Why Healthcare Security Matters

ronjor · Feb 19, 2020

Over 27 million affected by healthcare data breaches last year

By Ian Barker 19 Feb 2020
Cloud security company Bitglass has released its latest healthcare breach report analyzing data from the US Department of Health and Human Services.
Around 24 million people were affected by healthcare breaches due to hacking and IT incidents last year. This category was followed by unauthorized access or disclosure, which affected 2.5 million people.
Click to expand...

guest · Feb 19, 2020

Medical Devices Intro Major Bluekeep Risk to Hospitals
February 19, 2020
https://www.infosecurity-magazine.com/news/medical-devices-major-bluekeep

Medical devices represent a major risk to healthcare organizations (HCOs), and are twice as likely as standard network devices to be vulnerable to Bluekeep, according to CyberMDX.
The security vendor’s 2020 Healthcare Security Vision Report claimed that a third (30%) of US HCOs have experienced a cyber-attack in the past 12 months.

Connected devices are an increasing source of risk, as many are left unpatched and unmanaged, the report claimed. For example, 55% of imaging devices run unpatched or outdated Windows versions which could leave them vulnerable to Bluekeep.
CyberMDX uncovered a range of security issues among HCOs, claiming that 11% don’t patch devices at all, and that a typical hospital will have patched only 40% or fewer vulnerable devices four months after a bug disclosure.

There’s more: a quarter (25%) don’t possess a full inventory of connected devices, while a further 13% admit theirs is unreliable.
Click to expand...

guest · Feb 19, 2020

Maroof International Hospital Hit with Severe Ransomware Attack
February 19, 2020
https://propakistani.pk/2020/02/19/...oof-hospital-pushes-it-back-to-the-dark-ages/

Maroof International Hospital Islamabad’s entire computer network has been compromised in the wake of a massive ransomware attack.
Maroof is one of the most expensive private hospitals in Islamabad.

“But thankfully we had a disaster recovery facility available, and the process for recovery of data is already on its way”, said Muhammad Sohail, head of MIS and Communications at Maroof Hospital.
The attack brought the hospital’s internal operations to a complete halt.
Moreover, the entire Radiology and Laboratory department of the hospital was also crippled.

As per our sources, Maroof Hospital was using the Hospital Information System (HIS) for digitally storing and organizing medical records, developed by the Shaukat Khanum Memorial Hospital (SKMH).
This incident goes on to show the importance of data security in these modern times.
Click to expand...

guest · Feb 19, 2020

Health Data Breach Tally Update: 2020 Trends
Email-Related Incidents Continue to Dominate, But Other Breaches Still Popping Up
February 19, 2020
https://www.inforisktoday.com/health-data-breach-tally-update-2020-trends-a-13742

Hacking incidents involving email appear to be the most common type of major health data breach being reported to federal regulators so far in 2020. But the largest breach added to the tally involved a type of incident rarely seen in recent years: the theft of an unencrypted laptop.

A snapshot Wednesday of the Department of Health and Human Services' HIPAA Breach Reporting Tool shows that so far in 2020, 38 health data breaches affecting a total of about 1.1 million individuals have been added to the official tally.
Since 2009, 3,102 breaches affecting a total of nearly 233.6 million individuals have been posted on the federal tally.

But the biggest breach added to the tally involved the theft of an unencrypted laptop from GridWorks, a former medical transportation vendor of Health Share of Oregon. That breach affected nearly 655,000 individuals.
Click to expand...

guest · Feb 20, 2020

Data breach connected to Capital Region’s Community Care Physicians reported
February 19, 2020
https://dailygazette.com/article/2020/02/19/data-breach-community-Care-physicians

A data breach at an accounting firm has potentially exposed the personal data of patients at the largest independent medical practice in the Capital Region.

Some of the 370,000 patients of Community Care Physicians got letters Tuesday from BST & Co. CPAs about the matter. Community Care followed up Wednesday with notices to patients about the situation and how best to respond.
Neither BST or Community Care would say how many people are potentially affected. Community Care said it was not all 370,000 patients, but was more than the 500-person threshold for mandated reporting under federal healthcare privacy rules.

In a prepared statement Wednesday, Community Care Corporate Compliance Officer Mackensie Greene said there have been no known adverse effects on patients in the 10 weeks since the breach.
Click to expand...

guest · Feb 20, 2020

UW Medicine patients fearful after health information leaked
February 19, 2020
https://www.kiro7.com/news/tonight-...nformation-leaked/TPTTBFVMVVE7RBLTVSI4ALL5QA/

Imagine that your most private medical information is suddenly available worldwide on the internet.
That’s what happened to nearly a million UW Medicine patients, including a man who recently spoke with KIRO 7 on the condition his identity would be protected.

The huge data breach -- one of the largest in state history – occurred because of human error and was first reported by KIRO 7 in February of 2019. Because of the breach, private medical files were available online – in Excel spreadsheets -- for nearly three weeks.
The breach has now led to a class-action lawsuit that could eventually represent all 974,000 patients whose names and personal health information were compromised.

KIRO 7's February 2019 interview with Flory is detailed in the class action lawsuit as alleged evidence UW Medicine's "database had been accessed by other third parties, and that the exposed data included patient information related to HIV."
“There are still stigmas attached to an HIV test, whether it be drug habits, sexual orientation, which is no one’s business.”
Click to expand...

guest · Feb 21, 2020

NRC Health Ransomware Attack Prompts Patient Data Concerns
February 21, 2020
https://www.darkreading.com/attacks...-prompts-patient-data-concerns/d/d-id/1337116

A Feb. 11 ransomware attack targeting NRC Health has driven concerns about the security of patient data stored on the organization's servers. NRC Health manages patient survey systems and works with 75% of the 200 largest hospital chains in the United States, CNBC reports.

The incident has caused concern due to the vast amount of patient information NRC Health has on its servers. Its customers include 9,000 healthcare institutions including Cedars Sinai and Jefferson Health, and it stores data from more than 25 million healthcare consumers each year.
So far there is no indication of whether the attackers were able to view or steal confidential or patient data.
Click to expand...

CNBC: Cyberattack on NRC Health sparks privacy concerns about private patient records stored by US hospitals

guest · Feb 22, 2020

January 2020 Healthcare Data Breach Report
February 21, 2020
https://www.hipaajournal.com/january-2020-healthcare-data-breach-report/

In January, healthcare data breaches of 500 or more records were reported to the Department of Health and Human Services’ Office for Civil Rights at a rate of more than one a day.

As our 2019 Healthcare Data Breach Report showed, 2019 was a particularly bad year for healthcare data breaches with 510 data breaches reported by HIPAA-covered entities and their business associates. That equates to a rate of 42.5 data breaches per month. January’s figures are an improvement, with a reporting rate of 1.03 breaches per day. There was also a 15.78% decrease in reported breaches compared to December 2019.

Hacking/IT incidents continued to dominate the breach reports in January and accounted for 59.38% of all breaches reported (19 incidents). 28.13% of reported breaches were classified as unauthorized access/disclosure data breaches (9 incidents), there were two reported theft incidents, both involving physical records, and 2 cases of improper disposal of physical records.
Click to expand...

guest · Feb 25, 2020

Phishing in Healthcare: Yet Another Major Incident
'Phishing Continues to Be One of the Primary Breach Vectors in Healthcare'
February 25, 2020
https://www.inforisktoday.com/phishing-in-healthcare-yet-another-major-incident-a-13767

Yet another large phishing-related health data breach has been reported to federal regulators. This one potentially exposed the data of 109,000 patients at Bellevue, Washington-based Overlake Medical Center & Clinics.

"Phishing continues to be one of the primary breach vectors in the healthcare industry. It is cheap, effective and profitable to the cyber-criminal element," says Rich Curtiss, director of healthcare risk assurance services at security consultancy Coalfire.
Email Accounts Exposed
Within hours of Overlake Medical Center & Clinics discovering the phishing attack on Dec. 9, 2019, the organization secured the affected email accounts and immediately began an investigation, according to a recently released statement.
So far, the investigation has not determined whether third parties accessed patient information stored in the email accounts.

Healthcare organizations should conduct a risk assessment "so they can target their cybersecurity spend more efficiently and effectively and ensuring they have a tested incident response and remediation plan in place," Bell adds.
Click to expand...

guest · Feb 26, 2020

Rotherwood Healthcare AWS bucket security fail left elderly patients' DNR choices freely readable online
February 26, 2020
https://www.theregister.co.uk/2020/02/26/rotherwood_healthcare_data_leak_10k_records_aws/

A leak of 10,000 records at a Leicestershire care home provider exposed elderly patients' wishes not to be resuscitated, detailed care plans and precisely how much councils paid for individual patients' care.

Not only did Rotherwood Care Group, trading as Rotherwood Healthcare, leave an Amazon S3 bucket accessible to everyone on the internet, the company’s website privacy policy consisted solely of lorem ipsum placeholder text.
The leak came from an S3 bucket that was left unsecured.

Scans of what appeared to be staff members’ passports and birth certificates were also in the bucket, along with job interview questions and answers.
To its credit, the business closed off the bucket from public access within a day of being informed.
Click to expand...

Minimalist · Feb 26, 2020

Hackers Cashing In On Healthcare Industry Security Weaknesses

Between ransomware attacks on healthcare devices, malware-laced “medical” apps, and fraud services available on the dark net, attackers are pushing the boundaries on targeting healthcare.
Click to expand...

https://threatpost.com/hackers-cashing-in-on-healthcare-industry-security-weaknesses/

guest · Feb 27, 2020

Munson Healthcare data breach exposes PHI
February 27, 2020
https://www.scmagazine.com/home/security-news/data-breach/munson-healthcare-data-breach-exposes-phi/

The northern-Michigan based Munson Healthcare group reported several employee email accounts were hacked and being accessed for two and a half months last year exposing PHI.

The breach was discovered on January 16, 2020 and the investigation into the incident revealed the email accounts in question were being accessed by an outside source between July 31, 2019 and October 22, 2019. The accounts contained PHI that included names, dates of birth, insurance information along with treatment and diagnostic information. In some cases patient financial account numbers, driver’s license numbers and Social Security numbers were involved, Munson reported.

“This incident does not affect all patients of Munson Healthcare and not all information was included for all individuals. Munson Healthcare is now notifying affected individuals so that they can take steps to protect their information,” the healthcare system said.
Click to expand...

Munson Healthcare Notifies Patients of Data Security Incident

guest · Feb 27, 2020

Jordan Health hit by ransomware attack, shuts down computer network
February 27, 2020
https://eu.democratandchronicle.com...-network-rochester-canandaigua-ny/4891715002/

A ransomware attack has prompted Jordan Health to shut down its computer networks, a spokesperson said Thursday morning.

The nonprofit operates 9 health centers in Rochester and Canandaigua and treats upward of 30,000 patients. Those centers remain open for business and are seeing patients, but ask that patients bring their insurance card, medications, and photo ID with them.

"Jordan Health’s administrators became aware of a suspicious activity on one of its servers late yesterday afternoon," said communications director Chalonda James. "As a precaution, we shut down our entire network.
James said that patient data is maintained on a secure server, and their own analysis shows that patient data was not accessed.
Click to expand...

guest · Feb 29, 2020

LifeLabs files petition to keep cyberattack report from B.C. privacy commissioner
February 26, 2020
https://bc.ctvnews.ca/lifelabs-file...eport-from-b-c-privacy-commissioner-1.4832919

The B.C.-based laboratory testing company that was targeted in a cyberattack last fall is trying to keep the province's privacy commissioner from accessing a third-party report on the breach.

In a petition filed this month in B.C. Supreme Court, LifeLabs argued it shouldn't have to turn over a report prepared by cybersecurity firm CrowdStrike because it's protected by solicitor-client privilege.

"At all material times, CrowdStrike was using its cybersecurity expertise to assemble and explain factual information gathered from LifeLabs so that LifeLabs' counsel could obtain a full picture of the facts and give advice."
CrowdStrike's mandate, according to the petition, was to determine the extent of the cyberattack and identify vulnerabilities in LifeLabs' computer system.

LifeLabs is currently facing separate class action lawsuits related to the breach in B.C. and Ontario. The vast majority of the 15 million customers whose personal information was potentially compromised in the breach live in those two provinces.
Click to expand...

guest · Mar 2, 2020

Lawsuit Over November 2016 hack of Quest Diagnostics Settles
Quest Data Breach Class Action Settlement
March 2, 2020
https://topclassactions.com/lawsuit...ch/quest-data-breach-class-action-settlement/

A $195,000 Quest class action settlement will resolve claims that a 2016 data breach compromised the information of thousands of patients.

The settlement benefits individuals whose information was obtained by an unauthorized third party in the 2016 Quest data breach.
The Quest data breach reportedly took place in November 2016 when unauthorized users gained access to Quest Diagnostics’ MyQuest application.
As a result of the data breach, the information of around 34,000 patients was allegedly compromised.

“Despite the fact that it was storing sensitive Private Information that it knew or should have known was valuable to and vulnerable to cyber attackers, Quest and its fellow Defendants failed to take adequate measures that could have protected user’s information,” the Quest class action lawsuit alleged.
Click to expand...

guest · Mar 3, 2020

OCR Settles with Utah Provider for $100K Over HIPAA Security Failures
March 3, 2020
https://healthitsecurity.com/news/o...rovider-for-100k-over-hipaa-security-failures

The provider office of Steven Porter, MD in Ogden, Utah has settled with the Department of Health and Human Services Office for Civil Rights after failing to implement certain HIPAA security requirements. Porter will pay OCR $100,000 and must adopt a corrective action plan.

“All healthcare providers, large and small, need to take their HIPAA obligations seriously,” OCR Director Roger Severino, said in a statement. “The failure to implement basic HIPAA requirements, such as an accurate and thorough risk analysis and risk management plan, continues to be an unacceptable and disturbing trend within the healthcare industry.”
Click to expand...

HHS: Health Care Provider Pays $100,000 Settlement to OCR for Failing to Implement HIPAA Security Rule Requirements

guest · Mar 3, 2020

IT Weaknesses at the National Institutes of Health Placed EHR Data at Risk
March 3, 2020
https://www.hipaajournal.com/it-wea...institutes-of-health-placed-ehr-data-at-risk/

An audit of the National Institutes of Health (NIH) conducted by the Department of Health and Human Services’ Office of Inspector General (OIG) has revealed technology control weaknesses in the NIH electronic medical records system and IT systems that placed the protected health information of patients at risk.

CLA found NIH had implemented controls to ensure the confidentiality, integrity, and availability of health data contained in its EHR and information systems, but those measures were not working effectively.
Consequently, data in its EHR system and information systems could potentially have been accessed by unauthorized individuals and data was at risk of impermissible disclosure, disruption, modification, and destruction.
Click to expand...

guest · Mar 3, 2020

FDA warns of medical device hack vulnerability
March 3, 2020
https://www.morningstar.com/news/ma...da-warns-of-medical-device-hack-vulnerability

Certain chips used in medical devices may be vulnerable to hackers through their Bluetooth functions, the Food and Drug Administration said Tuesday. The FDA said that SweynTooth, also known as Bluetooth Low Energy, used in medical devices such as pacemakers, stimulators, blood glucose monitors and insulin pumps, is vulnerable to hackers who can use the Bluetooth function to crash or compromise the device.

Chip suppliers affected by the vulnerability include Texas Instruments Inc. (TXN), NXP Semiconductors NV (NXPI), Cypress Semiconductor Corp. (CY), Dialog Semiconductors PLC , Microchip Technology Inc. (MCHP), STMicroelectronics NV (STM.FR), and Telink Semiconductor, the FDA said.

"To date, the FDA is not aware of any confirmed adverse events related to these vulnerabilities," the agency said in a statement. "However, software to exploit these vulnerabilities in certain situations is publicly available."
Click to expand...

Minimalist · Mar 5, 2020

Security of Health Information

The world is racing to contain the new COVID-19 virus that is spreading around the globe with alarming speed. Right now, pandemic disease experts at the World Health Organization (WHO), the US Centers for Disease Control and Prevention (CDC), and other public-health agencies are gathering information to learn how and where the virus is spreading. To do so, they are using a variety of digital communications and surveillance systems. Like much of the medical infrastructure, these systems are highly vulnerable to hacking and interference.
Click to expand...

https://www.schneier.com/blog/archives/2020/03/security_of_hea.html

guest · Mar 5, 2020

mood said: ↑

UPMC Susquehanna admits employee snooped in co-worker’s medical records
November 25, 2019
https://www.pennlive.com/news/2019/...ee-snooped-in-co-workers-medical-records.html
Click to expand...

Liability claim remains against UPMC Susquehanna in medical records 'snooping ' case
March 5, 2020
https://www.pennlive.com/crime/2020...uehanna-in-medical-records-snooping-case.html

A Lycoming County judge has refused to dismiss a vicarious liability claim against UPMC Susquehanna that is being sued because an employee accessed the medical records of a co-worker without authorization.

Judge Eric R. Linhardt on Wednesday rejected UMPC’s claim it was not liable because Taylor Fausnaught failed to state any claim against Tasha Klock.
He ruled Fausnaught in her invasion of privacy and negligence suit successfully had asserted multiple claims against Klock.
Click to expand...

David F. Samar, in a letter that is part of the court file, stated the health system discovered July 2, 2018, Fausnaught’s medical information was improperly accessed as the result of “employee snooping.”
Her actions violated UPMC and federal privacy laws and she was disciplined by required to undergo additional training and increased monitoring, the letter states.

In another ruling on preliminary objections raised by the defense, Linhardt dismissed the punitive damages claim against UPMC but allowed it to stand against Klock.
Linhardt ruled in favor of UPMC dismissing three negligence claims and one under Pennsylvania Unfair Trade Practice and Consumer Protection Law.
Click to expand...

guest · Mar 5, 2020

6 Healthcare Organizations Discover PHI Has Potentially Been Compromised
March 5, 2020
https://www.hipaajournal.com/6-heal...iscover-phi-has-potentially-been-compromised/

Six possible data breaches have been reported by healthcare organizations in the past few days that may have resulted in an impermissible disclosure of patient data. 8,701 patients are known to have been affected by the breaches.
Harris Health System Notifies Patients About Potential Privacy Breach
Houston, TX-based Harris Health System has notified 2,298 patients that some of their protected health information (PHI) has been exposed.
Kaiser Permanente Alerts Patients About Mailing Error
Kaiser Permanente has discovered letters have accidentally been mailed to patients’ former addresses.
Backup Drive Containing ePHI Stolen from Elk Ridge Dentistry
The Estes Park, CO dentist practice, Elf Ridge Dentistry, has discovered a portable hard drive used to store backups was stolen from the practice. The hard drive was among several items taken from the practice. The incident was reported to law enforcement, but the hard drive has not been recovered.
Click to expand...

PHI Potentially Compromised in Break-in at Armada Physical Therapy
Armada Physical Therapy experienced a break-in around December 19, 2019 at its Menaul Clinic on Menaul Boulevard in Albuquerque, NM and a server was stolen. The theft was reported to law enforcement and the investigation is ongoing, but the stolen server has not been recovered.
Mailing Vendor Error Discovered by Riverview Health
An error at a printing and mailing vendor used by the Noblesville, IN-based healthcare provider, Riverview Health, has resulted in the exposure of the names of 2,610 patients.
Mental Health Records Found Abandoned in Chicago Street
Physical medical records from the Community Mental Health Council have been found abandoned in an alley in West Englewood, Chicago. The Community Mental Health Council permanently closed its clinics after funding was lost in 2012.
Click to expand...

guest · Mar 6, 2020

mood said: ↑

NSHA suffers privacy breach, nearly 3,000 patients possibly affected
June 10, 2019
https://globalnews.ca/news/5373338/nova-scotia-health-authority-privacy-breach/
Click to expand...

Health Authority changing security policy after probe into cyberattack
March 6, 2020
https://www.cbc.ca/news/canada/nova...following-cyberattack-investigation-1.5488663

The Nova Scotia Health Authority is reviewing its email and security policies after 2,841 patients had information about surgeries exposed during a phishing attack last year.

However, the health authority disagrees with an opinion from the office of the province's Information and Privacy Commissioner that there is a "high risk" that personal health information could be "readily transported and utilized by malicious actors."

"We're studying the recommendations," said Karen Hornberger, provincial director of privacy for the NSHA. "It's a little premature to say whether or not we're going to accept all of them at this point.
NSHA promoting anti-phishing
The NSHA is also promoting an anti-phishing campaign to all employees and updating its privacy policy. All employees must delete email messages with personal health information once the information is no longer required.
Click to expand...

guest · Mar 6, 2020

54% of healthcare vendors have experienced a data breach of protected health information
March 6, 2020
https://www.helpnetsecurity.com/2020/03/06/healthcare-vendors-data-breach/

More than half of all healthcare vendors have experienced a data breach that exposed protected health information (PHI), and it’s a costly problem that points to broken third-party risk assessment processes, according to data released by the Ponemon Institute and Censinet.

The report shows that 54 percent of healthcare vendors have experienced at least one data breach of protected health information belonging to patients of the healthcare providers they serve. Of those 54 percent of respondents, 41 percent experienced six or more data breaches over the past two years. The average breach costs $2.75 million and exposes nearly 10,000 records.

“The overall process for managing risk assessments is severely broken in healthcare,” stated Ed Gaudet, CEO and Founder of Censinet.
Many of the vendor respondents believe that healthcare providers do not fully embrace risk assessments to accurately measure and manage third-party risk.
Click to expand...

guest · Mar 8, 2020

Melbourne professor quits after health department pressures her over data breach
Vanessa Teague reported on a dataset of Medicare and PBS payments that was supposed to be anonymous but wasn’t
March 7, 2020
https://www.theguardian.com/austral...lth-department-pressures-her-over-data-breach

A prominent university professor has quit after the health department pressured her university to stop her speaking out about the Medicare and PBS history of over 2.5 million Australians being re-identifiable online due to a government bungle.

In 2016, Vanessa Teague, a cryptographer from the University of Melbourne, and two of her colleagues reported on a dataset, published on an open government data website by the federal government, of 2.5 million Australians’ Medicare and PBS payment history dating back to 1984 that had supposedly been de-identified so people were anonymous.
Teague and her colleagues reported that the dataset had several samples where people were able to be identified.

[...] the researchers had a trove of their entire medical history, including medication purchases and tests conducted.

“My strong feeling is all of the 2.5 million people should know. It can’t be rolled back now that it’s out on the internet. There are still decisions they can make that can be informed about the data that is out there.”
She said although she quit, the university was pressured by the department over her research.
Click to expand...

guest · Mar 8, 2020

Relation Insurance and Rainbow Hospice Care Experience Email Security Breaches
March 6, 2020
https://www.hipaajournal.com/relati...pice-care-experience-email-security-breaches/

Relational Insurance Inc., an insurance brokerage firm doing business as Relation Insurance Services of Georgia (RISG), experienced an email security breach in August 2019. An unauthorized individual was discovered to have gained access to the email account of an employee and potentially viewed or copied emails containing protected health information (PHI).
The account was found to contain a wide range of information, which differed from individual to individual.

Steps have been taken to improve email security and prevent similar breaches in the future. The breach report submitted to the HHS’ Office for Civil Rights indicates the PHI of up to 4,335 individuals was potentially compromised.
Email Security Breach Discovered by Rainbow Hospice Care, Inc.
Jefferson, WI-based, Rainbow Hospice Care, Inc. has discovered an employee’s email account has been accessed by an unauthorized individual and the protected health information of 2,029 current and former patents may have been viewed or downloaded.
Rainbow Hospice Care is unaware of any cases of misuse of patient information and said in its substitute breach notice that it believes misuse of patient information is unlikely.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches