Why Healthcare Security Matters

guest · Dec 11, 2020

Cedar Springs Hospital - Notice of Data Incident
December 9, 2020
https://www.prnewswire.com/news-rel...pital--notice-of-data-incident-301189953.html

Cedar Springs Hospital is providing notice of an incident that may affect the security of information relating to certain Cedar Springs Hospital patients.

Cedar Springs Hospital recently received a request from its licensing agency, the Colorado Department of Public Health & Environment ("CDPHE"), for certain hospital records. As a licensed healthcare provider, Cedar Springs Hospital is subject to periodic surveys by CDPHE and in connection with those surveys, the CDPHE is entitled to various hospital records, including, but not limited to, those containing patient health information.
Click to expand...

In late October, in connection with a survey, the CDPHE requested Cedar Springs Hospital copy a number of records onto an external drive [...] contrary to CDPHE's policy, the external device that the CDPHE surveyor provided for use was not encrypted.

Cedar Springs Hospital is working with CDPHE to obtain additional information about the incident, including why CDPHE policy was not followed and why an unencrypted external device was utilized.
Click to expand...

guest · Dec 12, 2020

The 10 Biggest Healthcare Data Breaches of 2020
December 10, 2020
https://healthitsecurity.com/news/the-10-biggest-healthcare-data-breaches-of-2020

Cybersecurity proved to be a massive challenge for many in the healthcare sector in 2020 as providers worked to combat the COVID-19 crisis, while simultaneously being pummeled with targeted cyberattacks. These led to some of the biggest healthcare data breaches seen in recent years.

While the first half of the year saw a reduction in the number of reported incidents, active threats continued to plague the sector, from ransomware to insiders, which came to a head in September with a steady onslaught of ransomware attacks.
As previously noted to HealthITSecurity.com, the fewer number of reported incidents in the sector during the first half of the year did not, in any sense, mean hackers were forgoing targeted attacks. [...]
Click to expand...

guest · Dec 12, 2020

To Report or Not Report Health Care Data Breaches
December 11, 2020
https://www.ajmc.com/view/to-report-or-not-report-health-care-data-breaches

ABSTRACT
Objectives: The study’s objectives were to explore the impact of personal/organizational knowledge, prior breach status of organizations, and framed scenarios on the choices made by privacy officers regarding the decision to report a breach.
Results: The percentage of privacy officers who chose to report a breach to the Office for Civil Rights varied by scenario: scenario 1 (general with little information), 39%; scenario 2 (4-factor risk assessment, paper records), 73.2%; scenario 3 (4-factor risk assessment, ransomware case), 91.9%. Several factors affected the response to each scenario. [...]
Click to expand...

Conclusions: Study findings show there are gray areas where privacy officers make their own decisions, and there is a difference in the types of decisions they are making on a day-to-day basis.
[...]
The findings from the study indicate that higher knowledge levels of respondents equate to a lower likelihood of reporting, which can be positive for a facility. However, if the case was reportable, it may be harmful to patients. It is essential that the federal government take into account the regulatory burden placed on businesses; however, protecting the privacy of patients must still be a priority.
Click to expand...

guest · Dec 15, 2020

More Than 45 Million Medical Images Openly Accessible Online
December 14, 2020
https://cybelangel.com/blog/medical-data-leaks/

The analyst team at CybelAngel, a global leader in digital risk protection, has discovered that more than 45 million medical imaging files – including X-rays and CT scans – are freely accessible on unprotected servers, in a new research report released today.

The report “Full Body Exposure” is the result of a six-month investigation into Network Attached Storage (NAS) and Digital Imaging and Communications in Medicine (DICOM), the de facto standard used by healthcare professionals to send and receive medical data. The analysts discovered millions of sensitive images, including personal healthcare information (PHI), were available unencrypted and without password protection.
Click to expand...

CybelAngel tools scanned approximately 4.3 billion IP addresses and detected more than 45 million unique medical images left exposed on over 2,140 unprotected servers across 67 countries including the US, UK, France and Germany.

“The fact that we did not use any hacking tools throughout our research highlights the ease with which we were able to discover and access these files,” says David Sygula, Senior Cybersecurity Analyst at CybelAngel and author of the report.
Click to expand...

guest · Dec 16, 2020

Flaws in Medtronic MyCareLink can allow attackers to take over implanted cardiac devices
December 15, 2020
https://securityaffairs.co/wordpress/112328/hacking/medtronic-mycarelink-flaws.html

Experts from IoT security firm Sternum discovered vulnerabilities discovered in Medtronic’s MyCareLink Smart 25000 Patient Reader product that could be exploited to take control of a paired cardiac device.
The vulnerabilities ((CVE-2020-25183, CVE-2020-25187, CVE-2020-27252)) could be only exploited by an attacker within the Bluetooth range of the vulnerable product.

The experts found three flaws that could be exploited to modify or forge data that is received from the implanted cardiac devices. The flaws could also allow remote attackers to taking control of the paired cardiac device and execute arbitrary code on the MCL Smart Patient Reader.
Click to expand...

Medtronic Security Bulletin

guest · Dec 16, 2020

mood said: ↑

Sonoma Valley Hospital computer systems shut down by ‘security incident’
October 22, 2020
https://www.sonomanews.com/article/news/hospital-computer-systems-shut-down-by-security-incident/
Click to expand...

Sonoma Valley Hospital Informs 67,000 Patients of Data Breach
December 16, 2020
https://hotforsecurity.bitdefender....orms-67000-patients-of-data-breach-24898.html

California-based Sonoma Valley Hospital (SVH) has sent out data breach notifications to about 67,000 patients whose personal health information may have been compromised during a ransomware attack on October 11.

According to an update by the hospital, the cyber-attack is believed to have been part of a more extensive ransomware campaign targeting healthcare facilities across the United States.

“As we reported recently, Sonoma Valley Hospital experienced a ransomware cyberattack on October 11, 2020, by what we believe is a Russian ’threat actor.’ This event was part of a broader attack on dozens of hospitals across the country,” SVH said.
Click to expand...

The letter sent to possible victims includes security measures that patients can apply to protect against identity theft and fraud. It is highly recommended for patients to closely review their medical bills and records in upcoming months for mismatches and notify their medical provider and law enforcement if they suspect any fraudulent charges.
Click to expand...

guest · Dec 17, 2020

Company that Provides Travel Emergency Services Settles FTC Allegations it Failed to Secure Sensitive Consumer Data
December 16, 2020
https://www.ftc.gov/news-events/pre...rovides-travel-emergency-services-settles-ftc

A Nevada-based company that provides travel emergency services must put in place a comprehensive information security program as part of a settlement with the Federal Trade Commission over allegations the company failed to take reasonable steps to secure sensitive consumer information such as health records.

In a complaint against SkyMed International, Inc., the FTC alleged that the company failed to take reasonable measures to secure the personal information it collected from people who had signed up for its emergency travel membership plan, and as a result, the company left unsecured a cloud database containing 130,000 membership records.

“People who bought travel protection services trusted SkyMed with their personal health information, and SkyMed had an obligation to keep that information secure,” said Andrew Smith, Director of the FTC’s Bureau of Consumer Protection. “The security of personal health information is a key priority for the FTC, and we will take action against companies that fail to implement robust data protection programs.”
Click to expand...

The FTC also alleged that SkyMed deceived consumers by displaying for nearly five years a “HIPAA Compliance” seal on every page of its website, which gave the impression that its privacy policies had been reviewed and met the security and privacy requirements of the Health Information Portability and Accountability Act (HIPAA). In fact, no government agency or other third party had reviewed SkyMed’s information practices for compliance with HIPAA.
Click to expand...

guest · Dec 18, 2020

OCR: Healthcare HIPAA Compliance Report Finds PHI Security Failures
December 18, 2020
https://healthitsecurity.com/news/ocr-healthcare-hipaa-compliance-report-finds-phi-security-failures

The Department of Health and Human Services Office for Civil Rights released an audit report on HIPAA compliance in the sector from 2016 to 2017 based on reviews of selected healthcare covered entities and business associates, which revealed several protected health information security failures.

Under HITECH, HHS is required to periodically conduct audits on industry compliance with the HIPAA rules. For its latest report, OCR conducted reviews of 166 covered entities and 41 business associates, which have been notified of the agency’s findings.

“The audits gave OCR an opportunity to examine mechanisms for compliance, identify promising practices for protecting the privacy and security of health information, and discover risks and vulnerabilities that may not have been revealed by OCR’s enforcement activities,” according to the report.
Click to expand...

A review of the audit report can prove useful to covered entities and business associates to strengthen their own HIPAA compliance, while shedding light on the OCR auditing process to bolster privacy and security practices across the enterprise.
Click to expand...

Audit Report (PDF): https://www.hhs.gov/sites/default/files/hipaa-audits-industry-report.pdf

guest · Dec 18, 2020

Email Account Breaches Reported by Meharry Medical College and MEDNAX Services
December 18, 2020
https://www.hipaajournal.com/email-...-meharry-medical-college-and-mednax-services/

Meharry Medical College in Nashville, TN, has discovered an email account breach may have resulted in unauthorized individuals viewing or acquiring the protected health information of up to 20,983 patients.

The email account breach was detected and blocked around July 28, 2020. Third-party technical experts were engaged to investigate the breach and confirmed that the incident was limited to a single email account.
A review of the content of the email account was performed and it was determined the email account contained patients’ full names, dates of birth, diagnoses/diagnostic codes, internal patient account numbers, provider names, and other health information.
Click to expand...

PHI Potentially Compromised in Phishing Attack on MEDNAX Services Inc.
Sunrise, FL-based MEDNAX Services Inc, a provider of revenue cycle management and other administrative services to its affiliated physician practice groups, discovered on June 19, 2020 that unauthorized individuals had gained access to its Microsoft Office 365-hosted email system after employees responded to phishing emails.
Click to expand...

guest · Dec 21, 2020

TennCare announces privacy breach impacting 3,300 members
December 21, 2020
https://www.wkrn.com/news/tenncare-announces-privacy-breach-impacting-3300-members/

TennCare, Gainwell Technologies LLC, and Axis Direct, Inc. announced a privacy breach impacting certain TennCare members in a joint statement on Monday.
According to the statement, around 3,300 Medicaid members in the state of Tennessee have been notified of a privacy issue that may have impacted their health information.

Gainwell, which runs the Medicaid Management Information System (MMIS) for the state, notified TennCare of the issue on October 23. An investigation found that roughly 3,300 mailings sent out in late 2019 and 2020 may have been misaddressed and gone to the wrong person. Those mailings were managed by vendor for the state, called Axis Direct.
Those mailings contained protected health information of TennCare members.
Click to expand...

guest · Dec 22, 2020

November 2020 Healthcare Data Breach Report
December 22, 2020
https://www.hipaajournal.com/november-2020-healthcare-data-breach-report/

For the second successive month, the number of reported healthcare data breaches has fallen; however, it should be noted that the number of breaches reported in October 2020 was almost three times the average monthly number due, in a large part, to the ransomware attack on the cloud service provider Blackbaud.

November saw 47 data breaches of 500 or more healthcare records reported to the HHS’ Office for Civil Rights by HIPAA-covered entities and business associates, 25.39% fewer than October. Even with that reduction, breaches are still well above the 12-month average of 41 data breaches a month (Median = 38 breaches).
Click to expand...

Causes of November 2020 Healthcare Data Breaches
Hacking/IT incidents continue to dominate the breach reports, both in terms of the number of breaches and the number of breached records. There were 23 hacking/IT incidents reported in November – 48.94% of all breaches reported in the month. 867,983 records were exposed or stolen in those breaches – 76.2% of all records breached in November.
Click to expand...

guest · Dec 23, 2020

mood said: ↑

eHealth hit by ransomware attack but personal health data is secure, says spokesperson
January 6, 2020
https://www.cbc.ca/news/canada/sask...th-data-is-secure-says-spokesperson-1.5416261
Click to expand...

One year later, Saskatchewan government still isn’t sure what data were exfiltrated in cyberattack
Potential privacy breach of Saskatchewan health records in January 2020 malware attack
December 22, 2020
https://globalnews.ca/news/7537390/privacy-breach-saskatchewan-health-records-malware-attack/

The Saskatchewan government says a privacy breach may have occurred in an eHealth malware attack in January 2020.

The malware then spread throughout Saskatchewan’s IT system, officials said, and resulted in a ransomware attack.
eHealth said it managed to contain and eliminate the malware and restore compromised files after the attack was discovered.
Click to expand...

However, they were unable to accurately determine what information was sent to the IP address.

“While the forensic investigation rendered no evidence that personal health information was compromised, the investigation was unable to rule out a breach of personal health information,” said a government statement.
eHealth said it continues to monitor the internet for any signs the files are in the wrong hands and said there is no evidence of this after its latest six-week scan was completed in November.
Click to expand...

guest · Dec 24, 2020

Vermont Hospital Says Cyberattack Was Ransomware
December 24, 2020
https://www.securityweek.com/vermont-hospital-says-cyberattack-was-ransomware

While the Burlington-based University of Vermont Health Network, which serves hospitals in Vermont and upstate New York, had said its systems were attacked on Oct. 28, officials had not confirmed the attack that disabled the system’s 600 applications was ransomware.

On Tuesday, hospital officials said its information technology workers found a file directing them to contact the attackers if they wanted their systems restored, but it did not contain a request for money.

“We considered it for about five seconds,” said Doug Gentile, the chief information officer for the UVM Health Network.
Click to expand...

The hospital said that before the attack they had strong security measures in place, but the attackers still found a way in.
Click to expand...

guest · Dec 24, 2020

Agency for Community Treatment Services, Inc. Notification of Data Security Incident
December 24, 2020
https://www.prnewswire.com/news-rel...tion-of-data-security-incident-301198356.html

TAMPA, Fla., Dec. 24, 2020 /PRNewswire/ -- The Agency for Community Treatment Services, Inc. ("ACTS") announced today that it has taken action after learning of a data security incident which may have compromised the personal information and/or protected health information of patients who received care from ACTS from 2000 through 2013. ACTS began providing notice to all potentially impacted individuals on December 22, 2020.

What Happened? On October 23, 2020, ACTS became aware of a data security incident, including ransomware, that impacted portions of its server and data infrastructure. ACTS immediately took its systems offline and undertook efforts to restore its servers with additional high-level security mechanisms and monitoring.
Click to expand...

The forensic investigation did determine that first access to ACTS' systems occurred on approximately October 21, 2020, with the ransomware launched on October 23, 2020. The data security incident may have resulted in unauthorized access to or acquisition of personal information, including names, date of birth, and Social Security numbers, as well as protected health information, including medical records, treatment information, health insurance information in connection with the provision of treatment services at ACTS from 2000 through 2013.
Click to expand...

guest · Dec 24, 2020

Savoyard hospital slows down after ransomware
December 24, 2020
https://www.newspage.us/2020/12/24/savoyard-hospital-slows-down-after-ransomware/

The Center hospitalier Albertville-Moûtiers (CHAM), located in Savoie, announced on December 23 that it had been the victim of a ransomware attack. The Albertville and Moûtiers hospital sites as well as the Claude Léger and Les Cordeliers health centers are also affected.
A complaint filed
The CHAM approached the Cybersecurity Support for Health Structures (ACSS), the body responsible for providing support to health structures in the management of security incidents, and the National Agency for the Security of Health Systems. information (Anssi) to try to stop the cyberattack. The management of CHAM also lodged a complaint.

The security incident damaged its information system and made unavailable “a certain number of equipment, servers, software as well as part of the computer network”, details Le Figaro.
Click to expand...

Access to patient records broken
In addition, to prevent the spread of malware, the entire hospital computer network has been purposely shut down. This makes it impossible to access medical and patient care records. “It’s very complicated for all services, we are confined to IT and it may last“said a hospital worker.
Click to expand...

guest · Dec 26, 2020

NIST Releases Final Guidance on Securing the Picture Archiving and Communication System (PACS) Ecosystem
December 22, 2020
https://www.hipaajournal.com/nist-f...ving-and-communication-system-pacs-ecosystem/

The National Cybersecurity Center of Excellence (NCCoE) at the National Institute of Standards and Technology (NIST) has released final guidance for healthcare delivery organizations on securing the Picture Archiving and Communication System (PACS) ecosystem.

1800-24“The final practice guide, which in addition to incorporating feedback from the public and other stakeholders, builds on the draft guide by adding remote storage capabilities into the PACS architecture. This effort offers a more comprehensive security solution that more closely mirrors real-world HDO networking environments,” explained NIST.
This practice guide can be used by HIPAA covered entities and their business associates to implement current cybersecurity standards and best practices to reduce their cybersecurity risk, while maintaining the performance and usability of PACS
Click to expand...

NIST Cybersecurity Special Publication 1800-24, Securing Picture Archiving and Communication System (PACS): Cybersecurity for the Healthcare Sector is available on this link.
Click to expand...

NIST: Securing Picture Archiving and Communication System (PACS)--Cybersecurity for the Healthcare Sector: NIST SP 1800-24

A new NIST Cybersecurity Practice Guide, NIST SP 1800-24, is now available: Securing Picture Archiving and Communication System (PACS): Cybersecurity for the Healthcare Sector.

Medical imaging plays an important role in diagnosing and treating patients. The system that that manages medical images is known as the Picture Archiving Communications System (PACS) and is nearly ubiquitous in healthcare environments. PACS fits within a highly complex healthcare delivery organization (HDO) environment that involves interfacing with a range of interconnected systems.
Click to expand...

guest · Jan 1, 2021

Northwestern Memorial Hospital says former temp worker may have improperly viewed patient records
The hospital said it learned of the incident Dec. 2.
December 31, 2020
https://chicago.suntimes.com/business/2020/12/31/22208012/northwestern-memorial-hospital-data-breach-patient-records

A former temp agency worker at Northwestern Memorial Hospital may have inappropriately viewed patient records, the hospital said this week.

The hospital said it learned about the incident on Dec. 2 and that the worker, who no longer works at Northwestern, “may have accessed patient medical records without an identified work-related purpose between Oct. 27, 2020, and Dec. 2, 2020.”
An investigation found the worker may have viewed patient names and addresses, as well as detailed treatment information — but not Social Security numbers or patient financial information, the hospital said.
Click to expand...

The hospital said the worker viewed the records of 682 patients, but it was unclear why. The hospital plans to send letters to patients informing them about the incident.
Click to expand...

guest · Jan 4, 2021

Can Healthcare Shore Up Insider Threats, Transparency Needs in 2021?
January 4, 2021
https://healthitsecurity.com/news/can-healthcare-shore-up-insider-threats-transparency-needs-in-2021

Ransomware is often the prime headline-stealing topic when it comes to cybersecurity and risks to the healthcare sector. But many entities often overlook the dominance of insider threats and its overall prevalence in a majority of these attacks.

Previous data has found the healthcare sector is the worst at stopping insider-related breaches, with a 2019 Verizon report revealing that insider security threats were a bigger concern than hacking.
In fact, insiders have been consistently named the biggest risk to healthcare data each year.
Click to expand...

Given the increase in remote work and telehealth in the last year in response to the national crisis, the need for transparency in the sector is paramount. As cybercriminals continue to prey on human nature and social engineering attacks, these concerns should be a key focus for healthcare organizations into 2021.

“The challenge is in protecting against passive, or accidental insider threats, such as malware, mistakes, etc., and active internal threats that are realized with intent, at the same time.”
Adding to these challenges in healthcare, is the need for balancing transparency with the confidentiality and integrity of data.
Click to expand...

guest · Jan 4, 2021

ronjor said: ↑

Amazon's joint health-care venture finally has a name: Haven
Click to expand...

Haven -- the joint health care venture by Amazon, Berkshire and JPMorgan -- is shutting down
January 4, 2021
https://edition.cnn.com/2021/01/04/...ing-down-amazon-jpmorgan-berkshire/index.html

Haven, an ambitious health care company formed just three years ago as a partnership between Amazon, Warren Buffett's Berkshire Hathaway and JPMorgan Chase, is shutting down.

"Haven will end its operations at the end of February," said Haven spokesperson Brooke Thurston in an email to CNN Business. The news was first reported by CNBC.
The venture was created in 2018 with the goal of helping provide better health care services and insurance at a lower cost to workers and families at these three leading American firms -- and potentially to other US companies as well.
Click to expand...

A spokesman for JPMorgan Chase (JPM) also confirmed to CNN Business that Haven was shutting down. Amazon (AMZN) and Berkshire Hathaway (BRKB) were not immediately available for comment.

Going forward, the three companies are expected to continue to focus on boosting the health care offerings for their own employees, especially as the Covid-19 vaccine becomes available to a wider group of Americans.
Click to expand...

guest · Jan 5, 2021

Healthcare Industry Witnessed 45% Spike in Cyber Attacks Since Nov 20
January 6, 2021
https://thehackernews.com/2021/01/healthcare-industry-witnessed-45-spike.html

Cyberattacks targeting healthcare organizations have spiked by 45% since November 2020 as COVID-19 cases continue to increase globally.

According to a new report published by Check Point Research today and shared with The Hacker News, this increase has made the sector the most targeted industry by cybercriminals when compared to an overall 22% increase in cyberattacks across all industry sectors worldwide seen during the same time period.
Click to expand...

The average number of weekly attacks in the healthcare sector reached 626 per organization in November as opposed to 430 the previous month, with attack vectors ranging from ransomware, botnets, remote code execution, and distributed denial-of-service (DDoS) attacks.

Central Europe topped the list of regions impacted by the increase in attacks against healthcare organizations with a 145% uptick in November, followed by East Asia (up 137%) and Latin America (up 112% increase). Europe and North America saw increases of 67% and 37% respectively.
Click to expand...

guest · Jan 8, 2021

mood said: ↑

A ransomware attack hit the Greater Baltimore Medical Center
December 7, 2020
https://securityaffairs.co/wordpress/112017/malware/greater-baltimore-medical-center-ransomware.html
Click to expand...

Maryland hospital brings EHR back online 1 month after ransomware attack
January 8, 2021
https://www.beckershospitalreview.c...k-online-1-month-after-ransomware-attack.html

Towson, Md.-based Greater Baltimore Medical Center HealthCare began restoring its EHR system Jan. 6 after a December ransomware attack shut down many of its IT systems.

In addition to the EHR, the Dec. 6 cyberattack disrupted GBMC's communication and data infrastructure systems, leaving the hospital to shut them down as a precaution. GBMC continued operations during the downtime but did reschedule some procedures.

"We were attacked, and all our tightly connected computer systems went down. In addition, we have telephones that work via computers; they went down, as well,” GBMC President and CEO John Chessare, MD, said in a note and video message to patients Jan. 6, according to The Baltimore Sun.
Click to expand...

guest · Jan 10, 2021

OCR Releases Report Summarizing HIPAA Privacy and Security Compliance Failures
January 7, 2021
https://www.workplaceprivacyreport....paa-privacy-and-security-compliance-failures/

In the final days of 2020, the Office for Civil Rights (OCR) at the U.S. Health and Human Service (HHS) released a HIPAA Audits Industry Report (“the Report”), that could be quite helpful to covered entities and business associates for tackling HIPAA compliance as we enter the new year.

The Report examines OCR’s findings from HIPAA audits the agency conducted during 2016-2017 of 166 healthcare providers and 41 business associates. The audits were intended to examine mechanisms for compliance, identify promising practices for protecting the privacy and security for health information, and discover vulnerabilities that may be have been overlooked by OCR enforcement activity.
Click to expand...

guest · Jan 10, 2021

Ransomware and EHR Systems: A Dangerous Mix
Attack on Greater Baltimore Medical Center Spotlights the Fallout
January 8, 2021
https://www.inforisktoday.com/ransomware-ehr-systems-dangerous-mix-a-15731

A Baltimore medical center that suffered a ransomware attack a month ago and pulled its electronic health records system offline as a precaution during the recovery is finally beginning to restore access to the system, the organization's CEO says.

The situation in Baltimore is the latest example of how a ransomware incident can cripple a healthcare organization's ability to access and use EHR systems following an attack, regardless of whether those systems were actually infected by the malware.
Click to expand...

Swift Action Needed
Healthcare entities detecting a ransomware attack or other cyber incident must take swift action - such as immediately isolating the impacted system and removing it from the network - to ensure that the malware does not also cripple the organization's EHR.

"Early detection is critical, and once you have found it, the next critical step is to quarantine the infected device or network segment," says former healthcare CIO David Finn, executive vice president of security consultancy CynergisTek. "You must literally isolate it on your network so it cannot spread and it can be remediated in place."
Click to expand...

guest · Jan 16, 2021

ronjor said: ↑

https://threatpost.com/ny-health-provider-excellus-discloses-data-breach-dating-to-2013/114615/
Click to expand...

Excellus Health Plan Hit With $5.1 Million HIPAA Settlement
Security Shortcomings Found in Wake of Major Data Breach
January 15, 2021
https://www.databreachtoday.com/excellus-health-plan-hit-51-million-hipaa-settlement-a-15777

The Department of Health and Human Services has slapped insurer Excellus Health Plan with a $5.1 million settlement in the wake of a 2015 breach that affected more than 9.3 million individuals.

Excellus, which serves upstate and western New York, in September 2015 filed a breach report stating that intruders had gained unauthorized access to its information systems, HHS' Office for Civil Rights says in a statement Friday.
Click to expand...

The Blue Cross Blue Shield health plan reported that the breach began on or before Dec. 23, 2013, and ended on May 11, 2015.

"The hackers installed malware and conducted reconnaissance activities that ultimately resulted in the impermissible disclosure of the protected health information of more than 9.3 million individuals, including their names, addresses, dates of birth, email addresses, Social Security numbers, bank account information, health plan claims, and clinical treatment information," OCR says.
Click to expand...

guest · Jan 17, 2021

Hendrick: Computer network breach compromised some patients' information
January 15, 2021
https://eu.reporternews.com/story/m...patient-information-cybersecurity/4177234001/

Hendrick Health System on Friday began notifying patients that some identifying information may have been compromised during a network security breach identified Nov. 20.

An investigation determined that patient information may have been accessible between Oct. 10 and Nov. 9, the release said, including patient names, Social Security numbers, demographic and other limited information about care provided by Hendrick.
The breach disrupted computer operations at Hendrick Medical Center and Hendrick Clinic.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches