Healthcare Cybersecurity

Is Google Drive HIPAA Compliant?

Posted by HIPAA Journal

Google Drive is a useful tool for sharing documents, but can those documents contain PHI? Is Google Drive HIPAA compliant?

Is Google Drive HIPAA Compliant?

The answer to the question, “Is Google Drive HIPAA compliant?” is yes and no. HIPAA compliance is less about technology and more about how technology is used. Even a software solution or cloud service that is billed as being HIPAA-compliant can easily be used in a manner that violates HIPAA Rules.

G Suite – formerly Google Apps, of which Google Drive is a part – does support HIPAA compliance. The service does not violate HIPAA Rules provided HIPAA Rules are followed by users.

G Suite incorporates all of the necessary controls to make it a HIPAA-compliant service and can therefore be used by HIPAA-covered entities to share PHI (in accordance with HIPAA Rules), provided the account is configured correctly and standard security practices are applied.

The use of any software or cloud platform in conjunction with protected health information requires the vendor of the service to sign a HIPAA-compliant business associate agreement (BAA) prior to the service being used with any PHI. Google offers a BAA for Google Drive (including Docs, Sheets, Slides, and Forms) and other G Suite apps for paid users only.

Prior to use of any Google service with PHI, it is essential for a covered entity to review, sign and accept the business associate agreement (BAA) with Google. It should be noted that PHI can only be shared or used via a Google service that is specifically covered by the BAA. The BAA does not cover any third-party apps that are used in conjunction with G Suite. These must be avoided unless a separate BAA is obtained from the provider/developer of that app.

The BAA does not mean a HIPAA covered entity is then clear to use the service with PHI. Google will accept no responsibility for any misconfiguration of G Suite. It is down to the covered entity to make sure the services are configured correctly.

Covered entities should note that Google encrypts all data uploaded to Google Drive, but encryption is only server side. If files are downloaded or synced, additional controls will be required to protect data on devices. HIPAA-compliant syncing is beyond the scope of this article and it is recommended syncing is turned off.

To avoid a HIPAA violation, covered entities should:

  • Obtain a BAA from Google prior to using G Suite with PHI
  • Configure access controls carefully
  • Use 2-factor authentication for access
  • Use strong passwords
  • Turn off file syncing
  • Set link sharing to off
  • Restrict sharing of files outside the domain (Google offers advice if external access is required)
  • Set the visibility of documents to private
  • Disable third-party apps and add-ons
  • Disable offline storage for Google Drive
  • Disable access to apps and add-ons
  • Audit access and account logs and shared file reports regularly
  • Configure ‘manage alerts’ to ensure the administrator is notified of any changes to settings
  • Back up all data uploaded to Google Drive
  • Ensure staff are training on the use of Google Drive and other G Suite apps
  • Never put PHI in the titles of files

To help HIPAA-covered entities use G Suite and Google Drive correctly, Google has released a Guide for HIPAA Compliance with G Suite to assist with implementation.

The post Is Google Drive HIPAA Compliant? appeared first on HIPAA Journal.

NotPetya Attack Continues to Disrupt Nuance Communications’ Services

Posted by HIPAA Journal

In late June, Nuance Communications, a provider of healthcare solutions and transcription services, was one of many organizations around the globe to have systems taken out of action by NotPetya ransomware.

While most ransomware attacks are conducted with the intention of obtaining ransom payments in exchange for the keys to unlock data, NotPetya was different. The aim was sabotage. Infection resulted in permanent encryption of master file tables, preventing infected computers from locating stored data. Data recovery was not possible even if the ransom demand was paid.

The attacks caused permanent damage at many organizations requiring the replacement of hardware and substantial portions of affected networks. Nuance Communications was no different.

Following the attack, Nuance Communications brought in external security experts to contain the infection and determine the extent of the attack. However, not in time to prevent widespread damage. Systems were taken out of action preventing hundreds of hospitals from using its services.

Premier Health was one of many hospital systems forced to switch transcription service providers. Boston’s Beth Israel Deaconess Medical Center was also impacted and has been prevented from using Nuance’s eScription service. University of Pittsburgh Medical Center was similarly affected and still cannot use the company’s transcription service.

It took Nuance Communications until July 3 to bring its eScription RH and Clinic 360 clients back online on the Emdat platform, and until July 5 to bring its eScription LH platform back online.  By July 11, almost 200 hospitals had started using its eScription LH platform again, although some company services continue to be disrupted.

Nuance Communications spokesperson Richard Mack announced yesterday that “We are doing everything within our power to support our health-care customers and provide them with the information and resources they need to provide quality patient care, including offering an alternative system and solutions.”

In addition to fixing its systems and working hard to bring customers back online, the company has been improving its security to prevent future attacks.

Even though most systems are now back online, it may be difficult to convince hospitals to return. Many have since switched to other service providers as a result of the attack and loss of its services. Many are unlikely to return. That is likely to make a serious dent in its Q3 profits at the very least. At present, the company’s share price has fallen 6% since the attack.

The post NotPetya Attack Continues to Disrupt Nuance Communications’ Services appeared first on HIPAA Journal.

U.S. Data Breaches Hit Record High

Posted by HIPAA Journal

Hacking still the biggest cause of data breaches and the breach count has risen once again in 2017, according to a new report released by the Identity Theft Resource Center (ITRC) and CyberScout.

In its half yearly report, ITRC says 791 data breaches have already been reported in the year to June 30, 2017 marking a 29% increase year on year. At the current rate, the annual total is likely to reach 1,500 reported data breaches. If that total is reached it would represent a 37% increase from last year’s record-breaking total of 1,093 breaches.

Following the passing of the HITECH Act in 2009, the Department of Health and Human Services’ Office for Civil Rights (OCR) has been publishing healthcare data breach summaries on its website. Healthcare organizations are required by HIPAA/HITECH to detail the extent of those breaches and how many records have been exposed or stolen. The healthcare industry leads the way when it comes to transparency over data breaches, with many businesses failing to submit details of the extent of their breaches.

ITRC says it is becoming much more common to withhold this information. In the first 6 months of 2017, 67% of data breach notifications and public notices did not include the number of records exposed, which is a 13% increase year on year and a substantial increase from the 10-year average of 43%. The lack of full information about data breaches makes it harder to produce meaningful statistics and assess the impact of breaches.

81.5% of healthcare industry data breach reports included the number of people impacted – a similar level to 2016. ITRC points out that does not mean healthcare organizations are failing to provide full reports, only that HITECH/HIPAA regulations do not require details of breaches of employee information to be reported.

The OCR breach portal shows healthcare industry data breaches in the year to June 30, 2017 increased by 14% year on year. 169 breaches were reported in the first six months of 2017 compared to 148 in the same period in 2016.

Hacking is Still the Biggest Cause of U.S Data Breaches

The biggest cause of U.S data breaches is still hacking according to the report, accounting for 63% of data breaches reported in the first half of the year across all industries – and increase of 5% year on year. Phishing, ransomware, malware and skimming were also included in the totals for hacking. 47.7% of those breaches involved phishing and 18.5% involved ransomware or malware.

The second biggest causes of U.S. data breaches were employee error, negligence and improper disposal, accounting for 9% of the total, followed by accidental exposure on the Internet – 7% of breaches.

The OCR breach portal shows 63 healthcare data breaches were attributed to hacking/IT incidents – 37% of the half yearly total. That represents a rise of 19% from last year.

In close second place is unauthorized access/disclosure – 58 incidents or 35% of the total. A 14% decrease year on year. In third place is loss/theft of devices – 40 incidents or 24% of all healthcare data breaches. A 4% fall year on year. The remaining 4% of healthcare data breaches – 7 incidents – were caused by improper disposal of PHI/ePHI.

Matt Cullina, CEO of CyberScout, said “All these trends point to the need for businesses to take steps to manage their risk, prepare for common data breach scenarios, and get cyber insurance protection.”

The post U.S. Data Breaches Hit Record High appeared first on HIPAA Journal.

Study Reveals 56% of Healthcare Organizations Plan to Invest in Data Breach Protection Solutions

Posted by HIPAA Journal

The Netwrix Corporation, a provider of a visibility platform for data security and risk mitigation in hybrid environments, has published the results of a recent study on healthcare IT risks. Netwrix asked healthcare IT professionals about the biggest security risks faced by their organizations, how security budgets are being allocated and the main areas where future security budgets will be directed.

Netwrix said, “We aimed to look deeper into IT security practices, successful experiences and plans of healthcare organizations, as well as the most typical pain points.”

The survey shows the biggest data security concern of healthcare IT professionals is employees. 56% of respondents said employees were the biggest data security threat. Only 38% believe the biggest threat comes from hackers.

The results are unsurprising since the majority of data security incidents in 2016 were caused as a result of the actions of employees. The two biggest causes of data security incidents last year were malware and human error, with malware often installed as a result of the actions of employees. 59% of respondents said they had experienced malware incidents in 2016 while 47% said they had to deal with security incidents caused by human error.

While healthcare organizations have invested heavily in cybersecurity defenses, only 31% of respondents said their organization is well prepared to beat cyber risks. Budgets are primarily being directed at protecting endpoints, databases and virtual infrastructure. 61% said their main focus was endpoint security, 56% said databases and 47% said virtual infrastructure.  The main focus of future investment was data breach prevention for 56% of organizations, with 25% saying they are focused on new measures to prevent intellectual property theft and 25% on technologies to prevent cyber sabotage.

The report authors pointed out that “Despite following the requirements of HIPAA and other compliance standards, medical organizations are likely to focus on certain areas of IT environment instead of having visibility across all critical systems, which increases their vulnerability to cyber threats.”

The study revealed there are a number of key areas where security protections are lacking. 38% of respondents said unstructured data in third party data centers was a major data security risk. The other main areas that had been neglected were BYOD (29%) and shadow IT (21%).

Data stored in third party data centers tends not to be as sensitive as data stored on premise, although poor visibility and a lack of control of data in hybrid cloud environments posed security problems. While measures are being introduced to improve the security of personal devices, a lack of visibility threatened organizations’ security posture.

Michael Fimin, CEO and co-founder of Netwrix. “Having a clear understanding of what is going on in the environment will help [healthcare organizations] mitigate the risk of human errors, detect and investigate incidents faster, and, as a result, improve the security of their sensitive patient data.”

The main obstacles preventing healthcare organizations from managing cybersecurity risks more effectively were time and money. Three quarters of respondents said a lack of money and a lack of time were hampering efforts to manage cyber risks more effectively, while 44% of respondents said a lack of participation of senior management was a major obstacle.

Healthcare organizations have had plenty of time to implement policies to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA) and ensure sufficient security protections are in place to ensure protected health information is safeguarded. However, 36% of respondents said they had experienced problems with compliance and passing audits. One of the major problems was not a failure to maintain an audit trail of user activity but the inability to access that information and produce it for auditors in the allocated time frame.

The post Study Reveals 56% of Healthcare Organizations Plan to Invest in Data Breach Protection Solutions appeared first on HIPAA Journal.

Office of Inspector General Releases Results of VA FISMA Audit

Posted by HIPAA Journal

The Department of Veteran Affairs’ Office of Inspector General has conducted its annual security review of the VA, the largest healthcare provider in the United States. The aim of the security review is to assess the VA’s information security program in accordance with the Federal Information Security Modernization Act (FISMA).

The report reveals there are many ongoing security vulnerabilities that need to be addressed, although this year’s report only adds three new recommendations. In total, OIG made 33 recommendations about how the VA can make improvements to addresses security weaknesses.

Those 33 recommendations are spread across 8 areas: The security management program, identity management and access controls, configuration management controls, system development and change management controls, contingency planning, incident response/planning, continuous monitoring and contractor systems oversight.

The three new recommendations in this year’s report are:

  • Weaknesses have been identified in the agencywide information and risk management program. OIG recommends processes are implemented to ensure all systems used by the VA are formally Authorized to Operate. System security controls should also be evaluated prior to systems connecting to the Internet or the VA network.
  • Weaknesses have been identified in the VA’s configuration management controls. OIG recommends the VA should improve and implement processes to ensure all devices and platforms are evaluated using credentialed vulnerability assessments.
  • Weaknesses have been discovered in incident response and monitoring. OIG recommends that the VA’s Network Security and Operations Center should be provided with full access to security incident data to help raise awareness of information security events.

The OIG report says considerable improvements have been made and security has been improved. New policies and procedures have been implemented and great strides are being made to improve agencywide security; however, many vulnerabilities persist and the VA faces considerable challenges implementing various components of its information security continuous monitoring and risk management program. OIG found significant deficiencies in the VA’s access controls, configuration management controls, continuous monitoring controls and service continuity practices.

OIG says the VA must concentrate its efforts on four key areas to better achieve FISMA outcomes. These are:

  • Address security issues that contributed to the information technology material weaknesses detailed in the FY 2016 audit of VA’s Consolidated Financial Statements.
  • Address process deficiencies to ensure system Authorizations to Operate and conducted in accordance with VA policy.
  • Make improvements to the speed of deployment of system upgrades, system configurations and security patches to address known vulnerabilities, and enforce a consistent process across all field offices.
  • Make improvements to performance monitoring to ensure security controls are operating as intended in all facilities. Identified security deficiencies should also be effectively communicated to appropriate personnel to ensure action can be taken to mitigate risks.

Many of the deficiencies identified in the report are common in the healthcare industry. While it is not possible to totally eliminate risks, it is possible to reduce those risks to an acceptable level. Some of the vulnerabilities are expected to be addressed when the VA transitions from its VistA EHR to the new Cerner EHR.

The post Office of Inspector General Releases Results of VA FISMA Audit appeared first on HIPAA Journal.

Healthcare IoT Security Market Predicted to Grow at CAGR of 22% over Next 5 Years

Posted by HIPAA Journal

Internet of Things (IoT) devices such as wearable sensors, implants, medical devices and home monitoring systems have the potential to greatly improve patient services and quality of care. The IoT could revolutionize the healthcare industry and adoption of the technology already high.

IoT devices can be controlled remotely and are highly automated. Implementing the technology can result in improvements to efficiency, accuracy and there are considerable economic benefits. However, IoT devices introduce considerable risks.

IoT devices are now being introduced, even though security is a major concern and many of the devices are not covered by existing security solutions. A recent healthcare-specific Thales Data Threat Report suggested that 60% of healthcare organisations are deploying new technologies before appropriate security is implemented. That said, investment in security technologies is increasing and healthcare organizations are working on improving security for IoT devices. There is currently strong demand for new security solutions and that is unlikely to change.

Currently the global healthcare IoT security market is valued at $4.8 billion, according to a recent Market Research Future report. Over the next five years, the market is expected to grow to $15.82 billion with a CAGR of 22%.

Market Research Future says the explosive growth in the IoT security market is driven by several factors, including the potential for huge savings to be made by increasing automation. Therefore, there is likely to be high adoption of the technology by the healthcare industry.

New smart devices are likely to come to market over the next five years which will require security solutions to protect them and the data they store, with R&D expenditure likely to increase. There is expected to be greater integration of the devices into the Internet ecology and cross transferability of IoT security to a wide range of industry sectors.

Factors that could hinder growth include shorter product lifecycles and greater sink costs associated with IoT technology. While adoption of new IoT technology is expected to be greatest in the United States, globally, growth may be limited by a lack of connectivity and bandwidth, a lack of a legal framework covering the technology and a lack of trained professionals.

Market Research Future suggests the major players in the IoT Security market over the next five years will be Cisco Systems, IBM, Intel Corporation, Sophos Group, Oracle Corporation, Trend Micro Inc., and Symantec, although many other security firms are expected to expand and develop new IoT security solutions to meet demand.

The post Healthcare IoT Security Market Predicted to Grow at CAGR of 22% over Next 5 Years appeared first on HIPAA Journal.

Princeton Community Hospital Replaces Network After NotPetya Attack

Posted by HIPAA Journal

Recovery from the WannaCry ransomware attacks was a long and complicated process for many healthcare organizations. Recovery from the recent NotPetya attacks has also been problematic.

In contrast to WannaCry, NotPetya is not actually ransomware. While it bears a number of similarities to a strain of ransomware called Petya, the virus is actually a wiper. The attacks initially appeared to involve ransomware, but the aim of the attacks was to wipe out computers and destroy data. A ransom demand was presented on screen claiming payment of a ransom would allow an organization to obtain the keys to unlock data, but access to files cannot be restored as the decryption keys do not exist.

Attacks in the United States were limited, with five known healthcare victims. Princeton Community Hospital in West Virginia is one of the organizations struggling to recover.

Princeton Community Hospital has been attempting to bring its systems back online since the attack last Tuesday. The hospital reports that attacked devices cannot now be used on the hospital’s network. The hospital is having to replace its entire network, including installing new hard drives on all affected devices.

The NotPetya attack caused considerable disruption, although the hospital quickly restored basic access to medical records by installing new computers at strategic points around the hospital. Medical records, details of medications and allergies and other essential information could therefore be accessed through the computers. Efforts are continuing to implement a new network.

Employees have been told on social media and via its website that the attack also took out the quick charge system in the cafeteria, the Meditech payroll system and the Kronos time system.

Even though computer systems were severely affected, inpatient, outpatient and radiology services continued to be provided, although there have been some delays, especially for non-emergency patients. The hospital said it would take a few days for the network to be rebuilt and for significant functionality to be restored.

The Heritage Health System was also affected, with much of its network of hospitals, satellite and community facilities affected. Pharma firm Merck was also attacked, as was Nuance, a Massachusetts based vendor of dictation and transcription services for the healthcare industry. In total, approximately 2,000 other organizations in 65 countries around the globe were affected. Approximately half of the attacks were on industrial organizations, with Ukraine hit particularly hard.

Many more healthcare organizations are likely to have been affected, although it is likeloy to be some time before the scale of U.S. attacks is known. Indicators of compromise have been shared with HITRUST via its cyber threat information exchange platform, although since information is shared anonymously it is unclear which organizations have been affected. Ransomware and other virus attacks that involve ePHI compromises are reportable to the Office for Civil Rights, although since covered entities have up to 60 days to report incidents it is likely to be several weeks before all covered entities affected by NotPetya are known.

The post Princeton Community Hospital Replaces Network After NotPetya Attack appeared first on HIPAA Journal.

U.S. Healthcare Providers Affected by Global Ransomware Attack

Posted by HIPAA Journal

NotPetya ransomware attacks have spread to the U.S. Decryption may not be possible even if the ransom is paid. Details of how to prevent attacks are detailed below.

NotPetya Ransomware Attacks Spread to the United States

Tuesday’s global ransomware attack continues to cause problems for many organizations in Europe, with the attacks now having spread to North America. The spread of the ransomware has been slower in the United States than in Europe, although many organizations have been affected including at least three healthcare systems.

Pennsylvania’s Heritage Valley Health System has confirmed that its computer systems have been infected with the ransomware. The ransomware has affected the entire health system including both of its hospitals and its satellite and community facilities.

While medical services continue to be provided, computer systems were shut down and some non-urgent medical procedures were postponed. 14 of the health system’s community facilities were closed on Wednesday as a result of the attack and lab and diagnostic services were also affected

The health system’s communications director, Suzanne Sakson said, “Corrective measures supplied by our antivirus software vendor have been developed and are being implemented and tested within the health system.”

No evidence has been uncovered to suggest protected health information has been accessed, although an investigation into the incident is ongoing.

West Virginia’s Princeton Community Hospital has also been affected with many of the hospital’s computers taken out of action following infection with ransomware. An investigation has been launched to determine whether patient health information was potentially accessed. Hospital spokesperson Rick Hypes said the hospital has implemented its protocols for cyberattacks and patient care is continuing to be provided.

The New Jersey-based pharmaceutical firm Merck has also been affected.

While it was initially believed the attacks involved Petya ransomware, security researchers believe this is a Petya-like ransomware variant from the same family. It has already attracted a variety of names including NotPetya, SortaPetya, GoldenEye, Petna, Nyeta and ExPetr.

Decryption Unlikely, Even if the Ransom is Paid

The ransomware variant deletes and replaces the Master File Table (MFT) which prevents computers from being able to locate files. The attackers have collected some ransom payments, although recovering systems by paying the ransom may not be possible.

The attacker was using an email account through a German email provider; however, that email account has been suspended. The email account was used to verify payment of a ransom. Without access to that email account, payment verification would be prevented.

Security researchers at Kaspersky Lab have also discovered a flaw in the ransomware which prevents data recovery, even if the ransom is paid. Kaspersky Lab issued a statement saying “We have analyzed the high level code of the encryption routine and we have figured out that after disk encryption, the threat actor could not decrypt victims’ disks.”

Some security researchers have suggested that the goal of the attack was therefore not extortion but sabotage. Matt Suiche suggested in a recent analysis of the attack that “The ransomware was a lure for the media, this version of Petya actually wipes the first sectors of the disk like we have seen with malwares such as Shamoon.” However, also likely is a mistake by the attackers when developing their ransomware.

The number of victims has been steadily rising, with Kaspersky Lab identifying 2,000 attacks on Tuesday, while Microsoft now reports there has been at least 12,500 infections across 65 countries.

The attacks have hit multinational companies hard, with infections first occurring in European facilities but then subsequently spreading across networks to other geographical locations. Shipping firm Maersk had its Danish facilities infected, followed by infections in Ireland, the UK and other countries.

How to Prevent Infection with NotPetya Ransomware

Two exploits released by Shadow Brokers have been used to spread infections – EternalBlue and EternalRomance – both of which were addressed with the MS17-010 patch issued by Microsoft in March, which was subsequently expanded for use on non-supported Windows versions such as Windows XP following the WannaCry ransomware attacks last month.

However, if one computer on a network has not been patched the machine can be infected. The infection can then spread across a network to patched computers.

Even if all vulnerable machines have been patched, infection may still occur. The attackers are using multiple attack vectors including spam emails containing malicious attachments.

To protect against these NotPetya ransomware attacks – and other similar attacks – the MS17-010 patch must be applied to all Windows devices. Since data recovery may not be possible it is essential for data to be backed up, with multiple copies made, including one copy on an air-gapped machine that is not exposed via the Internet.

Rapid7 recommends organizations should “employ network and host-based firewalls to block TCP/445 traffic from untrusted systems.” Additionally, “if possible, block 445 inbound to all internet-facing Windows systems.”

PsExec and wmic.exe should also be disabled to limit the ability of the ransomware to spread.

Since infection can occur via email, organizations should send alerts to company employees alerting them to the risk of attack from infected email attachments, specifically – but not exclusively – Microsoft Excel spreadsheets.

Security researcher Amit Serper at Cyberreason suggests it is possible to ‘vaccinate’ computers to prevent encryption, with his method confirmed by a number of firms such as Emisoft and PT security.

Serper says, “Create a file called perfc in the C:\Windows folder and make it read only.” Details of how to do this are available on Beeping Computer.

The post U.S. Healthcare Providers Affected by Global Ransomware Attack appeared first on HIPAA Journal.

Reports Flood in on New ‘Unprecedented’ Global Ransomware Attack

Posted by HIPAA Journal

A major global cyberattack involving Petya ransomware is currently underway, with firms across Russia, Ukraine and Europe affected. The attack is understood to involve Petya ransomware, in what appears to be a similar incident to the WannaCry ransomware attacks last month.

Companies confirmed as being infected with the ransomware include the Russian oil firm Rosneft, the Russian metal maker Evraz, French construction materials firm Saint Gobain, many Russian banks, the international Boryspil airport in Ukraine, the Ukraine government, two Ukrainian postal services, the Ukrainian aviation firm Antonov, shipping firm A.P. Moller-Maersk, legal firm DLA Piper, food manufacturer Mondelex and the advertising group WPP.  Many more companies are believed to have have been attacked with the list of victims certain to grow. Attacks now occurring in the UK and India and may spread further afield. Ukraine’s Prime Minister Volodymyr Groysman has said the ransomware attack is unprecedented.

The attacks appear to have started Tuesday, with Russian cybersecurity firm Group-IB suggesting ransomware was installed using some of the NSA exploits published by Shadow Brokers – two of those exploits were also used to install WannaCry ransomware on organizations around the globe last month.

In contrast to WannaCry, Petya ransomware is not understood to have a kill switch. Recovery from the attack will only be possible if data backups exist and have not been encrypted in the attack or if the ransom is paid. The ransom demand is understood to be $300 per infected device.

Petya ransomware is different to many other ransomware variants as it does not encrypt files. Instead, the ransomware attacks and replaces the Master File Table (MFT). The MFT is needed by computers to determine the location of files stored on the hard drive. Without access to the MFT, files cannot be located. Files are not encrypted, but since the files cannot be located the end result is the same. Files cannot be opened.

At this stage, the infection process is not fully understood, with some news outlets claiming the attacks are occurring via malicious email attachments, while others report they involve exploits for unaddressed vulnerabilities.

Further information will be published when it becomes available.

The post Reports Flood in on New ‘Unprecedented’ Global Ransomware Attack appeared first on HIPAA Journal.