Healthcare Cybersecurity

Healthcare Industry Scores Poorly on Employee Security Awareness

A recent report published by security awareness training company MediaPro has revealed there is still a lack of preparedness to deal with common cyberattack scenarios and privacy and security threats are still not fully understood by healthcare professionals.

For MediaPro’s 2017 State of Privacy and Security Awareness Report, the firm surveyed 1,009 US healthcare industry employees to assess their level of security awareness. Respondents were asked questions about common privacy and security threats and were asked to provide answers on several different threat scenarios to determine how they would respond to real world threats.

Based on the responses, MediaPro assigned respondents to one of three categories. Heroes were individuals who scored highly and displayed a thorough understanding of privacy and security threats by answering 93.5%-100% of questions correctly. Novices showed a reasonable understanding of threats, answering between 77.4% and 90.3% of answers correctly. The lowest category of ‘Risks’ was assigned to individuals with poor security awareness, who scored 74.2% or lower on the tests. Those individuals were deemed to pose a significant risk to their organization and the privacy of sensitive data.

Overall, 78% of healthcare employees were classified as risks or novices. The percentage of individuals rated in these two categories across all industry sectors was 70%, showing the healthcare industry still lags behind other industry sectors on security awareness and privacy and security best practices.

The survey revealed physicians’ understanding of privacy and security threats was particularly poor. Half of physicians who took part in the study were classified as risks, meaning their actions were a serious security threat to their organization. Awareness of the common identifiers of phishing emails was particularly poor, with 24% of physicians displaying a lack of understanding of phishing, compared with 8% of office workers and non-provider counterparts.

One of the main areas where security awareness was lacking was the identification of the common signs of a malware infection. 24% of healthcare employees had difficulty identifying the signs of a malware infection compared to 12% of the general population.

Healthcare employees scored worse than the general population in eight areas assessed by MediaPro: Incident reporting, identifying personal information, physical security, identifying phishing attempts, identifying the signs of malware infections, working remotely, cloud computing, and acceptable use of social media.

MediaPro points out that the 2017 Data Breach Investigations Report from Verizon showed human error accounted for more than 80% of healthcare data breaches last year, emphasizing the need for improved security awareness training for healthcare employees. Further, cybercriminals have been increasing their efforts to gain access to healthcare networks and sensitive patient information.

“The results of our survey show that more work needs to be done,” MediaPro explains in the report. “HIPAA courses often do not include information on how to stay cyber-secure in an increasingly interconnected world. Keeping within HIPAA regulations, while vital, does not educate users on how to spot a phishing attack, for example.”

If the security awareness of healthcare employees is not improved, the healthcare industry is likely to continue to be plagued by data breaches, irrespective of the level of maturity of their security defenses.

The post Healthcare Industry Scores Poorly on Employee Security Awareness appeared first on HIPAA Journal.

How Many HIPAA Violations in 2017 Resulted in Financial Penalties?

We are often asked about healthcare data breaches and HIPAA violations and two of the most recent questions are how many HIPAA violations in 2017 resulted in data breaches and how many HIPAA violations occurred in 2017.

How Many HIPAA Violations Occurred in 2017?

The problem with determining how many HIPAA violations occurred in 2017 is many violations are not reported, and out of those that are, it is only the HIPAA breaches that impact more than 500 individuals that are published by the Department of Health and Human Services’ Office for Civil Rights on its breach portal – often incorrectly referred to as the “Wall of Shame”.

To call it a ‘Wall of Shame’ is not fair on healthcare organizations because the breach reports show organizations that have experienced data breaches, NOT organizations that have violated HIPAA Rules. Even organizations with multi-million-dollar cybersecurity budgets, mature security defenses, and advanced employee security awareness training programs can experience data breaches. All it takes if for a patch not to be applied immediately or an employee to accidently click on a phishing link for a data breach to occur. The breach reports are therefore not an accurate guide to the number of HIPAA violations that have occurred.

Some attorneys general publish details of data breaches, and many of those breaches are the result of HIPAA violations; however, only a small number of states publish that data breach summaries and as with OCR’s breach portal, there are many breaches that have occurred at organizations that are fully compliant with HIPAA Rules. It is also not possible to say how many of those breaches were the result of HIPAA violations. That can only be determined with a detailed investigation.

Complaints about potential HIPAA violations are frequently submitted to OCR. These tend to be smaller incidents involving relatively few individuals, such as a patient who believes HIPAA Rules have been violated or employees who believe colleagues have violated HIPAA Rules. OCR occasionally releases figures on the number of complaints that it receives, but many of those complaints turn out to be unfounded and, in many cases, OCR cannot prove beyond reasonable doubt that a HIPAA violation has occurred.

It is also not possible to gauge the level of serious HIPAA violations that have occurred based on settlements and civil monetary penalties. Even when there is evidence to suggest HIPAA Rules have been violated, financial settlements are typically only pursued when a case against a HIPAA-covered entity is particularly strong and likely to be won.

It is therefore not possible to determine how many HIPAA violations in 2017 resulted in data breaches nor how many violations occurred last year.

How Many HIPAA Violations in 2017 Resulted in Financial Settlements?

It is also not possible to determine how many HIPAA violations in 2017 have resulted in financial penalties being issued, at least not yet. OCR and state attorneys general open investigations when data breaches are experienced or complaints are received about potential HIPAA violations. However, it takes time to conduct investigations and gather evidence. Even when there is evidence of HIPAA violations, cases can take years before settlements are reached or civil monetary penalties are issued.

The latest HIPAA settlement is a good example. Fresenius Medical Care North America settled its case with OCR for $3,500,000 in 2018, yet the data breaches that triggered the investigation occurred in 2012. The list below shows the settlements and civil monetary penalties issued in 2017 and the years in which the violations occurred.

So unfortunately, it is not possible to say how many HIPAA violations in 2017 resulted in financial penalties, as that will not be known for many years to come

HIPAA Settlements and Civil Monetary Penalties in 2017


Covered Entity Penalty Amount Penalty Type Reason for Penalty Date of Violation(s)
21st Century Oncology $2,300,000 Settlement Multiple HIPAA Violations 2015
Memorial Hermann Health System $2,400,000 Settlement Careless Handling of PHI 2015
St. Luke’s-Roosevelt Hospital Center Inc. $387,000 Settlement Unauthorized Disclosure of PHI 2014
The Center for Children’s Digestive Health $31,000 Settlement Lack of a Business Associate Agreement 2003-2015
Cardionet $2,500,000 Settlement Impermissible Disclosure of PHI 2011
Metro Community Provider Network $400,000 Settlement Lack of Security Management Process 2011
Memorial Healthcare System $5,500,000 Settlement Insufficient ePHI Access Controls 2007-2012
Children’s Medical Center of Dallas $3,200,000 Civil Monetary Penalty Impermissible Disclosure of ePHI 2006-2013
MAPFRE Life Insurance Company of Puerto Rico $2,200,000 Settlement Impermissible Disclosure of ePHI 2011
Presense Health $475,000 Settlement Delayed Breach Notifications 2013


What we can say is HIPAA violations have occurred at most healthcare organizations, although oftentimes the violations are minor and inconsequential. We can go further and say that a majority of healthcare organizations have failed to follow HIPAA Rules to the letter all of the time.

The evidence comes from the second round of HIPAA compliance audits conducted by OCR in late 2016 and 2017. A final report on the findings of the audits has yet to be published, but last September preliminary results were released. They showed that healthcare organizations are still not getting to grips with HIPAA Rules and noncompliance is commonplace.

Findings of the 2017 HIPAA Compliance Audits

Listed below are the preliminary findings of the second round of HIPAA compliance audits. The audits consisted of ‘Desk Audits’ conducted on 166 covered entities on the HIPAA Privacy, Security, and Breach Notification Rules and 41 business associates of HIPAA covered entities on the Security and Breach Notification Rules.

OCR gave each audited entity a rating from 1-5 based on the level of compliance. A rating of 1 means the organization was in compliance with the goals and objectives of the audited standards and implementation specifications. A rating of 5 was given to entities that did not provide OCR with evidence to show that a serious attempt had been made to comply with HIPAA Rules.

HIPAA Rule Aspect of HIPAA Rule 1 Rating 2 Rating 3 Rating 4 Rating 5 Rating N/A
Breach Notification Rule Timeliness of Notification 65% 6% 2% 9% 11% 7%
Breach Notification Rule Content of Notification 14% 14% 23% 37% 7% 5%
Privacy Rule Patient Right to Access 1% 10% 27% 54% 11% N/A
Privacy Rule Notice of Privacy Practices 2% 33% 39% 11% 15% 2%
Privacy Rule Provision of eNotice 57% 15% 4% 6% 15% 3%
Security Rule Risk Analysis 0% 2% 19% 23% 13% N/A
Security Rule Risk Management 1% 3% 13% 29% 17% N/A

The post How Many HIPAA Violations in 2017 Resulted in Financial Penalties? appeared first on HIPAA Journal.

VA OIG Discovers Security Vulnerabilities Introduced at Orlando VA Medical Center

The VA Office of Inspector General has discovered a Wi-Fi network was set up at a Florida VA medical center without being coordinated with the VA’s Office of Information & Technology (OI&T). As a result, vulnerabilities were introduced that could have been exploited to gain unauthorized access to VA systems.

The VA Office of Inspector General conducted an audit of the Orlando Veterans Affairs Medical Center (VAMC) at Lake Nona, FL after receiving a complaint that the Veterans Services Adaptable Network (VSAN) was being developed without coordination with the Office of Information & Technology (OI&T), and that appropriate funding for the project had not been obtained through proper channels.

While evidence of funding irregularities was not uncovered, the VA OIG did confirm that a WiFi network for patients had been set up without coordination with OI&T, and that the network did not have the appropriate security controls applied in accordance with VA policies.

After the network had been set up, a risk assessment was not performed and there was no segregation between the VSAN and VA network. The VA OIG explained in its report that the lack of oversight by local OI&T staff resulted in unnecessary risks being introduced that could have resulted in other VA systems being compromised. No evidence was uncovered to suggest any vulnerabilities had been exploited.

The VA OIG reports that staff did not ensure security controls were applied in accordance with the VA’s security requirements due to competing priorities and resources. A security risk assessment was not performed because management did not allocate the necessary resources to the task.

The VA OIG has recommended the executive in charge for the Office of the Under Secretary for Health and the executive in charge for the Office of Information and Technology ensure that all guest Internet networks, industrial control systems, and external air-gapped networks are properly segregated and meet VA security requirements.

The report highlights a common problem: The installation of software or use of hardware that has not been authorized by IT departments. Referred to as shadow IT, the unauthorized hardware and software can introduce vulnerabilities that may not be discovered and corrected by IT departments.

Without the oversight of the IT department, software may not be kept up to date and vulnerabilities could easily be exploited to gain access to healthcare networks.

Health IT departments can implement controls that prevent the installation of software by employees and employees should be instructed, in no uncertain terms, that the installation of software or use of devices without first having obtained authorization from the IT department is strictly prohibited.

IT departments should also consider conducting scans of the network to identify rogue devices that have been connected, although that means that IT departments must also maintain an accurate inventory of all authorized devices.

Network access tools can also be deployed to further protect healthcare networks. These tools restrict network access to authorized devices that have the appropriate security controls, AV software, and latest versions of software installed.

The post VA OIG Discovers Security Vulnerabilities Introduced at Orlando VA Medical Center appeared first on HIPAA Journal.

How Can Healthcare Organizations Protect Against Cyber Extortion

In its January 2018 Cybersecurity Newsletter, the Department of Health and Human Services’ Office for Civil Rights drew attention to the rise in extortion attempts on healthcare organizations and offered advice on how healthcare organizations can protect against cyber extortion

Ransomware Attacks Have Risen Significantly

Ransomware attacks on healthcare organizations have increased significantly over the past two years. Healthcare providers are heavily reliant on access to electronic data and any attack that prevents access is likely to have a major impact on patients. The inevitable disruption to services – and the cost of that disruption – makes it more likely that a ransom will be paid.

The relatively high probability of a ransom being paid, coupled with the ease of attacking healthcare organizations, has made the industry an attractive target for cybercriminals.

It may be more cost effective and better for patients if a ransom to be paid instead of recovering data from backups. That was certainly the view of Hancock Health. A ransom payment of 4 Bitcoin was paid to minimize disruption when data could have been recovered from backups.

Paying a ransom may seem preferable, but there is no guarantee that data will be recoverable. This year has seen wiper malware used that mimics ransomware. In such cases, there are no keys to unlock encrypted data. There have also cases of ransoms being paid, only for further demands to be sent, such as the 2016 ransomware attack on Kansas Heart Hospital.

Data Theft and Threats of Data Dumps

There have been numerous cases of data theft by hackers followed by threats to dump the data online if a ransom payment is not made – The modus operandi of the hacking group, TheDarkOverlord. The hacking group was responsible for many cyber extortion attacks on healthcare providers over the past 2 years.

Typically, this type of attack sees vulnerabilities exploited to gain access to data. Brute force attacks allow weak passwords to be guessed, and the past year saw several healthcare organizations have data stolen as a result of misconfigurations of databases and unsecured Amazon S3 buckets. Several attacks saw data deleted from healthcare organizations’ databases after data had been exfiltrated, adding an extra incentive to pay the ransom demand.

As with ransomware attacks, there is no guarantee that the attacker will return data, make good on a promise not to publish data or delete any copies of stolen PHI.

DoS and DDoS Attacks

Not all cyber extortion attempts involve the theft of data or use of encryption to prevent PHI access. Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks direct large volumes of traffic to computers and servers rendering them inaccessible. Demands for payment are often issued to stop the attacks, or threats of attacks are made unless payment is made.

How Can Healthcare Organizations Reduce Cyber Extortion Risk?

There are several ways that healthcare organization can reduce the risk of cyber extortion attacks, most of which are general cybersecurity best practices which should already have been adopted. Others are requirements of HIPAA Rules.

The most important measure, and one which so many healthcare organizations fail at,  is to perform a comprehensive, organization-wide risk analysis covering all systems and devices containing ePHI and systems/devices that can be used to access PHI. A risk management program must also be implemented that addresses all identified vulnerabilities and reduces them to an acceptable level.

Since so many cyber extortion attacks take advantage of unplugged vulnerabilities, healthcare organizations need to ensure all software and operating systems are kept up to date and patches are applied promptly. Robust inventory and vulnerability identification processes are necessary to ensure the accuracy and completeness of risk analyses.

Healthcare organizations should consider signing up with information Sharing and Analysis Organizations (ISAO) and other providers of threat intelligence to discover new threats and vulnerabilities in time to block attacks.

Ransomware attacks often occur as a result of healthcare employees responding to malicious emails. Unless a security awareness training program is implemented, employees will be a major weak point in security defenses. Technologies should also be implemented to block malicious emails and prevent them from reaching end users’ inboxes.

While anti-malware, anti-virus, and other signature-based malware defenses are not as effective as they once were, they are still an essential part of security defenses for healthcare organizations. Firewalls and other perimeter and network defenses should also be deployed, while internal defenses should be hardened to slow down attacks and prevent lateral movement within a network. Network segmentation is strongly recommended.

Just as encryption can prevent breaches when portable devices are lost or stolen, encryption can also prevent attackers from gaining access to sensitive data if the network is breached. Regular backups should also be created to ensure data recovery is possible without paying a ransom. A good backup strategy is the 3-2-1 approach. At least three copies of data, on two different media, with one copy stored securely off-site.

Backups are only of use if data recovery is possible. Backups should therefore be tested to make sure data has not been corrupted and can be recovered in the event of a cyberattack.

The post How Can Healthcare Organizations Protect Against Cyber Extortion appeared first on HIPAA Journal.

$3.5 Million Settlement to Resolve HIPAA Violations That Contributed to Five Data Breaches

The first HIPAA settlement of 2018 has been announced by the Department of Health and Human Services’ Office for Civil Rights (OCR). Fresenius Medical Care North America (FMCNA) has agreed to pay OCR $3.5 million to resolve multiple potential HIPAA violations that contributed to five separate data breaches in 2012.

The breaches were experienced at five separate covered entities, each of which was owned by FMCNA. Those breached entities were:

  • Bio-Medical Applications of Florida, Inc. d/b/a Fresenius Medical Care Duval Facility in Jacksonville, Florida (FMC Duval)
  • Bio-Medical Applications of Alabama, Inc. d/b/a Fresenius Medical Care Magnolia Grove in Semmes, Alabama (FMC Magnolia Grove)
  • Renal Dimensions, LLC d/b/a Fresenius Medical Care Ak-Chin in Maricopa, Arizona (FMC Ak-Chin)
  • Fresenius Vascular Care Augusta, LLC (FVC Augusta)
  • WSKC Dialysis Services, Inc. d/b/a Fresenius Medical Care Blue Island Dialysis (FMC Blue Island)

Breaches Experienced by FMCNA HIPAA Covered Entities

The five security breaches were experienced by the FMCNA covered entities over a period of four months between February 23, 2012 and July 18, 2012:

  • The theft of two desktop computers from FMC Duval during a February 23, 2012 break-in. The computers contained the ePHI – including Social Security numbers – of 200 individuals
  • The theft of an unencrypted USB drive from FMC Magnolia Grove on April 3, 2012. The device contained the PHI – including insurance account numbers – of 245 individuals
  • On April 6, 2012 FMC Ak-Chin discovered a hard drive was missing. The hard drive had been removed from a computer that had been taken out of service and the drive could not be located. The hard drive contained the PHI – including Social Security numbers – of 35 individuals
  • An unencrypted laptop computer containing the ePHI of 10 patients – including insurance details – was stolen from the vehicle of an employee on June 16, 2012. The laptop had been left in the vehicle overnight. The bag containing the laptop also contained the employee’s list of passwords
  • Three desktop computers and one encrypted laptop were stolen from FMC Blue Island on or around June 17-18, 2012. One of the computers contained the PHI – including Social Security numbers – of 35 patients

Multiple HIPAA Failures Identified

OCR launched an investigation into the breaches to establish whether they were the result of failures to comply with HIPAA Rules. The investigation revealed a catalogue of HIPAA failures.

OCR established that the FMCNA covered entities had failed to conduct a comprehensive and accurate risk analysis to identify all potential risks to the confidentiality, integrity, and availability of ePHI: One of the most common areas of non-compliance with HIPAA Rules. If an accurate risk assessment is not performed, risks are likely to be missed and will therefore not be managed and reduced to an acceptable level.

OCR also discovered the FMCNA covered entities had impermissibly disclosed the ePHI of many of its patients by providing access to PHI that is prohibited under the HIPAA Privacy Rule.

Several other potential HIPAA violations were discovered at some of the FMCNA covered entities.

FMC Magnolia Grove did not implement policies and procedures governing the receipt and removal of computer hardware and electronic storage devices containing ePHI from its facility, and neither the movement of those devices within its facility.

FMC Magnolia Grove and FVC Augusta had not implemented encryption, or an equivalent, alternative control in its place, when such a measure was reasonable and appropriate given the risk of exposure of ePHI.

FMC Duval and FMC Blue were discovered not to have sufficiently safeguarded their facilities and computers, which could potentially lead to unauthorized access, tampering, or theft of equipment.

FMC Ak-Chin had no policies and procedures in place to address security breaches.

Financial Penalty Reflects the Seriousness and Extent of HIPAA Violations

The $3.5 million settlement is one of the largest issued to date by OCR to resolve violations of HIPAA Rules. In addition to paying the sizeable financial penalty, FMCNA has agreed to adopt a robust corrective actin plan to address all HIPAA failures and bring its policies and procedures up to the standard demanded by HIPAA.

The FMCNA covered entities must conduct comprehensive, organization wide risk analyses to identify all risks to the confidentiality, integrity, and availability of PHI and develop a risk management plan to address all identified risks and reduce them to a reasonable and acceptable level.

Policies and procedures must also be developed and implemented covering device, media, and access controls and all staff must receive training on current and new HIPAA policies and procedures.

“The number of breaches, involving a variety of locations and vulnerabilities, highlights why there is no substitute for an enterprise-wide risk analysis for a covered entity,” said OCR Director Roger Severino. “Covered entities must take a thorough look at their internal policies and procedures to ensure they are protecting their patients’ health information in accordance with the law.”

Settlement Shows it is Not the Size of the Breach that Matters

All of the five breaches resulted in the exposure of relatively few patients’ PHI. No breach involved more than 235 records, and three of the breaches exposed fewer than 50 records.

The settlement shows that while the scale of the breach is considered when deciding on an appropriate financial penalty, it is the severity and the extent of non-compliance that is likely to see financial penalties pursued.

The settlement also clearly shows that OCR does investigate smaller breaches and will do so when breaches suggest HIPAA Rules have been violated.

The post $3.5 Million Settlement to Resolve HIPAA Violations That Contributed to Five Data Breaches appeared first on HIPAA Journal.

2017 Worst Year Ever for Cybersecurity Incidents According to Online Trust Alliance

According to the Online Trust Alliance´s “Cyber Incident & Breach Trends Report”, 2017 was the “worst year ever” for cybersecurity incidents. The organization estimates that, based on the number of reported breaches, there were nearly double the number of cybersecurity incidents than in 2016.  

The Online Trust Alliance´s “Cyber Incident & Breach Trends Report” is more than a review of the previous year´s cybersecurity incidents. The organization investigates how the incidents occurred in order to identify trends, and what could have been done to prevent the incidents so that businesses can implement appropriate measures to defend against future incidents.

The organization admits that the report´s headline figure of 159,700 cybersecurity incidents is a guesstimate based on the number of incidents reported during the third quarter of 2017. As the report states, many incidents are not reported, and the true figure could be much higher. However, using the same criteria, the organization guesstimated the number of cybersecurity incidents in 2016 at 82,000 – implying that there were nearly double in 2017.

Trends in Cybersecurity Incidents

The trends in cybersecurity incidents identified by the Online Trust Alliance will not surprise frequent visitors to HIPAA Journal. Ransomware attacks saw the biggest increase in numbers, but another type of ransom-based attack – the Ransom Denial-of-Service (RDoS) attack – was also identified as becoming more popular among cybercriminals. In this form of attack, cybercriminals threaten a Dedicated Denial-of-Service (DDoS) attack unless a ransom is paid in advance.

The organization also commented on the new risk threats generated by the growth in IoT devices, and an 85% increase in malicious email. The increase in malicious mail included a 90% increase in business-targeted ransomware and a rise in the number of BEC attacks. It was calculated there had been a four-fold increase in the number of records breached in 2017 and an estimated loss to US companies of $1.6 billion due to BEC attacks reported to the FBI (since 2015).

Key Avoidable Causes of Incidents

The report´s authors claim that 93% of breaches could have been avoided with proper preparedness and due diligence. The key avoidable causes of incidents were the failure to regularly patch software vulnerabilities and implement appropriate controls to prevent insider theft or the accidental exposure of confidential data. As the majority of successful ransomware attacks are initiated by malicious emails, the report suggests not enough is being done to block spam and train users to recognize phishing attacks.

Other areas identified as being avoidable causes of cybersecurity incidents included:

  • The lack of a thorough risk assessment to include internal and external partners, and third-party or cloud-based services.
  • Misconfigured servers and devices, and out-of-date operating systems and applications that were no longer supported.
  • The failure to encrypt data and safely manage encryption keys. The lack of encryption led to a loss of data when devices and drives are lost, stolen or hacked.

Conclusions from the Cyber Incident and Breach Trends Report

The “Cyber Incident & Breach Trends Report” does not include much information that most healthcare IT experts are not already aware of. However it does act as a good summary of best practices businesses should adopt to mitigate the risk of cybersecurity incidents. One particularly valid point made in the report is that “security and privacy are not absolute and must evolve”. Businesses are recommended to regularly review their procedures for creating, maintaining and transmitting data, especially in light of evolving threats, changing technologies and new regulations.

The post 2017 Worst Year Ever for Cybersecurity Incidents According to Online Trust Alliance appeared first on HIPAA Journal.

Lightning Likely to Strike Twice for Victims of Ransomware Attacks

A new report commissioned by online security company Sophos has revealed that victims of ransomware attacks are likely to experience further attacks within a year. The report confirms the healthcare industry is at the greatest risk of suffering multiple ransomware attacks.

In order to compile the report – “The State of Endpoint Security Today” – the research company Vanson Bourne surveyed 2,700 IT managers in organizations of 100 to 5,000 users across the US, Canada, Mexico, France, Germany, UK, Australia, Japan, India, and South Africa. The results of the survey make unpleasant reading:

  • 54% of the surveyed organizations were victims of one or more ransomware attacks in the last year.
  • Of the organizations that were victims of ransomware attacks, there was an average of two attacks per organization.
  • The median financial impact per affected organization amounted to $133,000 (including ransom paid, downtime, rectification costs, etc.).
  • The financial impact for the top 3% of organizations suffering a successful ransomware attack was between $6.6 million and $13.3 million.
  • The healthcare industry was the top target for ransomware attacks (76% of respondents), followed by energy (65%), professional services (59%), and retail (58%).
  • 77% of attacked organizations were running up-to-date endpoint security at the time of the attack, however 54% of organizations have not implemented specific anti-ransomware technology.

Why Healthcare Organizations are more often Victims of Ransomware Attacks

Despite being among the top spenders on online security, healthcare organizations are more often victims of ransomware attacks. The authors of the report believe this is because healthcare is perceived as a soft target by cybercriminals due to having an aging IT infrastructure and restricted resources for improving IT security. Healthcare organizations are also considered to be more likely to pay a ransom.

This would imply that healthcare organizations are spending their IT budgets on the wrong kind of security defenses, and the results of the survey appear to confirm that implication. 60% of respondents said their current cyber defenses are insufficient to contend with the growing complexity of ransomware attacks, although only 31% of respondents expect to be victims of a ransomware attack in the future.

Dan Schiappa – the senior vice president and general manager of products at Sophos – said: “Ransomware is not a lightning strike – it can happen again and again to the same organization. Cybercriminals are deploying multiple attack methods to succeed, whether using a mix of ransomware in a single campaign, taking advantage of a remote access opportunity, infecting a server, or disabling security software.

As cybercriminals are finding entry points other than those protected by endpoint security, healthcare organizations should review all their IT infrastructure to identify potential vulnerabilities. In addition to implementing software security solutions where required, special attention should be given to users connecting with healthcare networks in order to ensure they are aware of the threat from ransomware.

The post Lightning Likely to Strike Twice for Victims of Ransomware Attacks appeared first on HIPAA Journal.

92% of U.S. Companies “Vulnerable” to Data Threats

A survey conducted on behalf of global data security company Thales by 451 Research has revealed that 92% of U.S. companies are “vulnerable” to data threats, yet only 86% of respondents plan to increase IT spending in 2018.

The annual survey asked more than 1,200 senior security executives about their cybersecurity spending priorities over the coming year. The results of the survey formed the backbone of the Thales 2018 Data Threat Report, in which it was revealed that 46% of U.S. respondents had experienced a data breach in the previous twelve months (up from 24% in the 2017 report).

Possibly due to their recent experiences, 92% of U.S. respondents said they were vulnerable to data threats. 53% of the U.S. companies surveyed said they were either “very vulnerable” or “extremely vulnerable” – an increase from 29% in the 2017 report – with more than half or respondents citing “privileged users” as the biggest threat to data security.

However, whereas “securing data at rest” was considered to be the most effective defense against data breaches, only 44% of U.S. companies intend increasing their cybersecurity spending in this area. Most companies plan increasing their spending in areas such as end point and mobile device defenses, data in motion defenses, network defenses, and analysis and correlation tools.

Other Findings within the Data Threat Report

Although focusing on cybersecurity spending priorities, there were some interesting revelations for funds not being spent on defenses against data breaches. For example, the two primary reasons for not deploying data security mechanisms were concerns about the impact the mechanisms would have on business processes and the complexity of the mechanisms, rather than budget concerns.

Also surprising were the motives for IT security spending. The motive occupying the #1 position was “the avoidance of financial penalties resulting from a data breach”, rather than “compliance requirements” or “implementing security best practices”; while despite the high percentage of U.S. companies that have experienced a data breach in the past twelve months, only 24% said that was a motivating factor.

On the subjects of multi-cloud adoption and securing Big Data, the report drew the conclusion that cybersecurity spending priorities were not keeping pace with emerging technologies. Similarly companies are failing to address threats via new “attack surfaces” (AI, mobile payments, blockchain, etc.) that need to be offset by data security controls.

Author of the report – Garrett Bekker, the principal security analyst at 451 Research – said: “While times have changed, security strategies have not – security spending increases that focus on the data itself are at the bottom of IT security spending priorities, leaving customer data, financial information and intellectual property severely at risk.”

The post 92% of U.S. Companies “Vulnerable” to Data Threats appeared first on HIPAA Journal.

Analysis of Healthcare Data Breaches in 2017

A summary and analysis of healthcare data breaches in 2017 has been published by Protenus. Data for the report is obtained from, which tracks healthcare data breaches reported to OCR, the media, and other sources. The 2017 breach report gives an indication of the state of healthcare cybersecurity.  So how has 2017 been?

There Were at Least 477 Healthcare Data Breaches in 2017

In some respects, 2017 was a good year. The super-massive data breaches of 2015 were not repeated, and even the large-scale breaches of 2016 were avoided. However, healthcare data breaches in 2017 occurred at rate of more than one per day.

There were at least 477 healthcare data breaches in 2017 according to the report. While all those breaches have been reported via one source or another, details of the nature of all the breaches is not known. It is also unclear at this stage exactly how many healthcare records were exposed. Numbers have only been obtained for 407 of the breaches.

There was a slight increase (6%) in reported breaches in 2017, up from 450 incidents in 2016. However, there was a massive reduction in the number of breached records. In 2016, there were 27,314,647 records exposed/stolen. The 407 healthcare data breaches in 2017 resulted in the exposure/theft of 5,579,438 records.

In 2017, there were no million-record+ breaches. The largest security incident was a breach of 697,800 records. That breach was an insider incident where a healthcare employee downloaded PHI onto a USB drive and CD.

Main Causes of Healthcare Data Breaches in 2017

There were two causes of healthcare data breaches in 2017 that dominated the breach reports – Hacking/IT incidents and insider breaches, both of which were behind 37% of the year’s breaches. 178 incidents were attributed to hacking/IT incidents. There were 176 breaches caused by insider wrongdoing or insider errors.

Hacking/IT incidents resulted in the exposure/theft of 3,436,742 records, although detailed data is only available for 144 of those breaches. In 2016, 86% of breaches were attributed to hacking/IT incidents. In 2016, 120 hacking incidents were reported which resulted in the exposure/theft of 23,695,069 records. The severity of hacks/insider incidents was therefore far lower in 2017, even though hacking incidents were more numerous.

What is clear from the breach reports is a major increase in malware/ransomware attacks, which were at more than twice the level seen in 2016. This could be explained, in part, by the issuing of new guidance from OCR on ransomware attacks. OCR confirmed that ransomware attacks are usually reportable security incidents under HIPAA Rules. Until the issuing of that guidance, many healthcare organizations did not report ransomware attacks unless it was clear that data had been stolen or viewed prior to or during the attack.

Insider breaches continue to plague the healthcare industry. Data is available for 143 of the 176 data breaches attributed to insiders. 1,682,836 records were exposed/stolen in those incidents. While the totals are still high, there were fewer insider incidents in 2017 than 2016, and the incidents resulted in fewer exposed records. There were 192 insider-related incidents in 2016 and those incidents resulted in the exposure/theft of 2,000,262 records.

Protenus broke down the incidents into insider error – mistakes made by healthcare employees – and insider wrongdoing, which included theft and snooping. The breakdown was 102 insider errors and 70 cases of insider wrongdoing. Four incidents could not be classified as either. One of the cases of snooping lasted for an astonishing 14 years before it was discovered.

While theft of PHI by employees is difficult to eradicate, arguably the easiest cause of healthcare data breaches to prevent is theft of electronic devices containing unencrypted PHI. If devices are encrypted, if they are stolen the incidents do not need to be reported. There has been a steady reduction in theft breaches over the past few years as encryption has been more widely adopted. Even so, 58 breaches (16%) were due to theft. Data is available for 53 of those incidents, which resulted in the exposure of 217,942 records. The cause of 47 healthcare data breaches in 2017 could not be determined from the data available.

Breached Entities and Geographic Spread

The breaches affected 379 healthcare providers (80%), 56 health plans (12%), and 4% involved other types of covered entity. Business associate reported 23 incidents (5%) although a further 66 breaches (14%) reported by covered entities had some business associate involvement. Figures are known for 53 of those breaches, which resulted in the exposure/theft of 647,198 records.  Business associate breaches were lower than in 2016, as was the number of records exposed by those breaches.

There were breaches by covered entities and business associates based in 47 states, Puerto Rico and the District of Columbia. Interestingly, three states were free from healthcare data breaches in 2017 – Hawaii, Idaho, and New Mexico. California was the worst hit with 57, followed by Texas on 40, and Florida with 31.

Slower Detection, Faster Notification

Reports of healthcare data breaches in 2017 show that in many cases, breaches are not detected until many months after the breach occurred. The average time to discover a breach, based on the 144 incidents for which the information is known, was 308 days. Last year the average time to discover a breach was 233 days. It should be noted that the data were skewed by some breaches that occurred more than a decade before discovery.

The Breach Notification Rule of the Health Insurance Portability and Accountability Act (HIPAA) allows up to 60 days from the discovery of a breach to report the incident. The average time to report a breach, based on the 220 breaches for which information was available, was 73 days. Last year the average was 344 days.

The faster reporting may have been helped by the OCR settlement with Presense Health in January for delaying breach notifications – The first HIPAA penalty solely for late breach notifications.

Overall there were several areas where the healthcare industry performed better in 2017, although the report shows there is still considerable room for improvement, especially in breach prevention, detection and reporting.

The post Analysis of Healthcare Data Breaches in 2017 appeared first on HIPAA Journal.