Healthcare Cybersecurity

Ransomware Attack Results in Partial Closure of Emergency Rooms at Two Hospitals

Posted November 28, 2018 by HIPAA Journal

Computer systems used by East Ohio Regional Hospital (EORH) in Martins Ferry, OH, and Ohio Valley Medical Center (OVMC) in Wheeling, WV, were taken out of action over the weekend as a result of a ransomware attack.

The ransomware started encrypting files on the evening of Friday, November 23. While the attackers succeeded in gaining access to certain systems by penetrating the first layer of security, the subsequent layer was not breached, and the protected health information of its patients was not compromised. Even so, the attack resulted in disruption to certain medical services at both hospitals.

Patients walking into the emergency room could still be processed and treated, but the hospitals were unable to accept patients from emergency squads. During the attack the hospitals switched to paper charts to ensure data protection and e-squad patients were diverted to other hospitals.

Several hospital systems were taken offline to protect the integrity of information and IT teams have been working around the clock to eradicate the ransomware, restore files, and bring systems back online. The hospitals chose not to pay the ransom demand and instead restored affected files from backups after rebuilding affected systems.

Initially it was hoped that systems would be restored by Sunday evening; however, e-squad patients were still being diverted to other hospitals on Monday evening while the IT staff restored affected systems. “We’ve made great progress, but we are not there yet,” explained Daniel Dunmyer, CEO of OVMC, “It’s taken hours for significant improvement, but it will take days for finalization.”

Until essential systems are restored, the emergency rooms will remain on yellow diversion and remain partially closed. On yellow diversion, “the EMS can call in to the ER and we can let them know if it’s a case we can taken,” explained Dunmyer. On Tuesday, the software used to read radiology and CT scans and make that information available to ER staff was still being rebuilt. Only when that system is restored will EORH/OVMC go off diversion in the ERs.

The post Ransomware Attack Results in Partial Closure of Emergency Rooms at Two Hospitals appeared first on HIPAA Journal.

NIST Releases Draft Paper on Telehealth and Remote Monitoring Device Cybersecurity

Posted November 23, 2018 by HIPAA Journal

The National Institute of Standards and Technology’s National Cybersecurity Center of Excellence (NCCoE) has released a draft paper covering the privacy and security risks of telehealth and remote monitoring devices and best practices for securing the telehealth and remote monitoring ecosystem.

Patient monitoring systems have traditionally been deployed within healthcare facilities; however, there has been an increase in the use of remote patient monitoring systems in patients’ homes in recent years. While these systems are straightforward to secure in a controlled environment such as a hospital, the use of these systems in patients’ homes introduces new risks.

Managing the risks and ensuring the remote monitoring systems and devices have an equivalent level of security as in-house systems can be a major challenge.

The purpose of the paper is to create a reference architecture which addresses the security and privacy risks and provides practical steps that can be taken to improve the overall security of the remote patient monitoring environment.

The paper addresses cybersecurity concerns related to the use of the devices in patients’ homes, the use of home networks, and patient-owned devices and identifies cybersecurity measures that can be implemented by healthcare organizations with RPM and video telehealth capabilities.

“The project team will perform a risk assessment on a representative RPM ecosystem in the laboratory environment, apply the NIST Cybersecurity Framework and guidance based on medical device standards, and collaborate with industry and public partners,” explained NCCoE.

NCCoE has evaluated the following functions of the devices:

Connectivity of devices and applications deployed on patient-owned devices such as smartphones, tablets, laptops, and desktop computers
How applications transmit monitoring data to healthcare providers
The ability for patients to interact with their point of contact to initiate care
The ability for data to be analyzed by healthcare providers to identify trends and issue alerts to clinicians about issues with patients
The ability for data to be shared with electronic medical record systems
The ability for patients to initiate videoconference sessions through telehealth applications
The ability for application patches and updates to be installed
How a healthcare provider can establish a connection with a remote monitoring device to obtain patient telemetry data
How a healthcare provider can connect to a remote monitoring device to update the device configuration

The paper does not cover risks specific to third party telehealth platform providers nor does it evaluate device vulnerabilities and defects.

Stakeholders have been invited to comment on the draft paper. Comments will be accepted until December.

The guidance document can be downloaded on this link.

The post NIST Releases Draft Paper on Telehealth and Remote Monitoring Device Cybersecurity appeared first on HIPAA Journal.

53% Of Healthcare Data Breaches Due to Insiders and Negligence

Posted November 22, 2018 by HIPAA Journal

The healthcare industry has had more than its fair share of hacking incidents, but the biggest threat comes from within. The actions of healthcare providers, health insurers, and their employees cause more breaches than hacks, malware, and ransomware attacks.

Researchers at Michigan State University and Johns Hopkins University analyzed data breaches reported to the Department of Health and Human Services’ Office for Civil Rights (OCR) over the past 7 years and found that more than half of breaches were the result on internal negligence.

The research study, which was recently published in the journal JAMA Internal Medicine, is a follow-on from a 2017 study that explored the risk of hospital data breaches and the types of hospitals that were most prone to data breaches. While the previous research cast light on which hospitals were most vulnerable, little information was available on the main causes of the breaches. The latest study addresses that gap in knowledge.

The researchers performed a retrospective analysis of the 1,183 healthcare data breaches reported to OCR between October 21, 2009 and December 31, 2017. Those breaches resulted in the exposure of 164 million healthcare records.

The analysis was limited to breaches of 500 or more records, as OCR does not publish summaries of smaller breaches. The breach reports split data breaches into six categories; hacking/IT incidents, unauthorized access/disclosure incidents, theft, loss, improper disposal, and unknown. 77.6% of breaches were correctly classified and 22.24% were misclassified or the cause was unknown.

The researchers discovered that theft of data by third-parties or unknown individuals was the single leading breach cause, accounting for 32.5% of incidents, with mailing errors in second place (10.5%), followed by theft by current or former employees (9%). Internal/external hacking incidents accounted for around 20% of breaches, although those incidents involved 133.8 million of the 164 million compromised records. 53% of all breaches were found to have originated from inside healthcare organizations.

“One quarter of all the cases were caused by unauthorized access or disclosure – more than twice the amount that were caused by external hackers,” said Xuefeng Liang, associate professor of accounting and information systems at MSU’s Eli Broad College of Business and lead author of the study. “This could be an employee taking PHI home or forwarding to a personal account or device, accessing data without authorization, or even through email mistakes, like sending to the wrong recipients, copying instead of blind copying or sharing unencrypted content.”

An analysis of the location of breached PHI showed 46.1% of breaches involved mobile devices, paper records were involved in 28.7% of breaches and 29.3% of breaches involved network servers.

Typically, the actions taken by healthcare organizations post-breach were the use of encryption software, restricting the use of mobile devices, switching to digital records, improving physical security, strengthening firewalls and other cybersecurity protections, and enhancing monitoring and auditing.

While many breaches involve little risk to patients – the accidental disclosure of a name and address to another patient – the consequences of some breaches can be severe: For patients as well as the breached entity. Anthem Inc’s 78.8 million record breach in 2015 was used as an example. Many breach victims had tax returns filed in their names, resulting in financial losses.

In addition to the considerable cost of mitigating the breach – improving cybersecurity protections; hiring forensic investigators, cybersecurity consultants, and legal advisors; printing and mailing notification letters; providing credit monitoring services for breach victims – Anthem had to cover the cost of defending multiple class action lawsuits, which were ultimately settled for $115 million. Anthem has also recently been fined $16 million by OCR to resolve the HIPAA violations uncovered during its breach investigation. Anthem’s reputation has also been tarnished by the breach, the cost of which is difficult to calculate.

The findings of the study are important. “Healthcare entities must understand the causes of PHI breaches if they aim to effectively manage the trade-off between wider access or higher efficiency and more security,” explained the researchers in the paper.

The post 53% Of Healthcare Data Breaches Due to Insiders and Negligence appeared first on HIPAA Journal.

OIG: Cybersecurity One of Top 10 Management and Performance Challenges Faced by HHS

Posted November 22, 2018 by HIPAA Journal

The Department of Health and Human Services’ Office of Inspector General (OIG) has published its annual report on the top management and performance challenges faced by the HHS.

The report lists 12 major challenges that the HHS must overcome to ensure the department achieves its aims. Given the scale of the current opioid crisis in the United States and its impact, the prevention and treatment of opioid misuse has topped this year’s list.

The report also draws attention to the importance of cybersecurity protections to mitigate threats to be confidentiality, integrity, and availability of health data. Protecting HHS data, systems, and beneficiaries from cybersecurity threats made 10^th spot in this year’s list.

In the report, OIG explained that “data management, use, and security are essential to the effective and efficient operation of HHS’ agencies and programs.” Ensuring the integrity of IT systems and the confidentiality and availability of healthcare data are critically important to the health and well-being of Americans.

The HHS has a $5 billion annual budget for IT; a proportion of which is devoted to cybersecurity to ensure data and IT systems are kept secure. The HHS faces major challenges securing its highly complex systems and must store ever increasing volumes of data securely: Data which are spread across multiple locations and are accessible by many entities and individuals. Further, in recent years there has been a major expansion in the use of IoT technology and networked devices, which introduce many new risks. The HHS must ensure its internal systems are protected and is required to oversee the security of cloud data and ensure providers, contractors, and grantees are adhering to cybersecurity best practices.

OIG explained that the types of data used, stored, and transmitted by the HHS are of high value to cybercriminals and are up to ten times more valuable than credit card numbers. Consequently, the HHS is a major target for hackers.

If the HHS fails to secure its data and systems, not only could patients come to harm, it has potential to hinder Federal initiatives such as the NIH ‘All of Us’ Research program, preventing them from achieving their full potential.

OIG reports that the HHS lacks robust resources to prepare cybersecurity staff to respond to cyberattacks and has not thoroughly tested its incident response and recovery procedures, although significant progress has been made in improving cybersecurity protections.

The HHS budget for 2017 allocated $50 million to meet the HHS’s cybersecurity needs and ensure that sensitive data, and the systems on which the information is stored, are kept secure. Part of that budget has been spent on monitoring tools to ensure security compliance, threat hunting technologies have been deployed in some HHS agencies, and the staff of all agencies is now provided with ongoing cybersecurity awareness training.

Cybersecurity testing is conducted in conjunction with the Department of Homeland Security and there is a continuous dialogue across HHS agencies on the cybersecurity and operational challenges faced by the department. While significant progress has been made, there is still a great deal of work to be done.

OIG explained that the HHS needs to develop a well-designed contingency program for cyber-defenses, in addition to those for natural disasters. HHS must also take a more proactive approach to identify and address current and future vulnerabilities before they are exploited, including addressing vulnerabilities that have previously been discovered by OIG and other agencies. HHS must also focus on its capabilities to respond efficiently to a wide range of cybersecurity threats.

The HHS also needs to assist healthcare organizations address threats, which is best achieved through information sharing. Dissemination of threat information and strategies to mitigate threats is essential to ensure that cyberthreats do not result in widespread disruption in the healthcare sector.

The HHS should therefore continuously seek opportunities to partner with other government agencies, academia, private sector companies, and state governments to share cybersecurity information on emerging risks, threats, and best practices.

The HHS must also engage the healthcare and public health sectors to ensure that threat intelligence is communicated effectively and foundational cybersecurity best practices are made available.

The post OIG: Cybersecurity One of Top 10 Management and Performance Challenges Faced by HHS appeared first on HIPAA Journal.

October 2018 Healthcare Data Breach Report

Posted November 21, 2018 by HIPAA Journal

Our October 2018 healthcare data breach report shows there has been a month-over-month increase in healthcare data breaches with October seeing more than one healthcare data breach reported per day.

31 healthcare data breaches were reported by HIPAA-covered entities and their business associates in October – 6 incidents more than the previous month. It should be noted that one breach at a business associate was reported to OCR as three separate breaches.

The number of breached records in September (134,006) was the lowest total for 6 months, but the downward trend did not continue in October. There was a massive increase in exposed protected health information (PHI) in October. 2,109,730 records were exposed, stolen or impermissibly disclosed – 1,474% more than the previous month. In October, the average breach size was 68,055 records and the median was 4,058 records.

Largest Healthcare Data Breaches in October 2018

There were 11 healthcare data breaches of more than 10,000 records reported in October – A 120% increases from the five 10,000+ record breaches in September. The largest healthcare data breach in October resulted in the exposure of 1.24 million records: An unauthorized access/disclosure incident at Employees Retirement System of Texas. A flaw in its ERS Online portal allowed members to view the PHI of other members.

566,217 records were exposed in a breach at Banker’s Life, a division of CNO Financial Group Inc., also an unauthorized access/disclosure incident. Employee credentials were stolen and used to gain access to company websites, resulting in the exposure and potential theft of policyholder and applicant information.

Rank	Name of Covered Entity	Covered Entity Type	Individuals Affected	Type of Breach
1	Employees Retirement System of Texas	Health Plan	1248263	Unauthorized Access/Disclosure
2	CNO Financial Group, Inc.	Health Plan	566217	Unauthorized Access/Disclosure
3	Health First, Inc	Healthcare Provider	42000	Hacking/IT Incident
4	Jones Eye Center, P.C.	Healthcare Provider	39605	Hacking/IT Incident
5	Gold Coast Health Plan	Business Associate	37005	Hacking/IT Incident
6	The May Eye Care Center	Healthcare Provider	30000	Hacking/IT Incident
7	CJ Elmwood Partners, L.P.	Healthcare Provider	22416	Hacking/IT Incident
8	Minnesota Department of Human Services	Health Plan	20800	Hacking/IT Incident
9	Catawba Valley Medical Center	Healthcare Provider	20000	Hacking/IT Incident
10	National Ambulatory Hernia Institute	Healthcare Provider	15974	Hacking/IT Incident

Causes of October 2018 Healthcare Data Breaches

Unauthorized access/disclosure breaches resulted in the highest number of compromised records, but hacking/IT incidents were more common in October. October saw 16 hacking/IT incidents reported, 11 unauthorized access/disclosure incidents, and four theft incidents. There were no reports of lost PHI/ePHI and no improper disposal incidents.

Healthcare Records Exposed by Breach Cause

Location of Breached Protected Health Information

Phishing is arguably the biggest cyber threat faced by healthcare organizations and October saw many phishing attacks reported by healthcare providers. In October, there were 9 incidents involving PHI exposure via email. There were also 9 network server-related breaches, which included hacks, malware, and ransomware attacks.

Data Breaches by Covered-Entity Type

In terms of the number of incidents, healthcare providers were the worst hit by data breaches in October with 20 reported breaches, followed by health plans/health insurers with 7. Four HIPAA business associate breaches were reported, three of which were by the same business associate – HealthFitness. One further breach had some business associate involvement.

In terms of the number of exposed records, health plans/insurers fared worse than other HIPAA-covered entities. 1,848,235 healthcare records were exposed at health plans/insurers, 221,994 healthcare records were exposed in healthcare provider breaches, and 39,501 records exposed by business associates.

Healthcare Data Breaches by State

Texas was worst affected by healthcare data breaches in October. 5 breaches were reported by covered entities/business associates based in Texas. California, Connecticut, Illinois, and Washington each had 3 breaches reported. There were two breaches reported in each of Florida, Iowa, Indiana, and Pennsylvania. Minnesota, Missouri, North Carolina, New Mexico, Oklahoma, and Oregon had one breach apiece.

Penalties for HIPAA Violations in October

After a period of quiet on the HIPAA penalty front, the Department of Health and Human Services’ Office for Civil Rights announced three settlements in September related to filming patients without consent. There were followed up in October with a massive fine for Anthem Inc.

The Anthem Inc., HIPAA violation penalty was expected, and given the scale of the breach (78.8 million records), the penalty was likely to be large. After assessing the extent of HIPAA violations, the scale of the breach, and its impact, OCR fined Anthem $16,000,000. The previous largest ever HIPAA penalty was $5,550,000 (Advocate Health Care Network, 2016)

In October, a multi-state action against the health insurer Aetna was concluded and settlements were reached to resolve the HIPAA violations. The penalties related to the impermissible disclosure of 13,160 plan members’ HIV/AIDS diagnoses via a mailing. Settlements were reached with Connecticut, New Jersey, and the District of Columbia totaling $640,170. Washington was also part of the multi-state action, but the settlement amount has not yet been decided.

The post October 2018 Healthcare Data Breach Report appeared first on HIPAA Journal.

Congress Passes CISA Act Which Calls for New Cybersecurity Agency Within DHS

Posted November 15, 2018 by HIPAA Journal

The U.S. Department of Homeland Security will be forming a new agency solely focused on cybersecurity following the passing of new legislation by Congress.

The Cybersecurity and Infrastructure Security Agency Act of 2018 (CISA Act) amends the Homeland Security Act of 2002 can calls for DHS to form a new Cybersecurity and Infrastructure Security Agency. The CISA Act was unanimously passed by the House of Representatives and just awaits the president’s signature.

The new agency will be formed through the reorganization of the National Protection and Programs Directorate (NPPD) and will have the same status as other DHS agencies such as the U.S. Secret Service.

The NPPD is already responsible for reducing and eliminating threats to U.S. critical physical and cyber infrastructure, with cybersecurity elements covered by the Office of Cybersecurity and Communications and the National Risk Management Center.

NPPD currently coordinates IT security initiatives with other entities, local, state, tribal and territorial governments and the private sector and oversees cybersecurity at federal government civilian agencies.

The new name better reflects the work NPPD does and emphasizes the importance of cybersecurity in securing the nation’s critical infrastructure. The new agency will consolidate information security and physical infrastructure security in a unified agency.

“The cyber threat landscape is constantly evolving, and we need to ensure we’re properly positioned to defend America’s infrastructure from threats digital and physical,” said DHS Secretary Kirstjen M. Nielsen. “It was time to reorganize and operationalize NPPD into the Cybersecurity and Infrastructure Security Agency.”

Having a single agency in charge of the nation’s cybersecurity will help the U.S. government address current security gaps. At present, each federal agency is responsible for its own IT systems and managing cyber risks. Regardless of size and budget, each government entity must ensure cyber risks are managed and reduced to a minimal level. There are also several government agencies that cover various cybersecurity functions, which is inefficient and results in security gaps.

“Elevating the cybersecurity mission within the Department of Homeland Security, streamlining our operations, and giving NPPD a name that reflects what it actually does will help better secure the nation’s critical infrastructure and cyber platforms,” said Christopher Krebs, current undersecretary of the NPPD. “The changes will also improve the Department’s ability to engage with industry and government stakeholders and recruit top cybersecurity talent.”

The post Congress Passes CISA Act Which Calls for New Cybersecurity Agency Within DHS appeared first on HIPAA Journal.

New Philips iSite and IntelliSpace PACS Vulnerability Identified

Posted November 12, 2018 by HIPAA Journal

ICS-CERT has issued an advisory about a medium severity vulnerability in Philips iSite and IntelliSpace PACS. The weak password vulnerability is present in all versions of iSite PACS and IntelliSpace PACS. If exploited, the confidentiality, integrity, and availability of a component of the system could be impacted.

The vulnerability is being tracked as CVE-2018-17906 (CWE-521) and concerns the use of default credentials and a lack of authentication within third-party software. The vulnerability would require only a low level of skill to exploit, although the potential for exploitation is limited as an attacker would first need to gain local network access. The vulnerability has been assigned a CVSS v3 base score of 6.3 and was reported to Philips by a user. Philips self-reported the flaw to NCCIC.

To prevent exploitation of the vulnerability, healthcare providers should restrict access to vulnerable iSite and IntelliSpace PACS systems to authorized personnel and follow standard security best practices.

Phillips recommends only running IntelliSpace PACS installations in a managed service environment that conforms to NCCIC recommendations to reduce the risk of exploitation of the vulnerability. Measures that should be implemented include the use of a virtual private network, ensuring Philips iSite and IntelliSpace PACS are not accessible over the Internet, separation of iSite and IntelliSpace PACS from other networks, and to ensure they are protected by a firewall.

Through the managed service environment, Philips offers automated anti-virus protection to continuously scan systems and remediate threats. Phillips also runs a monthly patch program to address known vulnerabilities. Participants in the program will receive an update to address this and future vulnerabilities in a timely fashion.

Philips notes that the iSite 3.6 platform is now at end of life and has reached end of service, so upgrades are strongly recommended.

In October, ICS-CERT issued an advisory over six Philips iSite/IntelliSpace PACS vulnerabilities and a further two vulnerabilities in Philips IntelliSpace cardiovascular vulnerabilities were reported in August. In each case, rapid action was taken to address the vulnerabilities through the Philips’ Secure Development Lifecycle (SDL).

The post New Philips iSite and IntelliSpace PACS Vulnerability Identified appeared first on HIPAA Journal.

Vulnerabilities Identified in Roche Point of Care Handheld Medical Devices

Posted November 8, 2018 by HIPAA Journal

ICS-CERT has issued an advisory concerning five vulnerabilities that have been identified in Roche Point of Care handheld medical devices. Four vulnerabilities are high risk and one has been rated medium risk.

Successful exploitation of the vulnerabilities could allow an unauthorized individual to gain access to the vulnerable devices, modify system settings to alter device functionality, and execute arbitrary code.

The vulnerabilities affect the following Roche Point of Care handheld medical devices.

Accu-Chek Inform II (except Accu-Chek Inform II Base Unit Light and Accu-Chek Inform II Base Unit NEW with Software 04.00.00 or later)
CoaguChek Pro II
CoaguChek XS Plus & XS Pro
Cobas h 232 POC
Including the related base units (BU), base unit hubs and handheld base units (HBU).

CVE-2018-18564 is an improper access control vulnerability. An attacker in the adjacent network could execute arbitrary code on the system using a specially crafted message. The vulnerability is rated high severity and has been assigned a CVSS v3 base score of 8.3.