Why Healthcare Security Matters

guest · Nov 20, 2021

Episcopal Retirement Services Notifies Patients and Residents of Data Security Incident
https://www.episcopalretirement.com/corporate/datasecuritynotification

On or about September 24, 2021, Episcopal Retirement Services discovered that we were the victim of a cyber-attack that impacted its systems and servers. At that time, our technology team acted quickly to restore and secure its systems. However, on October 22, 2021, we experienced a ransomware attack. At this time, we learned that the September incident was also a ransomware attack.

The investigation is ongoing, but we believe that the unauthorized individual could have potentially obtained or accessed protected personal health information. With this said, as of the date of this release, we have no evidence indicating that any information has been misused.
Click to expand...

The types of protected health information potentially involved include first and last names, addresses, names, gender, home addresses, phone numbers, dates of birth, and social security numbers. It may also include medical diagnoses, health care provider names, insurance numbers, and Medicare numbers.
Click to expand...

Maine Attorney General’s office: Data Breach Notification - Episcopal Retirement Services

guest · Nov 23, 2021

October 2021 Healthcare Data Breach Report
November 22, 2021
https://www.hipaajournal.com/october-2021-healthcare-data-breach-report/

October saw 59 healthcare data breaches of 500 or more records reported to the Department of Health and Human Services’ Office for Civil Rights, which represents a 25.5% increase from September. Over the past 12 months, from November 2020 to October 2021, there have been 655 reported breaches of 500 or more records, 546 of which have been reported in 2021.
Largest Healthcare Data Breaches in October 2021
There were 18 data breaches reported to the HHS’ Office for Civil Rights in October that impacted 10,000 or more individuals, as detailed in the table below.
Click to expand...

The worst breach of the month was reported by Eskenazi Health. The PHI of more than 1.5 million patients was exposed and patient data is known to have been stolen in the attack.
A major ransomware attack was also reported by Sea Mar Community Health Centers. Its systems were first compromised in December 2020, the ransomware attack was identified in March 2021, and Sea Mar was notified about the posting of patient data on a darknet marketplace in June. It took until late October to issue notifications to affected individuals.
Click to expand...

Causes of October 2021 Healthcare Data Breaches
Data breaches classified as hacking/IT incidents, which include ransomware attacks, were the main cause of data breaches in October. 57.63% of all breaches reported in the month were classified as hacking/IT incidents and they accounted for 94.14% of all breached records (3,378,842 records). The average size of the data breaches was 99,378 records and the median breach size was 5,212 records.
Click to expand...

guest · Dec 6, 2021

Medical Data Exposed in Breach at True Health New Mexico
Insurer Counts Nearly 63,000 Victims; Offers Prepaid Credit Monitoring
November 26, 2021

A health insurer in New Mexico is warning of a data breach that exposed personal and medical information.

True Health New Mexico says in a security advisory posted to its website that it first learned of the security incident on Oct. 5, following an "early October" intrusion.
THNM, which describes itself as a physician-led health insurance company, says the breach exposed names, birthdates, physical addresses, email addresses, insurance information, medical information, Social Security numbers, health account member IDs, provider information, dates of service and provider identification numbers.
Click to expand...

guest · Dec 6, 2021

Telehealth takes off but security concerns persist
November 29, 2021

While 91 percent of medical organizations have already implemented telehealth capabilities, 52 percent of respondents have experienced cases where patients refused to use the services due to security concerns.

This is the key finding of a new research study by Kaspersky which also shows the pandemic has had a major effect with 44 percent of organizations implementing telehealth after COVID-19 hit.
What's more, 56 percent of healthcare institutions are planning to increase their investment in telehealth and virtual care solutions. 42 percent say most of their patients are more interested in remote than in-person sessions because of their convenience.
Click to expand...

And it's not only patients who are worried, 81 percent of healthcare providers say that clinicians in their organization have voiced concerns about patients' data protection when conducting remote sessions, and only 36 percent of respondents are very confident that their organization has the necessary security measures.
Click to expand...

