Why Healthcare Security Matters

guest · Jun 18, 2020

...Ransomware?
Care New England website remains down; no evidence found of data breach
June 17, 2020
https://www.providencejournal.com/n...remains-down-no-evidence-found-of-data-breach

Care New England’s investigation into ongoing IT problems hasn’t turned up any evidence of unauthorized access to patient information, the nonprofit’s president and CEO said Wednesday.

Dr. James Fanale said Care New England, which includes Kent Hospital, Women & Infants Hospital and Butler Hospital, is continuing to work with IT forensic experts to resolve the issues.
Early Wednesday afternoon, Care New England’s website was still down.
Click to expand...

Computer attack targets Care New England hospital group

The Care New England hospital system is being seriously affected by an apparent attack on its computer system, Target 12 has learned.

At 4 p.m. Tuesday, loading the URL for CNE’s website brought up an error message that said, “The page cannot be displayed because an internal server error has occurred.”
In a follow-up interview, Fanale told WPRI 12 he wasn’t ready to say whether Care New England had been hacked, and declined to say whether any ransom demand had been issued as has happened to health systems in other places.

Experts are still trying to determine whether any patient information was compromised.
Click to expand...

“We are coordinating with the emergency preparedness coordinators at the hospitals, and with CNE leadership,” he said. “There have been no impacts on patient care because of the IT issue, but we are working with them to monitor the situation.”
An FBI spokesperson declined to comment.
Click to expand...

guest · Jun 18, 2020

Plastic surgeon facing disciplinary charge over allegations he filmed patients without consent
June 17, 2020
https://www.cbc.ca/news/canada/toronto/dr-6ix-disciplinary-charge-1.5616103

A Toronto plastic surgeon is facing a disciplinary charge on allegations that he filmed thousands of patients at his clinic, including while they were fully or partially naked, without proper notification or consent.

Dr. Martin Jugenburg, whose two-storey clinic is located in Toronto's Royal York hotel, is also accused of posting images of a patient's bare breasts on his social media without her consent.
It's also alleged the surgeon — who calls himself "Dr. 6ix" — allowed a television crew to film a breast augmentation surgery against another patient's wishes.

"What this case is about is Dr. Jugenburg's repeated breaches of his patients' privacy, his repeated breaches of his patients' confidentiality," Carolyn Silver, a lawyer representing the regulator, told the disciplinary panel.
Click to expand...

Cameras installed at clinic
According to an agreed statement of facts, 24 cameras were installed throughout the clinic in early 2017, some that recorded audio as well as video. These were located in examination and operating rooms, in the reception area, in hallways and other spaces, even areas used by other doctors at the clinic.

Some of the patients the regulator spoke to during its investigation said they were unaware of the cameras and would not have gone through an examination or consultation had they known, the statement said.
Click to expand...

guest · Jun 19, 2020

Breaches Reported by Hanger Clinic, Gateway Health, and Sunrise Treatment Center
June 19, 2020
https://www.hipaajournal.com/breach...-gateway-health-and-sunrise-treatment-center/

Sunrise Treatment Center in Cincinnati, OH is alerting 3,660 patients that some of their protected health information may have been accessed by an unauthorized individual who gained access to the email account of an employee. The breach occurred on February 26, 2020 and was detected the following day.

A forensic investigation of the breach was completed on April 15, 2020 and confirmed that the email account contained patient information such as first and last names, birth dates, descriptions of the treatment provided, medications,
A fraudulent wire transfer was detected and blocked before any money left Sunrise accounts.
Click to expand...

PHI of Gateway Health Members Exposed in Business Associate Phishing Attack
Gateway Health, a managed care organization serving members in Pennsylvania, has discovered the protected health information of some of its members has potentially been compromised.
On April 11, 2020, NIA discovered its systems had been breached and an unauthorized individual had gained access to its email system. The investigation confirmed that access to emails was gained following a response to a phishing email.
Hanger Clinic Reports Improper Disposal Incident
Hanger Prosthetics & Orthotics, Inc., doing business as Hanger Clinic, has discovered a storage facility used by its Kirksville location in Missouri was accessed by storage facility staff who disposed of boxes of files containing patient records.

When Hanger Clinic learned about the incident, staff members were sent to the storage facility to secure the remaining records. Those records have now been recovered and the storage facility is no longer being used.
Click to expand...

guest · Jun 21, 2020

Hiqa suffered 22 data protection breaches since last year, figures reveal
Health Information and Quality Authority
June 19, 2020
https://www.irishexaminer.com/break...s-since-last-year-figures-reveal-1006143.html

The email account of a Hiqa employee was hacked and access was gained for a number of hours.
Spam-type emails were sent to several recipients and it was reported to the Data Protection Commissioner.

According to freedom of information files, it's one of 22 data protection breaches the health watchdog has experienced since the beginning of last year.

"It's important now that HIQA takes measures to ensure that no employees email accounts get hacked," he said.
Hiqa says it takes its responsibilities under GDPR very seriously and has procedures in place to ensure it complies with data-protection obligations.
Click to expand...

guest · Jun 24, 2020

Security lapses in eHealth system increased risk of cyberattack, says auditor
June 23, 2020
https://www.msn.com/en-ca/news/cana...-risk-of-cyberattack-says-auditor/ar-BB15SBs8

After finding numerous security gaps on laptops, tablets and smartphones connected to the eHealth system, Saskatchewan’s provincial auditor warned they could increase the risk of cyberattacks.

Judy Ferguson’s office identified unencrypted devices, inappropriate security settings, unrestricted USB ports and untrained staff that could make the system vulnerable to malware, viruses and unauthorized access. She said eHealth’s plan for protecting laptops with access to confidential data “is not sufficiently robust.”
Click to expand...

In a report published on Tuesday, her office warned that eHealth did not sufficiently monitor its network for security risks. A team with just 3.5 positions was only performing “limited monitoring” to detect unauthorized access.

“Without effective network monitoring, eHealth may not detect malicious activity or mitigate risks of a successful attack on the network within sufficient time to prevent a security breach,” said a news release detailing the findings.
Click to expand...

guest · Jun 24, 2020

Georgia hospital investigates medical records theft, suspends employees
June 23, 2020
https://www.beckershospitalreview.c...medical-records-theft-suspends-employees.html

Landmark Hospital of Athens (Ga.) is investigating the theft of medical records and on June 19 suspended three employees who may have been involved.

The three employees are accused of violating the hospital's policy against possessing, using, copying, reading or disclosing information on hospital records.

"We will conduct a full investigation to ensure every patient gets the protection they are guaranteed by federal law," said Marie Saylor, CEO of the 42-bed critical care hospital. "HIPAA requires the careful custody of patient medical records and we have zero tolerance of anything that violates that confidentiality."
Click to expand...

guest · Jun 24, 2020

Two-Year Data Breach at Florida Senior Care Provider
June 24, 2020
https://www.infosecurity-magazine.com/news/2year-data-breach-at-florida/

A cybersecurity breach at a Florida senior care provider went unnoticed for two years and impacted patient data.

Cano Health discovered in April 2020 that some email accounts belonging to its employees had been compromised by threat actors.
After investigating the incident, the healthcare company found that the accounts had been accessed multiple times in a prolonged security breach that took place between May 18, 2018, and April 13, 2020.

In a statement published on their blog June 12, the company said: “Based on its investigation, Cano Health cannot confirm that any emails were accessed by the unknown perpetrator, but because some emails contained documents or messages with personal information, it is notifying all potentially affected individuals out of an abundance of caution.”
Click to expand...

The information in the compromised email accounts included patient names, dates of birth, contact information, healthcare information, insurance information, Social Security numbers, government identification numbers, and/or financial account numbers.
Click to expand...

guest · Jun 24, 2020

May 2020 Healthcare Data Breach Report
June 23, 2020
https://www.hipaajournal.com/may-2020-healthcare-data-breach-report/

May 2020 saw a marked fall in the number of reported healthcare data breaches compared to April, with 28 data breaches of 500 or more records reported to the HHS’ Office for Civil Rights. That is the lowest number of monthly breaches since December 2018 and the first time in 17 months that healthcare data breaches have been reported at a rate of less than one per day.

There were 10 fewer data breaches reported in May 2020 than April, but 1,064,652 healthcare records were breached in May. That is more than twice the number of records breached in April.
Causes of May 2020 Healthcare Data Breaches
The largest healthcare data breach of the month affected Elkhart Emergency Physicians, Inc. and involved the improper disposal of paper records by business associate Central Files Inc. Elkhart Emergency

There were 8 reported unauthorized access/disclosure incidents reported, although those breaches only accounted for 2.35% of breached records in May. The mean breach size was 3,124 records and the median breach size was 3,220 records.
Click to expand...

guest · Jun 24, 2020

AMT healthcare data breach impacts nearly 50,000 patients
Client information exposed after attack on senior care company’s email network
June 24, 2020
https://portswigger.net/daily-swig/amt-healthcare-data-breach-impacts-nearly-50-000-patients

Healthcare provider American Medical Technologies (AMT) announced it has suffered a data breach affecting almost 50,000 patients.

The Irvine, California-based organization confirmed (PDF) that it had fallen victim to a cyber-attack back in December 2019, when “suspicious activity” was discovered on an employee’s email account.
AMT, which provides long-term care programs for senior patients, conducted an investigation via a third-party forensic team who established that a breach had taken place.

Potentially compromised data includes patient names, Social Security numbers, medical record numbers, diagnosis information, health insurance policy, medical history information, HIPAA account information, and driver’s license/state identification numbers, AMT said.

“AMT deeply regrets any concern or inconvenience this issue may have caused and is taking affirmative steps based on the findings of the investigation to prevent a similar event from occurring in the future, including working with leading cybersecurity experts to enhance the security of its digital environment,” the company said.
Click to expand...

ronjor · Jun 25, 2020

Canada's LifeLabs failed to protect customer data, privacy commissioners find

Moira Warburton June 25, 2020
TORONTO (Reuters) - Canadian laboratory testing company LifeLabs failed to adequately protect sensitive health information of millions of people, resulting in one of the biggest data breaches in the country last year, privacy commissioners for the provinces of British Columbia and Ontario said on Thursday.
Click to expand...

guest · Jun 29, 2020

NHSX offers £3 million tender to phase out pagers
June 29, 2020
https://www.itpro.co.uk/business-st...5/nhsx-offers-ps3m-tender-to-phase-out-pagers

The National Health Service (NHS) has put out a multi-year contract for tender for a company to support its ambitions to phase out pagers by 2021 and implement a replacement system.

Worth £3 million, the contract seeks to recruit an organisation to design a framework for a secure messaging system with image sharing, call functionality and a staff directory linked the global NHS address book.
The clinical communication tools framework developed in the place of pagers must also abide by several regulations from patient safety rules to data protection laws.

“The Secretary of State announced that NHS trusts will be required to phase out pagers by the end of 2021 and to move to more modern communication tools,” the contract’s description page said.
Click to expand...

guest · Jun 29, 2020

UnityPoint Health Reaches $2.8M Settlement Over 2018 Data Breach
June 29, 2020
https://healthitsecurity.com/news/unitypoint-health-reaches-2.8m-settlement-over-2018-data-breach

Iowa Health System, doing business as UnityPoint Health, has reached a proposed $2.8 million settlement with the millions of patients impacted by two phishing-related data breaches in 2017 and 2018.

The settlement will provide the 1.4 million breach victims with monetary and injunctive relief, including one year of comprehensive credit monitoring and identity theft protection services and reimbursement of ordinary expenses up to $1,000 per settlement class member for costs incurred by credit monitoring and identity theft protection services.
Click to expand...

The UnityPoint Health breach was the second largest healthcare security incident reported in 2018, impacting the health records of 1.4 million patients after the health system discovered two separate phishing attacks during the year.
If approved, the UnityPoint Health settlement will join some of the largest healthcare data breach settlements in the last few years: Anthem ($115 million), Premera Blue Cross ($10 million), Banner Health ($8.9 million), UCLA Health ($7.5 million), and Washington State University ($4.7 million).
Click to expand...

guest · Jun 30, 2020

Email Error Leads to Exposed PHI of 11,500 Patients
June 29, 2020
https://digitalguardian.com/blog/email-error-leads-exposed-phi-11500-patients

An employee at Iowa Total Care, Inc., a managed care organization based in Des Moines, assuredly knows that feeling well now. The organization, a health plan that's a subsidiary of Centene, a large, publicly traded managed care organization based in Missouri, recently acknowledged an email error that accidentally resulted in the information of 11,581 patients being sent to the wrong person.

According to reports, the employee mistakenly sent an Excel spreadsheet containing claims data to a large provider organization. While ordinarily this might not be a problem, this file contained protected health information (PHI) belonging to patients who had not received medical care there.
The recipient reportedly never shared or copied the spreadsheet and instead deleted it.

As the provider is a HIPAA covered entity, it was required to inform the U.S. Department of Health and Human Services' Office for Civil Rights; the breach appears on OCR's Breach Portal with a submission date of June 23.
Click to expand...

guest · Jun 30, 2020

Victim Count in Magellan Ransomware Incident Soars
Breach Reports Show Growing Tally of Affiliates, Individuals Affected
June 30, 2020
https://www.databreachtoday.com/victim-count-in-magellan-ransomware-incident-soars-a-14532

The number of companies and individuals affected by an April ransomware attack on managed care provider Magellan Health continues to grow.
This illustrates the risks faced by interconnected organizations in the healthcare sector, some experts note.

"A health insurer not only has a lot of the same patient data that a provider may have, but they may have it for patients at hundreds or thousands of providers," says former healthcare CIO David Finn, executive vice president at privacy and security consulting firm CynergisTek.
The Victim Tally
As of Tuesday, at least six Magellan affiliate companies, including health plans, plus three University of Florida-related entities that offer their employees Magellan health plans are listed on the Department of Health and Human Services HIPAA Breach Reporting Tool website as reporting breaches linked to the Magellan ransomware attack.
Click to expand...

guest · Jul 1, 2020

Security lapse at South Africa’s LogBox exposed user accounts and medical data
July 1, 2020
https://techcrunch.com/2020/07/01/security-lapse-at-south-africas-logbox-exposed-medical-data/

LogBox, a South African medical data startup that bills itself as an “absolutely secure” way of replacing paper forms for sharing patient data with doctors, has exposed user accounts and patient data following a security lapse.

Security researcher Anurag Sen found an exposed database belonging to the company containing account access tokens for thousands of LogBox users, which if used would grant full access to users’ accounts without requiring their password, Sen said.
When reached, LogBox director Neal Goldstein declined to comment by our deadline or answer any of our questions, specifically if LogBox planned to inform users or customers that data was exposed or if the company plans to report the incident to regulators.

Founded in 2010, LogBox has become a rising star in South Africa, just last year partnering with Lancet Laboratories, a medical diagnostics company that operates in 11 African countries.
Click to expand...

guest · Jul 1, 2020

Waikato DHB breached doctor's privacy after colleagues accessed his personal medical file
July 1, 2020
https://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=12343889

A junior Waikato Hospital doctor was left "humiliated and ashamed" after colleagues, including senior clinicians, accessed his medical records without good reason.

The Privacy Commissioner has found his privacy was breached - that the Waikato District Health Board interfered with the doctor's privacy by failing to safeguard personal health information and failing to release personal information to the doctor when he requested it.
The doctor, who the Herald is not naming, was a registrar at Waikato Hospital when he sought medical treatment at the emergency department on multiple occasions in 2016 and 2017, according to findings by the Privacy Commissioner's senior investigator.
Click to expand...

"When you obtained the full audit log you could see that colleagues that you worked closely with had accessed your medical records," the investigator wrote in her findings.
The investigator accepted the doctor had suffered harm and found the DHB had breached principle 5 of the Health Information Privacy Code, which governs the way information is stored.
Click to expand...

guest · Jul 1, 2020

mood said: ↑

Hospital still mum on ransomware attack
July 24, 2019
https://www.thedailyworld.com/news/hospital-still-mum-on-ransomware-attack/
Click to expand...

Grays Harbor County Hospital Settlement
June 2020
https://ghchsettlement.com/

If you were notified by Grays Harbor Public Hospital of the June 2019 Data Incident, you may be eligible for a payment from a class action settlement

A settlement has been proposed in a class action lawsuit against Grays Harbor County Public Hospital District No. 2, Grays Harbor Community Hospital, GHCH Physician Services, LLC d/b/a Harbor Medical Group (collectively “Grays Harbor”) relating to a cyberattack against Grays Harbor’s computer systems that occurred in June 2019 (the “Data Incident”). T

Grays Harbor has denied and continues to deny all of the claims made in the Lawsuit, as well as all charges of wrongdoing or liability against it.
Click to expand...

guest · Jul 3, 2020

One of Florida’s largest orthopedic providers faces class-action lawsuit after data breach
July 2, 2020
https://www.abcactionnews.com/money...-faces-class-action-lawsuit-after-data-breach

One of Florida’s largest orthopedic providers is facing a class-action lawsuit after hackers stole personal information from potentially thousands of patients.

Attorney John Yanchunis of Morgan & Morgan filed the lawsuit against the Florida Orthopedic Institute, seeking at least $99 million on behalf of patients and former patients citing a “failure to properly secure and safeguard protected health information,” according to the complaint filed June 30.

“If you retain this information and you lose it, you are responsible for the repercussions of its loss,” Yanchunis told ABC Action News.
ABC Action News confirmed several patients received a letter from Florida Orthopedic Institute dated June 19, alerting them about the data breach. But that notice reports the medical group learned of the ransom-ware attack on or around April 9.
Click to expand...

guest · Jul 4, 2020

Second NHS data leak to be fully investigated
July 3, 2020
http://www.orcadian.co.uk/second-nhs-data-leak-to-be-fully-investigated/

Another data breach at NHS Orkney has led to a confidential health board file being inadvertently sent to a member of the local press, in what has been described by the health authority’s new interim chief executive as a “regrettable” error.
Michael Dickson, who is set to arrive in Orkney today, Friday, has apologised for the data protection breach, which disclosed the names and personal information of ten NHSO staff members. Mr Dickson has confirmed that the leak will be the subject of a full investigation.
Click to expand...

This is the second time in recent months that NHS Orkney has breached data protection laws. In May, a file containing the names and personal details of 51 health and social care workers who had applied to be swabbed for coronavirus — including some test results — was sent to an Orkney business in an “administrative error.”
Click to expand...

guest · Jul 7, 2020

Lawsuits After Ransomware Incidents: The Trend Continues
In Latest Case, Florida Practice Sued for Damages, and Security Mandates Sought
July 6, 2020
https://www.databreachtoday.com/lawsuits-after-ransomware-incidents-trend-continues-a-14567

A lawsuit seeking damages as well as security mandates has been filed against a Florida-based orthopedic group in the wake of a ransomware incident. It's the latest in a series of such legal actions in healthcare, including one in which a preliminary settlement has been reached.

The preliminary settlement reached last month in a ransomware-related lawsuit against UnityPoint Health would require the organization to improve its network and data security to address vulnerabilities and safeguard patient data.
The Latest Lawsuit
The new lawsuit against Musculoskeletal Institute - which does business as Florida Orthopaedic Institute - alleges the Tampa, Fla.-based entity was "lackadaisical, cavalier, reckless, or in the very least, negligent" in maintaining the privacy of patients' information.
Click to expand...

"It is a good bet that we will continue to see more class action lawsuits brought by consumers whose personal information has been disclosed by healthcare organizations and their vendors," Holtzman notes. "Through failing to implement 'reasonable security procedures,' healthcare organizations will continue to be defending themselves from privacy and data breach class action lawsuits."
Click to expand...

guest · Jul 7, 2020

Brazil's Hapvida Discloses Cyber Breach, Potential Client Data Leak
July 6, 2020
https://www.usnews.com/news/technol...loses-cyber-breach-potential-client-data-leak

Brazilian health insurer Hapvida said in a securities filing on Monday it has suffered a cyber attack potentially involving access to the personal information of its customers.

Hapvida said, after a preliminary assessment of the security breach, that the attackers did not access customers' medical records or financial information.
It said the attack was blocked by Hapvida's own information security officers and third-party companies specializing in dealing with this type of issue.

The company is conducting a complete review of its infrastructure and applications aimed at strengthening protections and mitigating risks, the filing said.
Click to expand...

guest · Jul 9, 2020

The 10 Biggest Healthcare Data Breaches of 2020, So Far
July 8, 2020
https://healthitsecurity.com/news/the-10-biggest-healthcare-data-breaches-of-2020-so-far

The healthcare sector saw a whopping 41.4 million patient records breached in 2019, fueled by a 49 percent increase in hacking, according to the Protenus Breach Barometer. And despite the COVID-19 crisis, the pace of healthcare data breaches in 2020 continue to highlight some of the sector’s biggest vulnerabilities.

The end of 2019 saw a host of ransomware attacks and vendor-related breaches that outpaced previous years in the healthcare sector. For comparison, the industry saw just 15 million records breached in 2018.
Click to expand...

As seen with the biggest healthcare data breaches of the year, providers still have a great deal of work to do when it comes to securing remote connections, properly disposing documents, and educating users to prevent the frequency of successful phishing attacks – as well as delays in detection and breach notifications.
Click to expand...

guest · Jul 10, 2020

Vancouver Coastal Health hit by cyberattack, but says 'no evidence' data stolen
July 9, 2020
https://bc.ctvnews.ca/vancouver-coa...ck-but-says-no-evidence-data-stolen-1.5018428

An investigation into a cyberattack at Vancouver Coastal Health turned up "no evidence" that data was stolen, according to officials.

The health authority said malicious ransomware was discovered in data related to its Employee and Family Assistance Program on May 21, and that officials responded by bringing in external cybersecurity experts to investigate.

"The investigation of this cyberattack is now complete and there is no evidence any data has been removed or misused from EFAP computers," Vancouver Coastal Health said in a news release on Thursday.
Employees were not previously alerted about the breach back in May, the health authority said, but officials did quickly inform B.C.'s Office of the Information and Privacy Commissioner about the incident.
Click to expand...

guest · Jul 17, 2020

University of Lethbridge reveals details regarding privacy breach at health centre
July 15, 2020
https://globalnews.ca/news/7181967/privacy-breach-university-lethbridge-health-centre/

The University of Lethbridge says an Excel document with personal information of 1,225 patients at its health centre was inadvertently shared with a student.
The document that was the subject of a privacy breach included names, dates of birth, personal health numbers, genders and a list of family physicians whom patients had seen since 2015.

The U of L said the breach happened on June 23 when an email that was intended to be sent from one health centre employee to another was inadvertently sent to a U of L student email address.
The university declined to comment on camera but issued a statement on the breach.

“There is no indication the student opened, saved or forwarded the attachment and the email was deleted from the system by the university’s information technology department,” the statement reads.
Click to expand...

The U of L said the health centre’s protocols for handling personal information have been thoroughly reviewed and communication policies and privacy protocols have been reinforced with all staff members.
Click to expand...

guest · Jul 17, 2020

South East Coast Ambulance employee personal and medical details exposed
July 15, 2020
https://www.kentonline.co.uk/ashford/news/data-breach-at-ambulance-service-230388/

The South East Coast Ambulance Service has experienced a massive data breach and has referred itself to a privacy watchdog.

In May, the personal and medical details of all ambulance staff could have been seen by employees outside of senior management.
An internal memo revealed that a server containing details of sick leave - including operations and mental and physical health issues - was for 10 days accessible to seven people who were not managers.

"This was an isolated incident which occurred while an update was taking place to our systems and which resulted in the usual restricted access controls in place being unknowingly lifted.
"There is no evidence that any staff details were inappropriately accessed. However, we decided to write to all staff who could have potentially been affected in the interests of transparency. We also reported the issue to the Information Commissioner's Office for the same reason.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches