Why Healthcare Security Matters

Minimalist · May 22, 2020

FBI offers US companies more details from investigations of health care hacking

The FBI has provided U.S. companies more information on the extent of recent criminal and foreign government-backed hacking operations against the health care sector and warned of ongoing efforts to steal U.S. research data.
Click to expand...

https://www.cyberscoop.com/fbi-health-care-coronavirus-hacking/

guest · May 22, 2020

mood said: ↑

Clinic worker pleads guilty to identity theft
January 31, 2020
https://www.dailycommercial.com/news/20200131/clinic-worker-pleads-guilty-to-identity-theft
DoJ: Medical Clinic Worker Pleads Guilty To Aggravated Identity Theft And Wire Fraud
Click to expand...

Leesburg Woman Sentenced To 48 Months In Prison For Aggravated Identity Theft And Wire Fraud
May 19, 2020
https://www.justice.gov/usao-mdfl/p...ison-aggravated-identity-theft-and-wire-fraud

Senior U.S. District Judge James D. Whittemore today sentenced Stacey Lavette Hendricks (49, Leesburg) to 48 months in federal prison for aggravated identity theft and wire fraud. Hendricks had pleaded guilty on January 30, 2020.
According to court records, Hendricks worked administrative jobs at several Florida medical clinics. She used these jobs to gain access to medical records and patients’ birthdates and Social Security numbers. She then sold the stolen identities to others for cash, or used them herself to defraud businesses. I
Click to expand...

guest · May 24, 2020

April 2020 Healthcare Data Breach Report
May 20, 2020
https://www.hipaajournal.com/april-2020-healthcare-data-breach-report/

There were 37 healthcare data breaches of 500 or more records reported in April 2020, up one from the 36 breaches reported in March. As the graph below shows, the number of breaches reported each month has been fairly consistent and has remained well below the 12-month average of 41.9 data breaches per month.

While the number of breaches increased slightly, there was a significant reduction in the number of breached healthcare records in April. 442,943 healthcare records were breached in April, down 46.56% from the 828,921 records breached in March.
Causes of Healthcare Data Breaches in April
As was the case in March, hacking and IT incidents were the leading causes of healthcare data breaches. Unauthorized access/disclosure incidents were the next most common causes of breaches, an increase of 77.77% from the previous month.

333,838 records were compromised in the 18 reported hacking/IT incidents, which account for 75.37% of all records breached in April.
Click to expand...

guest · May 24, 2020

Court revives patient's lawsuit against Indiana hospital for medical record snooping, HIPAA violation
May 21, 2020
https://www.beckershospitalreview.c...-medical-record-snooping-hipaa-violation.html

An Indiana Court of Appeals reinstated a patient's claim that Fort Wayne-based Parkview Health System is vicariously liable for the actions of an employee who viewed the patient's medical records and wrongfully shared the information, according to The Indiana Lawyer.

In October 2017, former Parkview Health medical assistant Alexis Christian accessed Haley SoderVick's medical records during her appointment and then shared protected health information, including potential diagnosis and employment, with Ms. Christian's husband.
After notifying Ms. SoderVick in May 2018 of the inappropriate disclosure of her protected health information, Ms. SoderVick sued Parkview Health, claiming the hospital was vicariously liable for Ms. Christian's actions, it was negligent for failing to provide adequate training and supervision and also alleged Parkview Health violated its data protection duties under HIPAA.
Click to expand...

ronjor · May 26, 2020

Hackers are stepping up attacks on health care facilities and researchers

By Maya Shwayder May 26, 2020
Cyberattacks against health care facilities and public health researchers have nearly doubled amid the coronavirus pandemic, according to new data.
The statistics provided to Digital Trends by cybersecurity firm Infosec and compiled from the U.S. Department of Health and Human Services show there have been 127 breaches of U.S. hospitals and health care systems from February 1 through May 18 in 2020.
Click to expand...

guest · Jun 2, 2020

mood said: ↑

Leesburg Woman Sentenced To 48 Months In Prison For Aggravated Identity Theft And Wire Fraud
May 19, 2020
https://www.justice.gov/usao-mdfl/p...ison-aggravated-identity-theft-and-wire-fraud
Click to expand...

Inside Job at Clinics: Mobile Phone Used for Fraud
Worker Sentenced in Case Involving Theft of Patient Data
June 1, 2020
https://www.databreachtoday.com/inside-job-at-clinics-mobile-phone-used-for-fraud-a-14364

The case illustrates the potential risks posed by employees inappropriately using personal devices - a risk that could potentially be heightened with more staffers working at home during the COVID-19 crisis.
Hendricks was nabbed in July 2019 after a confidential source reported the activity to law enforcement, and an undercover officer twice purchased from Hendricks several screenshots of patient PII.

"During the investigation, agents recovered a total of 113 distinct sets of stolen patient PII from Hendricks possession; this number also includes the 15 sets of PII that Hendricks sold to the undercover officer as well as the information recovered from the search of her home," court papers allege.
Common Challenges
"The inappropriate use of smartphones to disclose PHI in the healthcare workplace can pose a significant threat to patient privacy," says privacy attorney David Holtzman of security consultancy CynergisTek.
But if employees need to use devices for work purposes, entities should have robust policies and procedures addressing how and when such devices should be used, she adds.
Click to expand...

guest · Jun 2, 2020

Mat-Su Surgical Associates Suffers Ransomware Attack
May 28, 2020
https://www.hipaajournal.com/mat-su-surgical-associates-suffers-ransomware-attack/

Palmer, AK-based Mat-Su Surgical Associates has announced it was attacked with ransomware in March. The attack was discovered on March 16 when staff were locked out of its computer systems as a result of the encryption of essential files.
The attacker was determined to have gained access to parts of its computer system that contained the protected health information of 13,146 patients.

Mat-Su Surgical Associates has taken steps to improve security, including implementing additional measures to prevent unauthorized remote access to its systems.
Click to expand...

The Little Clinic Discovers Online Appointment System Bug that Exposed PHI

The Little Clinic, a network of more than 215 medical care clinics in Ohio, Kansas, Kentucky, Tennessee, Arizona, Georgia, Indiana, Virginia and Colorado, has discovered a bug in its online appointment system potentially resulted in an unauthorized disclosure of patients protected health information.

The bug was discovered internally by The Little Clinic and was determined to have been introduced on October 7, 2018. The issue was corrected on February 13, 2020 and measures were implemented to prevent similar breaches in the future.
Click to expand...

guest · Jun 2, 2020

Hospitals 'overwhelmed' by cyberattacks fuelled by booming black market
June 2, 2020
https://ca.news.yahoo.com/hospitals-overwhelmed-cyberattacks-fuelled-booming-090000963.html

Canada's health system is under siege from unrelenting cybercriminals trying to access patient information and other data, according to health-care professionals and cybersecurity experts who say hospitals and clinics are unable to cope with the growing threats.
The problem has become so big that some are calling for Ottawa to impose national cybersecurity standards on the health-care sector and for an influx of cash from the federal government to deal with the issue.

Experts say health information can be even more valuable to hackers than a credit card, because it includes data such as a person's health number or date of birth — pieces of information with a "unique value" that doesn't change over time and can help thieves steal identities.

"The market for health-care identities is big and booming," said Abigail Carter-Langford, a vice-president with Canada Health Infoway, an organization funded by Health Canada that focuses on improving the access of Canadians to digital health technology.
Click to expand...

guest · Jun 2, 2020

Saint Joseph Health, 6 more Indiana providers report improper disposal of patient records
June 2, 2020
https://www.beckershospitalreview.c...ort-improper-disposal-of-patient-records.html

Mishawaka, Ind.-based Saint Joseph Health System disclosed to patients last week that in April it discovered some of the patient and employee records it paid to have securely stored or destroyed were improperly dumped in an unsecure location in South Bend, Ind.

The records were entrusted to Central Files and included protected information about patients, clients and employees of Saint Joseph Health System and six other Indiana health providers. Central Files was paid to destroy certain records and was instructed to securely store the remaining records until they were transferred to another records storage company.
After completing an investigation with the South Bend Police Department, the healthcare providers discovered that records exposed represented a range of dates from 1995 to 2015.
Click to expand...

guest · Jun 3, 2020

Data Breach Lawsuit Filed Against Pediatric Care Provider
Aveanna Healthcare Breach Affected More Than 166,000
June 2, 2020
https://www.databreachtoday.com/data-breach-lawsuit-filed-against-pediatric-care-provider-a-14372

A lawsuit seeking class action status has been filedd against Atlanta-based Aveanna Healthcare in the wake of a 2019 data breach at the pediatric home healthcare provider that affected more than 166,000 individuals.

The breach, reported to the Department of Health and Human Services on Feb. 14, is the fifth largest added to the HHS HIPAA Breach Reporting Tool website so far this year (see: Health Data Breach Tally Spikes in Recent Weeks).
Commonly called the "wall of shame," the HHS Office for Civil Rights website lists health data breaches affecting 500 or more individuals.
Click to expand...

In a Feb. 18, 2020 breach notification statement, Aveanna Healthcare said it became aware of suspicious activity relating to a number of its employee email accounts on Aug. 24, 2019.

"We took steps to secure the email accounts and began working with outside computer forensics specialists to determine the nature and scope of the activity," Aveanna said in its notification.
The complaint does not indicate how many of the more than 166,000 individuals impacted by the incident are minors, and Aveanna Healthcare did not respond to an Information Security Media Group inquiry on the number of pediatric patients affected by the breach.
Click to expand...

guest · Jun 5, 2020

University of Utah Health patient info was breached through ‘phishing schemes’
June 5, 2020
https://www.deseret.com/utah/2020/6...ta-breach-patient-information-phishing-scheme

The University of Utah Health fell victim to a phishing scheme in which an outside party accessed patient information such as birthdates and clinical information through employee emails, the organization announced Friday.
However, hospital officials say there is no evidence hackers have misused patient information as of Friday afternoon.

University of Utah Health officials said in a press release Friday they are in the process of notifying patients of the data breaches.
The press release says the unauthorized access to employee email accounts occurred between April 6 and May 22 after some employees responded unknowingly to phishing schemes sent to their email accounts.

“U of U Health is actively reviewing information protocols, reinforcing information security procedures with employees, and implementing changes where needed to help prevent incidents like these from happening again,” the release concludes.
Click to expand...

guest · Jun 6, 2020

Castro Valley Health notifies patients after learning that patient data had been improperly transferred to Docker Hub
Castro Valley Health, Inc. Notifying Patients of Data Security Incident
June 5, 2020
https://www.globenewswire.com/news-...fying-Patients-of-Data-Security-Incident.html

Castro Valley Health, Inc. has become aware of a data security incident that may have involved some personal information of former patients. Castro Valley Health is sending notifications to the potentially involved individuals to notify them of this incident and provide resources to assist them.

What Happened: The incident occurred when certain information about Castro Valley Health patients inadvertently was transferred during 2016-2017 to a third-party website called Docker Hub. Castro Valley Health first became aware of this incident on April 21, 2020, and promptly removed the information from the Docker Hub site. The transferred information was heavily coded and therefore not readable without significant decoding.

What Information Was Involved: The information that was transferred to the Docker Hub site included: patient names, an entry that said “Start of Care - Admission Visits,” the name of the nurse, physical therapist, or speech therapist who admitted the patient, the address at which the patient visit was to occur, the patient’s date of birth, medical record number, and the start of care date.
Click to expand...

guest · Jun 6, 2020

How screwed is Indian healthcare data?
June 6, 2020
https://medium.com/bugbountywriteup/how-screwed-is-indian-healthcare-data-fa4584be8a04

The story behind how I was able to view, edit & delete classified personal information of lakhs of patients all over India

Some months ago, I read an interesting article on Techcrunch titled “A billion medical images are exposed online” about medical imaging storage servers that are not configured securely and are exposed online. This caught my attention, and I wanted to dig deeper, especially in the Indian context.
Before going into the details, I am discussing some important concepts that are critical to this article.
Click to expand...

guest · Jun 6, 2020

Chile: CPLT announces breach of sensitive patient data in health industry
June 2, 2020
https://www.dataguidance.com/news/chile-cplt-announces-breach-sensitive-patient-data-health-industry

The Chilean Transparency Council ('CPLT') announced, on 1 June 2020, that following an audit of 12,000 purchase orders made by 86 organisations in the health sector, the CPLT found that 12 purchase orders by hospitals and six by health services were made which revealed the sensitive personal data of patients. In particular, the CPLT noted that the patient information shared was in most cases sensitive personal data and was shared without the express consent of the data subject, and without adequate security measures to protect the data.

Moreover, the CPLT highlighted that in some cases this data was made public through portals. Finally, the CPLT outlined that it had sent a letter ('the Letter') to the Ministry of Health, offering technical support to remedy the situation.
You can read the press release here and the Letter here, both only available in Spanish.
Click to expand...

guest · Jun 8, 2020

Fears patient files at Hockley GP surgery hacked - urgent probe launched
June 7, 2020
https://www.birminghammail.co.uk/news/midlands-news/fears-patient-files-hockley-gp-18375560

Thousands of alerts have been sent to patients at a leading GPs' practice amid fears their medical records have been hacked.

Staff at Hockley Medical Practice, based in the Jewellery Quarter, have acted swiftly after being made aware of the possible cyber attack.
The surgery has 8,839 patients. A text message has been sent to all adults on its books.

An NHS spokesperson said there was no indication any other surgery has been affected. She stressed it has not yet been established if a hacker had syphoned sensitive data, but the situation is being taken extremely seriously.

"If any patients have received suspicious emails, please do not click any links within or share any personal information or passwords, and contact your practice as soon as possible.”
Click to expand...

guest · Jun 10, 2020

Babylon Health admits data breach of GP video consultations
Patients were given access to the video consultations of others
June 10, 2020
https://www.itpro.co.uk/security/da...-admits-data-breach-of-gp-video-consultations

Patients using a smartphone app developed by the private health firm Babylon to book GP appointments were inadvertently given access to videos recorded by other patients.

The company has admitted that the data breach was as a result of a software error whereby a new feature worked improperly, showing videos recorded by other people when patients who booked an audio-only consultation switched to video.
The issue was first flagged by a clinician yesterday afternoon, the company told IT Pro, about an hour before reports began circulating on social media. Developers then switched off the video access feature within two hours and begun assessing who had been impacted.

“We give out data to these companies in good faith because we believe our information will be kept secure,” Glover added in response to another user. “Personally, I just hope Babylon gather learnings from this monumental error to stop it happening
Click to expand...

guest · Jun 10, 2020

South Africa's Life Healthcare hit by cyber attack
June 9, 2020
https://in.reuters.com/article/us-l...-healthcare-hit-by-cyber-attack-idINKBN23G0MY

South Africa’s Life Healthcare said on Tuesday its southern African operation was hit by a cyber attack affecting its admissions systems, business processing systems and email servers, but is yet to determine the extent to which data has been compromised.

Southern Africa is Life Healthcare’s biggest market that includes Botswana.
The company said its hospitals and administrative offices continue to function with some delays, after having switched to backup systems.
Click to expand...

LIFE HEALTHCARE CYBER INCIDENT Q & A
(PDF): https://www.lifehealthcare.co.za/media/3177/20200609_life-healthcare-cyber-incident_web-q-and-a-final.pdf

guest · Jun 10, 2020

mood said: ↑

Data breach connected to Capital Region’s Community Care Physicians reported
February 19, 2020
https://dailygazette.com/article/2020/02/19/data-breach-community-Care-physicians
Click to expand...

BST sued by Community Care customers over cyber attack
June 10, 2020
https://www.timesunion.com/business...munity-Care-customers-over-cyber-15330030.php

Lawyers for patients of Community Care Physicians that were victimized by a cyber ransomware attack last December are suing the accounting firm that the medical practice hired to protect its customer data, some of which was published online.

The class-action lawsuit was filed in state Supreme Court in Albany last month against BST and Co. CPAs of Colonie by the New York City law firm Chaffin Luhana on behalf of Albany resident and lead plaintiff in the case, local attorney Elmer Keach III.
Community Care is not listed as a defendant.
Click to expand...

It is unclear how many Community Care patients were affected by the ransomware attack, which the lawsuit claims was done by the infamous Maze ransomware ring.

Community Care posted on its web site that the breach was with BST, not Community Care, although BST had access to patient data for tax and accounting purposes.
"We again just want to stress that CCP’s systems were not affected and your data remains secure with CCP," Community Care said in the February post to its web site.
Click to expand...

guest · Jun 11, 2020

eHealth ransomware attack potentially catastrophic for Sask. health card holders: cybersecurity expert
June 11, 2020
https://www.cbc.ca/news/canada/sask...ck-potentially-catastrophic-1.5606021?cmp=rss

The bad guys slipped the virus into the eHealth Saskatchewan computer system on Dec. 20. For the next 17 days, it crept undetected through the network, copying some of the most sensitive health and personal information collected by government.

Now, five months later, eHealth admits it still doesn't know exactly what information was taken, who took it, where it went or what it's being used for.
Toronto cybersecurity expert Claudiu Popa said anyone with a Saskatchewan health card should be alarmed.

"The worst case scenario is a scenario in which we don't know what was taken," he said in an interview.
Click to expand...

A high value target
Popa said health agencies are popular targets for cyberthieves, because they collect and stockpile sensitive information.

"That's where the bad guys want to break in because they want to do as little work as possible for as much gain," he said.
System improvements and lingering questions
eHealth said it has since taken steps to protect patient information and limit the impact on health services.

"Lessons learned in the ransomware incident will be incorporated in eHealth's previously existing multi-year plans to strengthen disaster recovery and business continuity planning," the official said.
Click to expand...

guest · Jun 12, 2020

12,000+ Indian blood donors’ PII and passwords leaked
June 12, 2020
https://cloudsek.com/threatintelligence/12000-indian-blood-donors-pii-and-passwords-leaked/

CloudSEK has discovered a data leak that contains sensitive information of 12,472 blood donors registered on http://www.indianblooddonors.com/index.php. Indian Blood Donors is an organization that maintains a free database of blood donors. They also have an app, which matches recipients with the nearest donor, based on blood type.
Discovery of the leak
A CloudSEK researcher discovered posts on 2 forums advertising a database of Indian blood donors registered on http://www.indianblooddonors.com/index.php. The posts claimed that the database, which contains donors’ Personally Identifiable Information (PII), blood type, and passwords in plain text, was available for free. So, we were able to obtain the complete database at no cost to validate its contents.

We notified Indian Blood Donors and CERT India about the leak. While CERT India has responded, saying that necessary action is being taken, Indian Blood Donors has not responded, at the time of publishing this article. If we receive a reply, it will be duly updated here.
Click to expand...

guest · Jun 14, 2020

RDH suffers ransomware attack
June 13, 2020
https://www.theheraldtimes.com/rdh-suffers-ransomware-attack/rangely/

Rangely District Hospital (RDH) will send notices this week to patients whose records may have been involved in a ransomware attack in April 2020.

According to a press release issued June 8, parts of the hospital’s computer network were attacked by ransomware, including some files containing patients’ health information and other files necessary to view certain patient information.

“There is no indication that any files with personal health information were exported or viewed by any unauthorized person as a result of the incident,” the press release states, but breach notification letters are being sent to involved patients for whom RDH has current mailing addresses.
Software used by the hospital to access some database records entered between August 2012 and August 2017 was infected by ransomware, causing loss of access.

RDH has since made changes to protect its network, is researching additional data backup options, and taken additional steps to protect its data in the future.
Click to expand...

guest · Jun 14, 2020

Electronic Waveform Lab reports ransomware incident
Notice of Data Breach

What Happened?
On April 11, 2020, we discovered a ransomware incident that affected some of our computer systems. We immediately took steps to secure our network, began an investigation, and hired an experienced computer forensic firm to assist.
What Information Was Involved?
The unauthorized actors may have obtained some client information, including your name, address, date of birth, insurance information, and in some cases, limited diagnosis or treatment information. Electronic Waveform Lab’s servers have been restored, and no data has been lost due to this incident.
Click to expand...

Electronic Waveform Lab, Inc.'s Notice of Privacy Incident

HUNTINGTON BEACH, Calif., June 12, 2020 /PRNewswire/ -- Electronic Waveform Lab, Inc. announced today it is notifying individuals of a ransomware incident that affected some of its servers that contained certain patient information.

Electronic Waveform Lab regrets that this incident occurred and remains focused on ensuring the security and confidentiality of patient information. While Electronic Waveform Lab has had safeguards in place to protect information, the company has taken additional steps to prevent something like this from occurring in the future [...]
Click to expand...

guest · Jun 15, 2020

113 NHS Email Accounts Hacked
June 15, 2020
https://www.cbronline.com/news/113-nhs-email-accounts-hacked

Some 113 NHS email accounts were compromised by phishing emails last month, the NHS has admitted.

Due to the potential compromise of sensitive data like patient medical records, a breach of any kind on NHS end-points is of serious concern; all affected accounts have been isolated.

A spokesperson for NHS Digital played down the incident, saying: “There is currently no evidence to suggest that patient records have been accessed. We are working closely with the National Cyber Security Centre, who are investigating a widespread phishing campaign against a broad range of organisations across the UK.”
Click to expand...

guest · Jun 18, 2020

Business Associate Incidents Added to Breach Tally
Health Data Breaches Involving Paper Records, Email Compromises Added to 'Wall of Shame'
June 17, 2020
https://www.databreachtoday.com/business-associate-incidents-added-to-breach-tally-a-14456

Several major health data breaches that have been added to the federal tally in recent weeks serve as stark reminders of the security and privacy risks posed by business associates.

Among the incidents recently added to the Department of Health and Human Services' HIPAA Breach Reporting Tool website are breaches involving the improper disposal of paper records by a vendor hired to store and destroy the records; records damaged in a tornado that hit a vendor facility; and an email hack of employees of a healthcare entity that is a parent company providing services to more than a dozen hospitals and other servide providers. [...]
Click to expand...

guest · Jun 18, 2020

Privacy breach at Chatham-Kent Health Alliance (CKHA)
Staffer snooped at health records of 40 patients for no reason
June 17, 2020
https://chathamvoice.com/2020/06/17/privacy-breach-at-ckha/

A Chatham-Kent Health Alliance (CKHA) employee went snooping into the health records of 40 patients in recent months; they are no longer with the organization.

Justin Turkington, director of human resources and occupational health and safety for the alliance, said the information breach took place over a matter of months – from March to May.

“This is a privacy breach. It has been reported to the Privacy Commissioner,” Lori Marshall, president and CEO for the CKHA, said. “We’re notifying each of those 40 patients or their substitute decision-makers, if that is more appropriate.”
She added the breach was initially identified in May through a routine system audit. Further investigation led alliance officials to uncover the full scope of the breaches dating back to March.
Click to expand...

When employees join the CKHA, Marshall said they are required to sign confidentiality agreements and complete mandatory privacy electronic learning, which is refreshed on an annual basis.
“CKHA is committed to patient centred care and preserving patients’ trust in the care they are receiving and the staff providing that care,” Marshall said. “We regret that this privacy breach happened.”
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches