Healthcare Cybersecurity

Study Highlights Seriousness of Phishing Threat and Importance of Security Awareness Training

Posted by HIPAA Journal

A new study has revealed the extent to which employees are being fooled by phishing emails and how despite the risk of a data breaches and regulatory fines, many companies are not providing security awareness training to their employees.

For the study, 500 office workers were surveyed by the consultancy firm Censuswide. While all the respondents were based in Ireland, the results of the survey reflect the findings of similar studies conducted in other countries, including the United States.

14% of all surveyed office workers said that they had fallen for a phishing email, which would equate to around 185,000 office workers in Ireland.

There were notable differences in susceptibility to phishing emails across the different age groups: Millennials, generation X, and baby boomers. The age group most likely to be fooled by phishing scams was millennials (17%), followed by baby boomers (7%), and Generation X (6%).

Respondents were asked about how confident they were in their ability to identify phishing scams. Even though almost three times as many millennials had fallen for phishing scams as Generation Xers, millennials had the greatest confidence in their ability to identify phishing scams. That confidence, it would seem, has been somewhat misplaced.

14% of millennials said they would not be certain that they could identify fraud, compared to 17% of Gen Xers, and 26% of baby boomers.

The survey revealed one in five workers had not been given any security awareness training whatsoever, but even when training was provided, many office workers still engaged in unsafe practices such as clicking hyperlinks or opening email attachments in messages from unknown senders. 44% of baby boomers admitted having completed one of those actions in the past, compared with 34% of millennials, and 26% of gen Xers.

The consequences of a successful phishing attack can be severe. Phishing attacks can result in major financial loses, especially when financial information is stolen. Phishing attacks can cause lasting damage to the reputation of a company, business may be lost, and companies can face lawsuits from individuals whose personal information has been exposed or stolen, and regulators can issue substantial civil monetary penalties.

While security solutions can be implemented to block the majority of phishing emails, it is not possible to prevent all phishing emails from being delivered to inboxes. Security awareness training for everyone in the company, from the CEO down, is therefore essential.

Security awareness training needs to be thought of in the same way as health and safety training. It is an organizational and HR matter, not just the responsibility of the IT department.

Simply providing an annual training session for employees is no longer sufficient. Phishing attacks are becoming more sophisticated and cybercriminals are constantly changing tactics. Businesses therefore need to continually educate their employees to ensure training is not forgotten and to keep employees abreast of new threats.

Annual or biannual training sessions should be accompanied by regular refresher training sessions to help develop a security culture. Phishing email simulations are also useful for reinforcing training, gauging the effectiveness of training sessions, and identifying weak links.

The post Study Highlights Seriousness of Phishing Threat and Importance of Security Awareness Training appeared first on HIPAA Journal.

30% of Healthcare Databases Misconfigured and Accessible Online

Posted by HIPAA Journal

A recent study by the enterprise threat management platform provider Insights has revealed an alarming amount of healthcare data is freely accessible online as a result of exposed and misconfigured databases.

While a great deal of attention is being focused on the threat of cyberattacks on medical devices and ransomware attacks, one of the primary reasons why hackers target healthcare organizations is to steal patient data. Healthcare data is extremely valuable as it can be used for a multitude of nefarious purposes such as identity theft, tax fraud and medical identity theft. Healthcare data also has a long lifespan – far longer than credit card information.

The failure to adequately protect healthcare data is making it far too easy for hackers to succeed.

Healthcare Organizations Have Increased the Attack Surface

The cloud offers healthcare organizations the opportunity to cut back on the costs of expensive in-house data centers. While cloud service providers have all the necessary safeguards in place to keep sensitive data secure, those safeguards need to be activated and configured correctly.

Healthcare organizations that have moved data to the cloud have increased the attack surface, yet a substantial percentage have not effectively managed the risks and have left healthcare data exposed.

The problem is not the use of the cloud, but “a lack of process, training, and cybersecurity best practices,” according to Insights. The problem is also not confined to the healthcare industry, as other industry sectors face the same problems, but healthcare organizations face greater risks as hackers are searching for healthcare data.

The Insights report concentrates on exposed healthcare databases which are increasingly being targeted by hackers due to the large volumes of valuable data that can be obtained and the ease of gaining access to those databases. Many are left totally unprotected. All hackers need to know is where to look.

Insights Identified 16,667 Exposed Medical Records Per Hour

For the study, the researchers looked at two commonly used technologies for handling medical records and well-known commercially available databases.

The researchers wanted to demonstrate just how easy it is to find healthcare data. They used no hacking techniques to find the exposed data, only Google and Shodan searches, technical documentation, subdomain enumeration, and educated guesses about the combination of sites, systems and data.

After 90 hours of research and evaluations of 50 databases, 15 exposed databases were found. Those databases contained 1.5 million health records. That’s a rate of 16,667 medical records per hour. Even with a conservative estimate of a price of $1 per medical record on the black market, that would mean a full-time hacker could earn $33 million per year.  Insights estimated 30% of healthcare databases are exposed online.

“Although our findings were not statistically significant, our [database exposure] rate of 30% is fairly consistent with what we’re seeing across all industries for exposed assets,” explained Insights in the report.

The researchers found healthcare data at rest and in motion. The researchers identified open Elasticsearch databases, which can be found using the search engine Shodan. One of those databases contained the records of 1.3 million patients. The records came from a large healthcare clinic in a major European capital city.

Unsurprisingly, given the number of cases of misconfigured MongoDB databases that have been discovered this year, the researchers found a misconfigured MongoDB database used by a Canadian healthcare provider.

In addition to databases, the researchers noted one healthcare provider was using vulnerable SMB services despite the recent WannaCry attacks and one U.S hospital was using an exposed FTP server. “FTP’s usually hold records and backup data and are kept open to enable backup to a remote site. It could be a neglected backup procedure left open by IT that the hospital doesn’t even know exists,” wrote Insights.

“Healthcare budgets are tight, and if there’s an opportunity to purchase a new MRI machine versus make a new IT or cybersecurity hire, the new MRI machine often wins out. Healthcare organizations need to carefully balance accessibility and protection,” explained Insights analyst, Ariel Ainhoren.

The report – Chronic [Cyber] Pain: Exposed & Misconfigured Databases in the Healthcare Industry – can be downloaded on this link.

The post 30% of Healthcare Databases Misconfigured and Accessible Online appeared first on HIPAA Journal.

University of Maryland Medical System Discovers 250-Device Malware Attack

Posted by HIPAA Journal

In the early hours of Sunday, December 9, 2018, the University of Maryland Medical System discovered an unauthorized individual had succeeded in installing malware on its network. Prompt action was taken to isolate the infected computers to contain the attack.

According to a statement issued by UMMS senior VP and chief information officer, Jon P. Burns, most of the devices that were infected with the malware were desktop computers. The prompt action taken by IT staff allowed the infected computers to be quarantined quickly. No files were encrypted and there was no impact on medical services.

UMMS should be commended for its rapid response. The attack was detected at 4.30am and by 7am, its networks and devices had been taken offline and affected devices had been quarantined. The majority of its systems were back online and fully functional by Monday morning.

The incident highlights just how important it is for healthcare organizations to have an effective incident response plan that can be immediately implemented in the event of a malware attack.

UMMS runs medical facilities in more than 150 locations and uses more than 27,000 computers. If a breach response plan had not been in place, the malware attack could have been far more serious and could have had a major impact on patients.

“The measures we took to identify the initial threat, isolate it to prevent intrusion, and to counter and combat the attack before it could infiltrate and infect our network worked as designed,” explained Burns.

At this stage, UMMS does not believe that any medical records or other patient data have been compromised. The investigation into the attack is continuing to determine how the malware was introduced. UMMS has enlisted help from computer forensics experts in this regard and the security breach has been reported to law enforcement.

The post University of Maryland Medical System Discovers 250-Device Malware Attack appeared first on HIPAA Journal.

DHS/FBI Issue Fresh Alert About SamSam Ransomware

Posted by HIPAA Journal

In late November, the Department of Justice indicted two Iranians over the use of SamSam ransomware, but there is unlikely to be any let up in attacks.

Due to the high risk of continued SamSam ransomware attacks in the United States, the Department of Homeland Security (DHS) and FBI have issued a fresh alert to critical infrastructure organizations about SamSam ransomware.

To date, there have been more than 200 SamSam ransomware attacks, most of which have been on organizations and businesses in the United States. The threat actors behind SamSam ransomware have received approximately $6 million in ransom payments and the attacks have resulted in more than $30 million in financial losses from computer system downtime.

The main methods of attack have been the use of the JexBoss Exploit Kit on vulnerable systems, and more recently, the use of Remote Desktop Protocol (RDP) to gain persistent access to systems. Access through RDP is achieved through the purchase of stolen credentials or brute force attacks.

Once access is gained, privileges are escalated to gain administrator rights. The threat actors then explore the network and deploy and execute the ransomware on as many devices as possible to maximize the disruption caused. A ransom demand is then placed on the desktop. Ransoms of between $5,000 and $50,000 are usually demanded, depending on the extent of encryption.

The FBI has analyzed the systems of many SamSam ransomware victims and has determined in many cases there has been previous unauthorized network activity unrelated to the SamSam ransomware attacks. This suggests the SamSam ransomware threat actors have purchased stolen credentials that have previously been used by other threat actors.

“Detecting RDP intrusions can be challenging because the malware enters through an approved access point,” explained DHS/FBI in the report, but there are steps that can be taken to make systems more secure.

Summary of DHS/FBI Advice to Improve Network Security

  • Audit the network for systems that use Remote Desktop Protocol for communications and disable RDP, if possible
  • Close open RDP ports on cloud-based virtual machine instances with public IPs, especially port 3389, unless there is a valid reason for keeping ports open
  • Adhere to cloud providers’ best practices for remote access to cloud-based VMs
  • Locate all systems with open RDP ports behind firewalls and ensure VPNs are used to access those systems remotely
  • Ensure third parties that require RDP access adhere to internal remote access policies
  • Enforce the use of strong passwords
  • Use multi-factor authentication, where possible
  • Ensure software is kept up to date and patches are applied promptly
  • Ensure all data are backed up regularly
  • Implement logging mechanisms that captured RDP logins and retain logs for 90 days. Review logs regularly for attempted intrusions
  • Where possible, disable RDP on critical devices and minimize network exposure for all control system devices
  • Regulate and limit external-to-internal RDP connections
  • Restrict user permissions, especially related to the use of unauthorized/unwanted software applications
  • Use spam filtering technology to scan all email attachments and make sure the attachment extensions match file headers
  • Disable file and printer sharing services where possible. If those services are required, use strong Active Directory authentication.

Technical details of four SamSam (MSIL/Samas.A) ransomware variants have been released (Alert: AA18-337A) to help network defenders protect against attacks.

The post DHS/FBI Issue Fresh Alert About SamSam Ransomware appeared first on HIPAA Journal.

First Hospital GDPR Violation Penalty Issued: Portuguese Hospital to Pay €400,000 GDPR Fine

Posted by HIPAA Journal

The first hospital GDPR violation penalty has been issued in Portugal. The Portugal supervisory authority, Comissão Nacional de Protecção de Dados (CNPD), took action against the Barreiro Montijo hospital near Lisbon for failing to restrict access to patient data stored in its patient management system.

Concerns were raised about the lack of data access controls in April 2018. Medical workers in the southern zone discovered non-clinical staff were using medical profiles to access the patient management system.

CNPD conducted an audit of the hospital and discovered 985 hospital employees had access rights to sensitive patient health information when there were only 296 physicians employed by the hospital. Only medical doctors at the hospital should have been able to access that level of detailed information about patients. CNPD also discovered a test profile had been set up with full, unrestricted administrator-level access to patient data and nine social workers had been granted access to confidential patient data.

The failure to implement appropriate access controls is a violation of the EU’s General Data Protection Regulation (GDPR) which came into force on May 25, 2018.

The hospital has been fined €400,000 ($455,050) for the GDPR violations – €300,000 for the failure to limit access to patient data and €100,000 for the failure to ensure the confidentiality, integrity, and availability of treatment systems and services. The hospital is taking legal action over the GDPR penalty.

This is the first GDPR violation fine to be issued in Portugal and one of the first fines since GDPR started to be enforced in May 2018. The financial penalty is well below the maximum fine that can be issued for a GDPR violation, which is up to €20 million ($22.74 million) or 4% of global annual turnover, whichever is greater.

In November, the supervisory authority in Germany, Baden-Württemberg Data Protection Authority, issued a financial penalty to the chat platform Knuddels.de for the failure to secure the personal information of EU residents. Knuddels.de suffered a data breach that exposed the email addresses of 808,000 users and 1.8 million usernames and passwords. The investigation revealed sensitive information such as passwords were stored in plain text.

Knuddels.de was fined €20,000 ($22,750). The relatively low fine was due to the level of transparency over the breach, exemplary cooperation with the data protection authority, and the speed at which security upgrades were applied.

The post First Hospital GDPR Violation Penalty Issued: Portuguese Hospital to Pay €400,000 GDPR Fine appeared first on HIPAA Journal.

ONC Announces Winners of Easy EHR Issues Reporting Challenge

Posted by HIPAA Journal

The Department of Health and Human Services’ Office of the National Coordinator for Health Information Technology (ONC) has announced the winners of its Easy EHR Issues Reporting Challenge.

Currently, reporting EHR safety concerns is cumbersome and causes disruption to clinical workflows. A more efficient and user-friendly mechanism is required to allow EHR users to quickly identify, document, and report issues to their IT teams.

Fast reporting of potential safety issues will allow the root causes of problems to be found more quickly and for feedback to be provided to EHR developers rapidly to ensure problems are resolved in the shortest possible timeframe.

The aim of the challenge was to encourage software developers to create solutions that would help clinicians report EHR usability and safety issues more quickly and efficiently in alignment with their usual clinical workflows and make the reporting of EHR safety issues less burdensome.

After assessing all submissions, ONC chose three winners:

1st Place and $45,000 was awarded to James Madison Advisory Group, which developed a unique solution for documenting and reporting potential EHR safety issues. The tool can be launched using a system tray icon or hotkey without exiting the EHR workflow. The solution works on Windows 8 systems and above and all EHR platforms. The software tool exports data in the HHS Agency for Healthcare Research and Quality (AHRQ) Common Formats XML and PDF, can capture screenshots, and simplifies report delivery.

2nd Place and $25,000 was awarded to Pegwin which developed a software platform that clinicians can use to create and send safety and usability reports with three clicks of a mouse. The solution has an intuitive design, uses contextual menus, and automates Common Formats reporting as far as possible.

3rd Place and $10,000 was awarded to Jared Schwartz and his team for developing a Google Chrome plug-in that integrates with IT ticketing systems. The plug-in allows more consistent capturing of EHR safety issues.

Improving the safety of health IT remains an important priority,” said Andy Gettinger, M.D., ONC chief clinical officer. “We believe that making it easier for end users to report will help in that goal.”

The post ONC Announces Winners of Easy EHR Issues Reporting Challenge appeared first on HIPAA Journal.

OIG Identified Serious Security Failures at Arizona Managed Care Organizations

Posted by HIPAA Journal

The Department of Health and Human Services’ Office of Inspector General (OIG) has issued a report on the findings of security audits at two managed care organizations (MCOs) in Arizona. OIG discovered serious security flaws in information systems that could place the confidentiality, integrity, and availability of Medicaid data and systems used to process Medicaid managed care claims at risk.

OIG conducted the audits to determine whether the Arizona Medicaid MCOs were adequately protecting their information systems and Medicaid data, and whether they were in compliance with Health Insurance Portability and Accountability Act (HIPAA) security requirements.

OIG discovered 19 security vulnerabilities in access controls and configuration management spanning 9 security control areas.

5 vulnerabilities were identified in the access controls category and 14 vulnerabilities were identified in the configuration management category. They included vulnerabilities in access controls, administrative controls, patch management, antivirus management, database management, server management, website security, and the configuration of network devices. The vulnerabilities were collectively and, in some cases, individually significant, although OIG did not uncover any evidence to suggest the vulnerabilities had been exploited.

Examples of vulnerabilities in the access control category include the failure to disable user accounts for terminated employees in a timely manner and the lack of two-factor authentication for remote network access.

Examples of vulnerabilities in the configuration management category include the misconfiguration of firewall Secure Shell (SSH) session timeouts. While the default timeout was 5 minutes, at one of the MCOs it had been changed to 30 minutes. Such a long timeframe would allow an attacker to access the system using an authenticated administrator session that had not been terminated.

The MCOs failed to apply patches on workstations promptly. If vulnerabilities persist, they can be exploited to gain access to data as the May 2017 WannaCry attacks on the UK’s National Health Service (NHS) clearly demonstrated.

Antivirus software was not updated at one of the MCOs. Around half of its servers had out of date antivirus definitions, which could have allowed malware to be installed undetected. Unsupported software was still in use on three production servers used by one MCO and there was no encryption used on the claims processing database.

The auditors found that in three security control areas, which accounted for 10 of the 19 vulnerabilities identified, similar vulnerabilities were present at both audited MCOs.

The discovery of similar security vulnerabilities at both MCO’s strongly suggests that other MCOs in the state, and potentially nationwide, could have the same vulnerabilities. OIG also notes that federal regulations covering the security of Medicaid data differ depending on who holds the data. The different application of security measures by state agencies and MCOs could affect state-MCO relationships nationwide and thus increase the risk of exposure of Medicaid data.

OIG recommended the CMS to conduct a documented risk assessment to determine how the disparate application of Federal security requirements creates cybersecurity risks for Medicaid data maintained by MCOs, and suggested the CMS identify actions that could be taken to address the security gaps.

OIG also recommended that the CMS should inform all state agencies of the findings of the audits to raise awareness of the vulnerabilities to enhance nationwide awareness of cybersecurity weaknesses.

The CMS did not concur with the OIG recommendation to conduct a documented risk assessment. “CMS stated that a risk assessment is already a requirement under the jurisdiction of the HHS Office for Civil Rights (OCR) and it would be duplicative of existing risk assessment efforts.”

OIG noted that since the issue concerns the Medicaid program and OCR is not responsible for the disparate application of Federal security requirements, the CMS is in the best position to ensure that security requirements are consistently applied to protect Medicaid data, regardless of who holds the data.  The CMS did concur with the the recommendation to notify state agencies about the cybersecurity vulnerabilities uncovered by the audits.

The post OIG Identified Serious Security Failures at Arizona Managed Care Organizations appeared first on HIPAA Journal.

DOJ Indicts Two Iranian Hackers for Role in SamSam Ransomware Attacks

Posted by HIPAA Journal

The U.S. Department of Justice has announced significant progress has been made in the investigation of the threat actors behind the SamSam ransomware attacks that have plagued the healthcare industry over the past couple of years.

The DOJ, assisted the Royal Canadian Mounted Police, Calgary Police Service, and the UK’s National Crime Agency and West Yorkshire Police, have identified two Iranians who are believed to be behind the SamSam ransomware attacks.

Both individuals – Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri – have been operating out of Iran since 2016 and have been indicted on four charges:

  • Conspiracy to commit fraud and related computer activity
  • Conspiracy to commit wire fraud
  • Intentional damage to a protected computer
  • Transmitting a demand in relation to damaging a protected computer

The DOJ reports that this is the first ever U.S. indictment against criminals over a for-profit ransomware, hacking, and extortion scheme.

In contrast to many threat actors who use ransomware for extortion, the SamSam ransomware group conducts targeted, manual attacks on organizations. Most ransomware gangs use spam email and other mass distribution techniques to infect as many individuals as possible.

The SamSam ransomware group exploits vulnerabilities and conducts brute force RDP attacks to gain access to systems, then investigates networks and moves laterally before manually deploying ransomware on as many computers as possible.

This method of attack allows the threat actors to inflict maximum damage. With a large percentage of an organization’s computers and systems taken out of action, the gang can issue large ransom demands. The ransoms demanded are typically in the range of $5,000 to $50,000, with the amount based on the number of devices that have been encrypted.

In the two years that the gang has been deploying SamSam ransomware, approximately $6,000,000 in ransom payments have been collected from around 200 victims. Many victims chose not to pay the ransom demands but still incurred significant costs mitigating the attacks. The DOJ estimates that in addition to the ransom payments, additional losses from downtime due to the attacks has exceed $30 million.

The gang’s list of victims is long and includes the cities of Newark, New Jersey and Atlanta, the Colorado Department of Transportation, and the Port of San Diego. Healthcare industry victims include Hancock Health, Adams Memorial Hospital, Kansas Heart Hospital, Allied Physicians of Michiana, Cass Regional Medical Center, Nebraska Orthopedic Hospital, LabCorp of America, Allscripts, and MedStar Health.

Research by Sophos indicates 26% of attacks were on the healthcare organizations, 13% were on government agencies, 11% were on educational institutions, and 50% were on private companies. The attacks have primarily been conducted on organizations in the United States, with other victims spread across Canada, the UK, and the Middle East.

The DOJ said the SamSam ransomware gang “engaged in an extreme form of 21st-century digital blackmail, attacking and extorting vulnerable victims like hospitals and schools, victims they knew would be willing and able to pay.”

The DOJ will continue to work with international law enforcement agencies to gather evidence and bring those responsible to justice.

The DOJ has also taken the opportunity to spread the message that all industry sectors are at risk of being attacked. “This indictment highlight[s] the need for businesses, healthcare institutions, universities, and other entities to emphasize cyber security, increase threat awareness, and harden their computer networks,” wrote the DOJ in a press release announcing the indictment.

The post DOJ Indicts Two Iranian Hackers for Role in SamSam Ransomware Attacks appeared first on HIPAA Journal.

2.65 Million Atrium Health Patients Impacted by Business Associate Data Breach

Posted by HIPAA Journal

A data breach has been reported by AccuDoc Solutions Inc., a provider of healthcare billing services, that resulted in the exposure of the protected health information of 2,650,000 patients of Atrium Health.

Morrisville, NC-based AccuDoc Solutions prepares bills for patients and operates the online payment system used by Atrium Health, a network of 44 hospitals throughout North Carolina, South Carolina and Georgia.

On October 1, 2018, AccuDoc Solutions notified Atrium Health that some of its databases had been compromised. The breach investigation revealed hackers had gained access to AccuDoc Solutions databases between September 22 and September 29, 2018.

An extensive forensic investigation into the attack confirmed that patient information had been compromised, but the information stored in its databases could only be viewed. No PHI was downloaded by the attackers nor distributed via other channels.

AccuDoc Solutions reports that the breach was due to a security vulnerability at a third-party vendor. The business relationship with that vendor has now been terminated. AccuDoc Systems has locked out the hackers and has enhanced its security measures to prevent future attacks.

Atrium Health said the information compromised in the attack was limited to patients’ names, addresses, invoice numbers, account balances, service dates, and health insurance information. Approximately 700,000 Social Security numbers were also compromised; however, no sensitive financial information or medical records were affected.

“We are notifying the patients and guarantors who may have been impacted by this incident. We take cybersecurity very seriously, and we’ve worked very hard to determine exactly what happened, and how to prevent it from happening again,” said a spokesperson for Atrium Health. “The fact that even one record was accessed is one too many. Our patients expect us to keep all of their information private, which is why we took action so quickly.”

Atrium Health is now notifying all affected patients and has offered credit monitoring and identity theft protection services to patients impacted by the breach.

AccuDoc serves approximately 50 other healthcare providers; however only one other client was affected by the breach: Baylor Medical Center in Frisco, TX. Approximately 40,000 Baylor Medical Center patients were affected.

Based on the estimated number of individuals affected, this is the largest healthcare data breach since the 3,466,120-record breach at Newkirk Products Inc., that was reported to OCR in September 2016. It is the eleventh largest healthcare data breach reported since OCR started publishing breach summaries in 2009.

Largest Ever Healthcare Data Breaches

Rank Entity Entity Type Individuals Affected Breach Type Date
1 Anthem Inc. Health Plan 78,800,000 Hacking/IT Incident Feb-15
2 Premera Blue Cross Health Plan 11,000,000 Hacking/IT Incident Mar-15
3 Excellus Health Plan, Inc. Health Plan 10,000,000 Hacking/IT Incident Sep-15
4 Science Applications International Corporation Business Associate 4,900,000 Loss Nov-11
5 University of California, Los Angeles Health Healthcare Provider 4,500,000 Hacking/IT Incident Jul-15
6 Community Health Systems Professional Services Corporation Business Associate 4,500,000 Hacking/IT Incident Aug-14
7 Advocate Health and Hospitals Corporation, dba Advocate Medical Group Healthcare Provider 4,029,530 Theft Aug-13
8 Medical Informatics Engineering Business Associate 3,900,000 Hacking/IT Incident Jul-15
9 Banner Health Healthcare Provider 3,620,000 Hacking/IT Incident Aug-16
10 Newkirk Products, Inc. Business Associate 3,466,120 Hacking/IT Incident Aug-16
11 AccuDoc Solutions Inc. Business Associate 2,650,000 Hacking/IT Incident Nov-18
12 21st Century Oncology Healthcare Provider 2,213,597 Hacking/IT Incident Mar-16

The post 2.65 Million Atrium Health Patients Impacted by Business Associate Data Breach appeared first on HIPAA Journal.