Kaspersky: Nine out of ten healthcare organizations provide telehealth services, yet almost half face patients’ mistrust towards privacy

guest · Dec 6, 2021

Quest’s ReproSource faces patient lawsuit over data breach impacting 350K patients
November 30, 2021

One month after notifying 350,000 patients of a potential theft of their protected health information, ReproSource Fertility Diagnostics has been sued by a patient over alleged security failings. ReproSource is a clinical laboratory for fertility specialists and a subsidiary of Quest Diagnostics.

First disclosed Oct. 8, an attacker hacked into the ReproSource network in early August. The security team detected the intrusion two days later when the ransomware was deployed, but not before the actor possibly accessed or exfiltrated certain patient health information.
Quest officials informed patients of the ongoing investigation and that a follow-up disclosure may be released at its completion.
Click to expand...

It should be noted that the breach disclosure was within the 60-day timeframe required by The Health Insurance Portability and Accountability Act.

The lawsuit claims the breach was caused by ReproSource failing to take reasonable measures to protect patient data, detailing the elements recommended by a number of cybersecurity leaders.
The suit outlines the ongoing attacks against the healthcare sector that have plagued the sector and asserts that the breach could have been prevented if these measures were implemented.
Click to expand...

guest · Dec 6, 2021

Data hacked for 400,000 Planned Parenthood LA patients
December 2, 2021

The Los Angeles branch of Planned Parenthood was hit by a data breach involving about 400,000 patients, but there is no indication that the information was used "for fraudulent purposes," the group said.

A hacker installed computer malware between Oct. 9 and Oct. 17 and "exfiltrated" files containing patient names and possibly addresses, insurance and medical information, including procedures they may have undergone, Planned Parenthood Los Angeles warned Tuesday.

"Patients are encouraged to review statements from their healthcare providers or health insurers and contact them immediately if they see charges for services they did not receive," the branch said in a statement.
The attack involved ransomware, software that hackers can use to lock an organization out of its own computer network until a ransom is paid, but the group didn't immediately say whether any ransom was paid.
Click to expand...

Planned Parenthood has been hacked before. The Metropolitan Washington branch this year revealed that patient and donor information was breached in 2020, and in 2015, hackers posted online the names and other information on hundreds of Planned Parenthood employees.
Click to expand...

guest · Dec 6, 2021

HHS Launches 405(d) Program Website Providing Resources to Help Mitigate Healthcare Cybersecurity Threats
December 3, 2021

The Department of Health and Human Services has launched a new website that offers advice and resources to help the healthcare and public health sector mitigate cybersecurity threats.

The website was created as part of the HHS 405(d) Aligning Health Care Industry Security Approaches Program, which was established in response to the Cybersecurity Act of 2015. The Cybersecurity Act of 2015 called for the HHS to establish the program and a Task Group to enhance cybersecurity and align industry approaches by developing a common set of voluntary, consensus-based, and industry-led cybersecurity guidelines, practices, methodologies, procedures and processes that healthcare organizations can use.
Click to expand...

More than 150 individuals from industry and the federal government have collaborated under the program and provided insights into how best to mitigate cyberthreats.

“The new 405(d) Program website is a step forward for HHS to help build cybersecurity resiliency across the Healthcare and Public Health Sector. This is also an exciting moment for the HHS Office of the Chief Information Officer in our ongoing partnership with industry,” said Christopher Bollerer, HHS Acting Chief Information Security Officer.
Click to expand...

HHS.gov: HHS launches website for the 405(d) Aligning Health Care Industry Security Approaches Program

guest · Dec 6, 2021

Patient Sues Eskenazi Health Over Ransomware Attack After Misuse of Her Data
December 2, 2021

An Eskenazi Health patient whose protected health information was stolen in an August 2021 ransomware attack is suing the healthcare provider over the data breach.

It is now common for ransomware gangs to exfiltrate sensitive data prior to using ransomware to encrypt files. The stolen data is used to threaten victims to encourage payment of the ransom, as was the case in the Eskenazi Health ransomware attack.
The investigation into the breach determined its systems had first been compromised in May and files containing sensitive patient data had been exfiltrated from its systems.
Click to expand...

The lawsuit alleges patients placed their trust in Eskenazi Health to secure its systems and protect patient data, but the healthcare provider betrayed that trust by failing to implement up-to-date security practices and appropriate safeguards to protect patient data. The lawsuit alleges negligence, breach of contract, and unjust enrichment.

The lawsuit, which was filed by Cohen and Malad and John Steinkamp & Associates, seeks class action status and requests a jury trial. A spokesperson for Eskenazi Health said the lawsuit has yet to be formally served.
Click to expand...

ronjor · Dec 8, 2021

Over 40 million people had health information leaked this year

By Nicole Wetsman Dec 8, 2021
Over 40 million people in the United States had their personal health information exposed in data breaches this year, a significant jump from 2020 and a continuation of a trend toward more and more health data hacks and leaks.
Click to expand...

Health organizations are required to report any health data breaches that impact 500 or more people to the Office for Civil Rights at the Department of Health and Human Services, which makes the breaches public. So far this year, the office has received reports of 578 breaches, according to its database. That’s fewer than the 599 breaches reported in 2020, but last year’s breaches only affected about 26 million people.
Click to expand...

guest · Dec 21, 2021

Healthcare provider Texas ENT alerts 535,000 patients to data breach
December 20, 2021

More than half a million patients have been impacted by a data breach at US healthcare provider Texas Ear, Nose and Throat Specialists (Texas ENT).

After learning of a security compromise on October 19, Texas ENT “determined that unauthorized parties gained access to our computer systems and took copies of Texas ENT files between August 9, 2021 and August 15, 2021”, reads a security alert (PDF) from the healthcare specialist.
Click to expand...

The breached data includes patient names, dates of birth, medical record numbers, procedure codes used for billing purposes, and, for only “a limited number of files”, Social Security numbers.
The unauthorized intruders did not access the company’s electronic medical records system, Texas ENT stressed.

It also urged patients to be vigilant about fraudsters in the wake of the breach: “It is always advisable to review the statements from healthcare providers for accuracy, and we recommend contacting your provider if you see services that were not received”, the organization advised.
Click to expand...

guest · Dec 21, 2021

Ransomware attacks on CompuGroup Medical SE & Co. KGaA
December 21, 2021

CompuGroup Medical SE & Co. KGaA, a major medical services provider, has been the victim of a cyberattack. The Koblenz-based medical services provider admitted as much on Monday, Dec. 20, 2021. The internal IT systems are likely affected, which should affect some doctors, pharmacies, labs and clinics if they want to contact the company. Here is some information on what is known.
The cyber attack
The company CompuGroup Medical SE & Co. KGaA has been the victim of a cyberattack. I became aware of the facts through several blog readers directly (thanks for that), as well as via Twitter.
Click to expand...

The text above is in German, but on the companies website, there are also statements in English. The first statement talks about a technical issue caused by a cyber attack on the IT systems: [...]
An update around 10:50 p.m. then admits to a ransomware attack that affects the availability of some internal systems, such as email and phone services.

However, this update states that customer systems are not affected. And the ransomware attack is also said to have had no impact on customer data.
Click to expand...

Who is CompuGroup Medical SE & Co. KGaA?
CompuGroup Medical SE & Co. KGaA (short CGM)is a listed software company headquartered in Koblenz, Germany, which is one of the leading international providers of healthcare software with approximately 8000 employees (2021) and 746 million euros in revenue (2019).
Click to expand...

guest · Dec 22, 2021

Escalation in Healthcare Data Breaches
December 21, 2021

The number of healthcare data breaches reported in the United States has increased for the third month in a row.

Records kept by the Department of Health and Human Services’ Office for Civil Rights (OCR) indicate that the total number of reported data breaches impacting the US health sector in 2021 is likely to be higher than the total reported in any previous year.
Click to expand...

In November, the OCR received reports of 68 data breaches exposing 500 or more health records. This number was 15.25% higher than the 59 breaches reported in October.

While August saw only 38 such breaches reported, 47 breaches were reported in September. The total number of data breaches of 500 or more records reported to the OCR from January 1 to November 30 is 614.
Click to expand...

November 2021 Healthcare Data Breach Report
December 21, 2021

The number of reported healthcare data breaches has increased for the third successive month, with November seeing 68 data breaches of 500 or more records reported to the HHS’ Office for Civil Rights – a 15.25% increase from October and well above the 12-month average of 56 data breaches a month. From January 1 to November 30, 614 data breaches were reported to the Office for Civil Rights. It is looking increasingly likely that this year will be the worst ever year for healthcare data breaches.
Click to expand...

xxJackxx · Dec 22, 2021

I'm not surprised by any of this mess. As I spend portions of my day dealing with customers of medical auditing software I see a lot of places where the IT is contracted or on staff and doesn't want to deal with the issues or just doesn't care so I am sure the security is lacking more often than not. A lot of these folks a are HIPAA violation waiting to happen. Most of them spell that acronym wrong if that tells you anything. I guess once everyone's records are breached it won't matter anymore.

guest · Dec 31, 2021

Confusing data breach in Rhode Island leads to AG investigation
Now the ACLU is questioning why thousands of people with no relationship to RIPTA had their personal information leaked.
December 30, 2021

Rhode Island Attorney General Peter Neronha told The Providence Journal on Thursday that he is going to open an investigation into a data breach involving the Rhode Island Public Transit Authority (RIPTA). This comes after outrage grew this week over the agency's handling of the incident.

Neronha's office told the news outlet that they are receiving a high number of calls about the incident, prompting them to look into what happened.
Click to expand...

On December 21, RIPTA sent out a notice saying that August 5 was when it first identified a "security incident." RIPTA eventually discovered that data was exfiltrated from their systems between August 3 and August 5. The files contained information about RIPTA health plans and included Social Security numbers, addresses, dates of birth, Medicare identification numbers and qualification information, health plan member identification numbers, and claims information.

Earlier this week, the ACLU of Rhode Island asked RIPTA to explain why the personal information of people with no connection to the agency was included in the data breach.
Click to expand...

The ACLU also said that RIPTA was not being transparent about the breach, noting that RIPTA's public statements about the incident are very different than the letters being sent to victims. RIPTA's initial statement implied that those affected were only the beneficiaries of RIPTA health plans.
Click to expand...

guest · Dec 31, 2021

New HIPAA Regulations in 2022
December 30, 2021

It has been several years since new HIPAA regulations have been signed into law, but HIPAA changes in 2022 are expected. The last update to the HIPAA Rules was the HIPAA Omnibus Rule in 2013, which introduced new requirements mandated by the Health Information Technology for Economic and Clinical Health (HITECH) Act. OCR issued a Notice of Proposed Rulemaking (NPRM) on December 10, 2020, that proposed a slew of changes to the HIPAA Privacy Rule, and a Final Rule is expected to be issued in 2022; however, no date has yet been provided on when the 2022 HIPAA changes will take effect and become enforceable.
Click to expand...

guest · Jan 3, 2022

Broward Health discloses data breach affecting 1.3 million people
January 3, 2022

The Broward Health public health system has disclosed a large-scale data breach incident impacting 1,357,879 individuals.

Broward Health is a Florida-based healthcare system with over thirty locations offering a wide range of medical services and receives over 60,000 admissions per year.
Click to expand...

The healthcare system disclosed a cyberattack on October 15, 2021, when an intruder gained unauthorized access to the hospital's network and patient data.

An investigation revealed that the threat actors gained access to patient's personal medical information, which may include the following items: [...]
Although Broward Health confirms that the network intruder has exfiltrated the above data, it notes that there is no evidence that the threat actors misused it.
Click to expand...

Due to the critical nature of the exposed data, recipients of the notices need to remain vigilant against all forms of communication.
Click to expand...

guest · Jan 6, 2022

Black Country hospital trust suffers 'significant IT data loss'
January 4, 2022

It is understood the incident happened last month and is said to have 'disrupted' over 20 systems across Sandwell and West Birmingham Hospitals NHS Trust, which runs Birmingham's City Hospital, Rowley Regis Hospital and Sandwell General Hospital.

He says no patient data has been exfiltrated and the Information Commissioner is aware, saying the data loss incident was caused by a ‘recommended update’ and there was no evidence to suggest it was a cyber attack.
Click to expand...

In the report, Mr Beeken says: “December saw us witness a major IT incident which disrupted over 20 systems across the trust.

“While an independent external review of the cause and recovery of the systems impacted is underway the incident was caused by a recommended update and security patch to an operating system issued by an international software provider who subsequently advised to uninstall the patch through reported known issues.
“On attempting to remove the patch there was system and data loss.
Click to expand...

guest · Jan 6, 2022

US online pharmacy Ravkoo links data breach to AWS portal incident
January 6, 2022

Ravkoo, a US Internet-based pharmacy service, has disclosed a data breach after the company's AWS hosted cloud prescription portal was involved in a security incident that may have led to personal and health information being accessed.

"Ravkoo utilizes AWS cloud services for online hosting of its prescription portal. On September 27, 2021, Ravkoo detected that this portal was the target of a cybersecurity attack," the pharmacy said in data breach notification letters sent to 105,000 affected customers on January 3.
"An unauthorized third party attempted to infiltrate the portal. On October 27, 2021, Ravkoo's responsive forensic investigation revealed that certain prescription and health information could have been compromised."
Click to expand...

Alpesh Patel, the online pharmacy's CEO, said in a public notification on Ravkoo's site that the incident was reported to the FBI. The company is assisting the federal law enforcement agency's ongoing investigation into the matter.
Reportedly "hilariously easy" to hack
The details of the incident Ravkoo shared with Attorney Generals' offices from multiple states and affected customers line up with a report from The Intercept right after the incident took place saying that an anonymous hacker that Ravkoo was "hilariously easy" to breach.
Click to expand...

guest · Jan 9, 2022

Cyberattackers Hit Data of 80K Fertility Patients
January 7, 2022

The protected health information of nearly 80,000 patients of Fertility Centers of Illinois (FCI) may have been pawed over by cyber intruders following a cyberattack.

FCI runs four clinics across Illinois. According to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights’ data breach site, the breach – reported on Dec. 27 – affected 79,943 people.
Click to expand...

FCI’s data breach notice (PDF) said that the healthcare organization first detected suspicious activity on its internal systems on Feb. 1, 2021. A subsequent investigation indicated that security systems had blocked attackers from accessing patient EMR (electronic medical records) systems. However, the intruder(s) managed to access administrative files and folders.
Click to expand...

ronjor · Feb 8, 2022

Health sites let ads track visitors without telling them

Lily Hay Newman, wired.com - 2/7/2022
Third-party tools grab personal information from medical, genetic-testing company sites.
Click to expand...

ronjor · Apr 1, 2022

Writing Google reviews about patients is actually a HIPAA violation

By Nicole Wetsman Apr 1, 2022
A real one that resulted in a $50,000 fine
Click to expand...

ronjor · Apr 12, 2022

500,000 Impacted by Email Breach at Illinois Healthcare Firm

By Ionut Arghire on April 12, 2022
Christie Business Holdings Company (Christie Clinic), a major medical practice in Illinois, is informing roughly 500,000 individuals that their personal information was potentially compromised in a data breach.
Click to expand...

ronjor · Jun 4, 2022

Healthcare organizations face rising ransomware attacks – and are paying up

Jeff Burt Fri 3 Jun 2022
The good news is that healthcare organizations are aware that they are under attack. The majority of them have cyber insurance and are improving their security practices, Grajek said, adding that "the chickens are on alert that the fox is circling the hen house."
Click to expand...

ronjor · Jun 8, 2022

Data breach at health care organization may affect 2 million

Shields Health Care Group Inc., which provides imaging and ambulatory surgical services at dozens of locations, said in a notice on its website Tuesday that data including names, Social Security numbers, dates of birth, and medical or treatment details is among the information that may have been compromised.
Click to expand...

ronjor · Jun 16, 2022

Facebook Is Receiving Sensitive Medical Information from Hospital Websites

By Todd Feathers, Simon Fondrie-Teitler, Angie Waller, and Surya Mattu June 16, 2022
A tracking tool installed on many hospitals’ websites has been collecting patients’ sensitive health information—including details about their medical conditions, prescriptions, and doctor’s appointments—and sending it to Facebook.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

xxJackxx Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

xxJackxx Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches