701001/
Click to expand...

Lawsuit Filed in Wake of Ransomware Attack
Patients Seek Damages, Citing Impact of Security Incident in New Jersey
February 18, 2020
https://www.databreachtoday.com/lawsuit-filed-in-wake-ransomware-attack-a-13736

A lawsuit seeking class action status has been filed against a New Jersey healthcare organization in the wake of a ransomware attack last December in which the entity paid attackers a ransom to unlock its systems.

The ransomware attack on Dec. 2, 2019, brought down the organization's computer network for two days, "leaving hospitals in the HMH network to reschedule non-emergency surgeries and doctors and nurses scrambling to deliver care without access to electronic records," the lawsuit states.
Because of the ransomware attack, patients had their medical care and treatment disrupted, the complaint alleges.

"As a consequence of the ransomware locking down the medical records ... plaintiffs and class members had to, among other things, forego medical care and treatment or had to seek alternative care and treatment," the lawsuit alleges.
Click to expand...

ronjor · Feb 19, 2020

Why fixing security vulnerabilities in medical devices, IoT is so hard

Mitch Parker - 2/19/2020
Op-ed: It's not so easy to just patch or upgrade medical devices, IU Health's CISO explains.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

Useful Searches