Healthcare Cybersecurity

Airway Oxygen Inc. Ransomware Attack Impacts up to 500,000 Individuals

Posted by HIPAA Journal

A ransomware attack on the Wyoming, MI-based medical supply company Airway Oxygen Inc., in April 2017 has potentially resulted in the protected health information of 500,000 individuals being accessed by the attackers.

No evidence of data access or theft was uncovered by Airway Oxygen, although it was not possible to rule out the possibility that information was compromised in the attack.

The attackers gained access to the company’s technical infrastructure on April 18, 2017 and installed ransomware. The part of the network affected was discovered to contain protected health information including names, addresses, birth dates, contact telephone numbers, medical diagnoses, health insurance policy numbers and details of the services the company provided to patients. Financial information and Social Security numbers were not exposed.

Upon discovery of the cyberattack, immediate action was taken to prevent further network intrusions and a scan of the entire system was performed to search for any additional malware. Passwords for users, vendors and applications were changed as a precaution. Airway Oxygen has reported the incident to the FBI and has brought in a third-party cybersecurity company to conduct a full investigation to determine how the ransomware was installed and the impact of the breach.

The incident has prompted Airway Oxygen to update its security tools and deploy new security protections to prevent future attacks. A firewall review has been scheduled and a new system has been installed to monitor suspicious firewall activity. That system will issue alerts if suspicious firewall activity is detected. The firm will also continue to review its security protections to reduce the risk of future incidents occurring.

Affected individuals were notified of the breach this month and provided with information on the steps they can take to secure their accounts and prevent fraud. While the attackers are not believed to have viewed PHI, affected individuals have been advised to monitor all their healthcare and financial accounts for suspicious activity.

Airway Oxygen Inc., has not released details about the type of ransomware involved, the ransom amount demanded by the attackers or whether the ransom was paid.

Last year, the HHS’ Office for Civil Rights issued guidance for covered entities on ransomware attacks, explaining that a ransomware attack that results in the encryption of data is a reportable security incident unless the covered entity had encrypted PHI prior to the ransomware attack occurring or it can be demonstrated, by means of a risk assessment, that there is a low risk of PHI having been accessed, used, disclosed or modified. Following the WannaCry ransomware attacks last month, OCR reconfirmed that ransomware attacks are usually reportable incidents.

The post Airway Oxygen Inc. Ransomware Attack Impacts up to 500,000 Individuals appeared first on HIPAA Journal.

FDA Chief Announces New Plan for Post-Market Regulation of Digital Health Products

Posted by HIPAA Journal

Food and Drug Administration (FDA) Commissioner Scott Gottlieb, M.D., has announced the FDA will be launching a new, risk-based regulatory framework in the fall for overseeing connected medical technology, including health apps and medical devices.

The FDA wants to encourage and promote innovation that will lead to the development of new and beneficial medical technologies; however, it is essential that these technologies can benefit patients without placing their health or privacy at risk.

Gottlieb said the FDA has now developed a new Digital Health Innovation Plan that will foster “innovation at the intersection of medicine and digital health technology.” The plan includes a novel post-market approach that will allow the regulation of digital medical devices and health-related apps.

In a recent blog post, Gottlieb pointed out that close to 165,000 health-related apps have now been released for Smartphones and Apple devices, with forecasts estimating the apps will be downloaded 1.7 billion times by the end of this year. These apps have the potential to improve the health of patients, empowering them to make better day-to-day heath decisions and manage their health conditions more effectively.

There has been an explosion in the number and types of connected digital health devices in recent years, including health-tracking apps, fitness trackers and medical devices. There has been considerable innovation in the field, although Gottlieb said there is currently some ambiguity about how the FDA regulates apps and medical devices which results in some innovators steering clear of healthcare and focussing efforts on other ventures.

The FDA’s aim is to release clear guidance for developers that will enable them to understand all regulatory requirements on their own without having to obtain answers from the FDA on each individual technological change they wish to make.

The new guidance will cover a wide range of digital health products with multiple software functions, including some apps and devices that currently fall outside the scope of FDA regulation.

Gottlieb said, “Greater certainty regarding what types of digital health technology is subject to regulation and regarding FDA’s compliance policies will not only help foster innovation, but also will help the agency to devote more resources to higher risk priorities.”

The FDA will be running a pilot program for its new, risk-based regulatory framework this fall. The pilot program is still under development and the FDA is currently determining how a third-party certification program can be developed that will allow low-risk digital health products to be marketed without the need for a premarket review by the FDA.

High-risk products will still require a pre-market review, although the FDA is looking at ways the process can be streamlined. The FDA is considering a certification program that would assess companies on their products to determine whether they are reliably and consistently engaging in high quality software design and have been diligently validating their software products.

Gottlieb said, “Employing a unique pre-certification program for software as a medical device (SaMD) could reduce the time and cost of market entry for digital health technologies.”

“Applying this firm-based approach, rather than the traditional product-based approach, combined with leveraging real-world evidence, would create market incentives for greater investment in and growth of the digital health technology industry.”

The post FDA Chief Announces New Plan for Post-Market Regulation of Digital Health Products appeared first on HIPAA Journal.

Healthcare Data Breach Costs Fall to $380 Per Record

Posted by HIPAA Journal

Healthcare data breach costs have fallen year-over year according to the latest IBM Security/Ponemon Institute study. However, for the seventh straight year, healthcare data breach costs were higher than any other industry sector.

This year, the Ponemon Institute calculated the average healthcare data breach costs to be $380 per record. The average global cost per record for all industries is now $141, with healthcare data breach costs more than 2.5 times the global average. Last year, average healthcare data breach costs were $402 per record. The average cost of a breach in the United States across all industries is $225 per record, up from $221 in 2016.

Data breach costs have risen substantially over the past seven years, although the latest report shows there was a 10% reduction in data breach costs across all industry sectors. This was the first year that data breach costs have shown a decline. The average global cost of a data breach now stands at $3.62 million, having reduced from $4 million last year.

The study was conducted globally, with 63 organizations in the United States surveyed. Those organizations were spread across 16 industry sectors. The Ponemon Institute surveyed each company after they experienced the loss or theft of sensitive information and had issued breach notifications to affected individuals. Sensitive data was classed as “An individual’s name plus Social Security number, medical record and/or a financial record or debit card.”

In the United States, the surveyed companies experienced data breaches that resulted in the exposure or theft of between 5,563 and 99,500 records, with an average of 28,512 records per breach.

The Ponemon compared the total cost of a breach with the average cost over the past four years. In the United States, the total cost of a data breach rose from $7.01 million to $7.35 million. This was the highest total breach cost since IBM Security/Ponemon first started conducting the study.

Across all industry sectors, the cost of a data breach was higher for malicious or criminal attacks ($244 per record) followed by system glitches ($209 per record) and human error ($200 per record). The breakdown of the causes of the breaches were malicious or criminal attacks ($52%), system glitches (24%) and human error (24%).

How do Healthcare Data Breach Costs Compare to Other Industries?

 

United States Data Breach Costs
Industry Average Cost per Record (USD)
Healthcare 380
Financial Services 336
Services 274
Life Sciences 264
Industrial 259
Technology 251
Education 245
Transportation 240
Communications 239
Energy 228
Consumer 196
Retail 177
Hospitality 144
Entertainment 131
Research 123
Public Sector 110
Average Cost 225

 

The study showed the United States has higher breach costs than Europe, where the average cost of a data breach declined by 26% year-over-year. The Ponemon Institute attributed this, in part, to the centralized regulatory environment in Europe. In the United States, organizations have to comply with federal regulations as well as separate regulations in 48 of the 50 states. This makes the breach response labor intensive and extremely costly.

The report suggests the reason for the rise in breach costs in the United States was the result of compliance failures and a rush to notify individuals, with the latter costing organizations 50% more than in Europe. The study revealed the cost of issuing breach notifications was $690,000 on average in the United States – twice the figure of any other country.

The study showed that when third parties were involved in a breach there was an increase in data breach costs, typically adding an extra $17 per record.

As in previous years, a rapid response to a data breach saw organizations limit the cost. When an incident response plan was in place prior to a breach, organizations were able to save an average of $19 per record. There was an average reduction in breach costs of $1 million when organizations were able to contain the breach within 30 days. However, on average, companies took more than six months to discover a breach and more than 66 days to contain it.

Other factors that led to a reduction in breach costs were the use of encryption, which saw a $16 reduction in costs per record and employee education which saw breach costs reduced by $12.50 per record.

Dr. Larry Ponemon, Chairman and Founder of the Ponemon Institute said, “Data breaches and the implications associated continue to be an unfortunate reality for today’s businesses,” explaining, “Year-over-year we see the tremendous cost burden that organizations face following a data breach.

The post Healthcare Data Breach Costs Fall to $380 Per Record appeared first on HIPAA Journal.

May’s Healthcare Data Breach Report Shows Some Incidents Took 3 Years to Discover

Posted by HIPAA Journal

The May 2017 healthcare Breach Barometer Report from Protenus shows there was an increase in reported data breaches last month. May was the second worst month of the year to date for healthcare data breaches with 37 reported incidents, approaching the 39 data breaches reported in March. In April, there were 34 incidents reported.

So far, each month of 2017 has seen more than 30 data breaches reported – That’s one reported breach per day, as was the case in 2016.

In May, there were 255,108 exposed healthcare records representing a 10% increase in victims from the previous month; however, it is not yet known how many records were exposed in 8 of the breaches reported in May. The number of individuals affected could rise significantly.

The largest incident reported in May was the theft of data by TheDarkOverlord, a hacking group/hacker known for stealing data and demanding a ransom in exchange for not publishing the data. The latest incident saw the data dumped online when the organization refused to pay the ransom.

While April saw a majority of healthcare data breaches caused by hackers, in May it was insiders that caused the most data breaches. Insiders were responsible for 40.54% of data breaches (15 incidents) in May, with 10 the result of insider errors and 5 incidents the result of insider wrongdoing. In total, 39,491 healthcare records were exposed as the result of insiders.

Hacking was the second biggest cause of data breaches, accounting for 35.14% of the month’s reported breaches. As is typical, hacking resulted in the exposure of the most records – 203,394. At least three of those hacking incidents involved ransomware.

This month’s report proved problematic, as several hacking incidents were discovered after data were posted on black market websites, yet it is unclear whether the incidents are genuine as efforts to verify the data proved inconclusive.

Loss or theft of unencrypted devices and physical records accounted for 13.51% of breaches. Those incidents resulted in the exposure of 4,122 records, although it is unclear how many records were exposed in one of the 4 breaches involving theft/loss. The cause of the 10.81% of incidents is still unknown.

Healthcare providers reported 81% of the months’ breaches, followed by business associates (11%) and health plans (8%).

Over the past two months there has been an improvement in the reporting of healthcare data breaches, with more covered entities reporting incidents inside the 60-day limit of the HIPAA Breach Notification Rule. This month 83% of covered entities reported their breaches on time, an improvement from last month when just 66% of breaches were reported within 60 days. One covered entity took 77 days to report a breach while another took 140 days; more than twice the allowable time. The improvement could be due, in part, to OCR’s decision to fine a covered entity $475,000 for the late issuing of breach notifications to patients.

This month’s Breach Barometer report shows that while breach reporting is improving, breach detection remains a problem. April’s breaches took an average of 51 days to detect, whereas in May it took an average of 441 days for healthcare organizations to discover a breach had occurred. Three healthcare organizations took more than three years to discover a breach had occurred. One healthcare organization took almost three and a half years (1,260 days) to discover a breach, another took 1,125 days and one took 1,071 days.

California was once again the worst affected state with 6 breaches, closely followed by Florida with 5 incidents.

The post May’s Healthcare Data Breach Report Shows Some Incidents Took 3 Years to Discover appeared first on HIPAA Journal.

Study: 1 in 5 Enterprise Users Have Set Weak Passwords

Posted by HIPAA Journal

The sharing of passwords across multiple platforms is a bad idea. If one platform suffers a data breach, all other systems that have the same password set could also easily be compromised. Even though the reuse of passwords is unwise, and many organizations have policies in place prohibiting employees from recycling passwords, it remains a common practice.

Many organizations have implemented policies, procedures and technology to prevent weak passwords from being used and they force end users to change their passwords frequently, but it is difficult for organizations to prevent password recycling.

The practice has recently been investigated by Preempt. Preempt has developed a tool that can be used by enterprises to assess the strength of the passwords used by their employees. The tool reports on the accounts that have weak passwords set, allowing the enterprise to take action. The tool also compares passwords to a database of 10 million passwords compromised in previous data breaches that are now in the hands of cybercriminals.

An analysis of data from enterprises that downloaded the Preempt Inspector tool showed that more than 7% of employees are using passwords for their work accounts that have already been compromised in previous data breaches. Preempt also reports that 20% of passwords used by enterprise employees could easily be compromised, even though many enterprises have systems in place to ensure password complexity.

Preempt reports that 1 in 14 enterprise employees have set an extremely weak password that has appeared in a previous breach, while 13.39% of enterprise users have shared their password, either with other users, teams or the password has been used for other services. Preempt says its research shows that 1 in 7 users have disclosed their password to other users within their network.

The study revealed that an average of 19.1% of enterprise users have set poor passwords, either those that have been used elsewhere, have been shared or are particularly weak. This translates to 1 in 5 enterprise users having a password that could easily be guessed by a threat actor.

The study revealed that larger organizations tend to have a better security posture and also a lower percentage of weak passwords in use. The larger the organization, the more secure their passwords are. This has been attributed to larger organizations having more resources devoted to security, with password policies likely to have been set and systems in place to enforce strong passwords. Those organizations are also likely to have more extensive education programs to raise security awareness.

The study was conducted on clients in multiple countries, with US-based organizations having approximately half the number of weak passwords that non-US companies. Preempt suggests that credential theft and cyberattacks are more extensively covered in the media in the United States, raising awareness of security and the need to take steps to prevent data breaches, such as setting strong passwords and not reusing passwords on multiple platforms.

The research shows that even though employees receive security awareness training and policies and technology are used to enforce the use of strong passwords, many employees are still taking big risks with their password choices. Many enterprises may believe they have tackled the issue of poor passwords, when the realty is likely quite different.

The post Study: 1 in 5 Enterprise Users Have Set Weak Passwords appeared first on HIPAA Journal.

Ponemon Study Reveals Impact of Data Breaches on Organizations’ Reputation

Posted by HIPAA Journal

Organizations that experience data breaches can expect many negative repercussions such as loss of reputation, loss of customers and fall of share value. The impact of a data breach on a company’s reputation and share value has recently been studied by the Ponemon Institute.

The Centrify-sponsored survey was conducted on IT operations and information security professionals, senior level marketers, communications professionals and consumers. 31% of the 446 IT practitioners said they had experienced a data breach of more than 1,000 sensitive records in the past two years, while 62% of the 549 consumers surveyed said they had been notified by companies or government agencies that their data had been exposed as a result of a data breach in the past 24 months.

Data breaches are to be expected; however, the study suggests that the C-Suite and boards of directors do not fully appreciate the negative impact data breaches can have on companies’ reputations. The effect can be considerable. The Ponemon Institute tracked the share value of 113 publicly traded companies for 30 days prior to a data breach and for 90 days following the breach. On average, share value dropped by 5% following the disclosure of a data breach.

However, it is possible to stop a decline in share value following a breach, provided companies are able to respond quickly. Companies that had self-declared their security posture to be superior prior to a breach, and were able to respond quickly the security incident, regained stock value after an average of 7 days.

Companies that had a poor security posture and failed to respond quickly saw a stock price decline that lasted an average of 90 days. Organizations with a poor security posture and slow response were also more likely to lose customers as a result of the breach.

The potential for loss of customers is considerable. 31% of consumers said they discontinued their relationships with the breached entity following a data breach, while 65% said they lost trust in the organization after being affected by one or more breaches. The average losses reported by organizations with a low customer loss rate (less than 2%) was $2.67 million. A customer loss rate of 5% resulted in average revenue losses of £3.94 million.

The study also revealed that healthcare organizations are trusted the most when it comes to keeping sensitive information secure. 80% of consumers said they trusted their healthcare providers to protect their sensitive information with the industry ranking highest in terms of consumer trust, even though healthcare organizations experience 34% of all data breaches.

Aside from banking institutions, which were trusted by 77% of consumers, trust in financial institutions was far lower. Only 26% of consumers trusted their credit card company to protect data, even though credit and financial institutions account for just 4.8% of data breaches.

The post Ponemon Study Reveals Impact of Data Breaches on Organizations’ Reputation appeared first on HIPAA Journal.

Microsoft Patches Two Critical, Actively Exploited Vulnerabilities

Posted by HIPAA Journal

Microsoft released a slew of updates this Patch Tuesday, including patches for two critical vulnerabilities that are being actively exploited in the wild. In total, 95 vulnerabilities were addressed yesterday, eighteen of which have been rated critical and 76 as important.

The two actively exploited vulnerabilities are of most concern, in fact one is so serious that Microsoft took the decision to issue a patch for Windows XP, even though extended support for the outdated operating system ended in April 2014. As with the emergency patch issued last month shortly after the WannaCry ransomware attacks, the vulnerability was considered so severe it warranted a patch.

Adrienne Hall, general manager of Microsoft’s Cyber Defense Operations Center, explained the decision to issue a patch for Windows XP saying, “Due to the elevated risk for destructive cyberattacks at this time, we made the decision to take this action because applying these updates provides further protection against potential attacks with characteristics similar to WannaCrypt.”

The flaw – CVE-2017-8543 – exists in the Windows Server Message Block (SMB) service. It was also a SMB service vulnerability that was exploited in the recent WannaCry ransomware attacks that spread to more than 300,000 devices in 150 countries on May 12.

CVE-2017-8543 could similarly be exploited by cybercriminals to install malware with wormlike capabilities, allowing infections to spread rapidly across a network. The flaw exists in most Windows versions, including Windows XP, Windows 7, Windows 8.1 and Windows 10, as well as Microsoft Server 2003, 2008, 2012 and 2016. Microsoft has also issued a patch for Microsoft Server 2003.

As with the WannaCry attacks, the vulnerability could be exploited without any user interaction required. A remote unauthenticated user could trigger the vulnerability via a SMB connection. If exploited, the attacker could take control of the infected device. Since this vulnerability is being actively exploited in the wild, it is essential that the patch is applied promptly.

The other critical – and actively exploited – flaw is CVE-2017-8464: A LNK remote code execution vulnerability. This vulnerability can be exploited using a specially crafted shortcut file.

While not believed to be exploited at present, a memory corruption vulnerability in Outlook (CVE-2017-8507) is of particular concern. An attacker could exploit the vulnerability simply by sending a specially crafted message to an Outlook user. The vulnerability would be triggered when the user views the message, giving the attacker full control of their computer. No attachment would need to be opened in order for the vulnerability to be exploited.

CVE-2017-8527 could also potentially be exploited with little user interaction required. A user would only be required to visit a website with specially crafted fonts.

Patches have also been issued for remote code execution vulnerabilities in Microsoft Edge and Internet Explorer. These flaws are not being actively exploited at present, although the flaws have been publicly disclosed so it is only a matter of time before attacks occur.

In addition to the patches released by Microsoft, Adobe has similarly issued a round of updates. In total, 21 vulnerabilities have been addressed, 15 of which have been rated critical. Four products have been updated – Flash, Shockwave, Captivate and Adobe Digital Editions.

While Microsoft has now issued patches for unsupported operating systems on two occasions in the past 30 days, this should not be taken as a sign that flaws will continue to be addressed. Any organization still using unsupported operating systems should ensure those systems are upgraded to supported Windows versions as soon as possible. Further flaws are likely to be discovered, but Microsoft is unlikely to continue to release patches.

Eric Doerr, general manager of the Microsoft Security Response Center said, “Our decision today to release these security updates for platforms not in extended support should not be viewed as a departure from our standard servicing policies.”

The post Microsoft Patches Two Critical, Actively Exploited Vulnerabilities appeared first on HIPAA Journal.

Reducing the Impact of Healthcare-Focused WannaCry-Style Ransomware Attacks

Posted by HIPAA Journal

by Sean Masters, Worldwide Programs Manager, Services & Support, Zerto

Starting with a major attack on the UK’s National Health Service (NHS) several weeks ago, the WannaCry ransomware attack has now spread to more than 150 countries, producing tens of thousands of infections and causing worldwide data havoc.

Healthcare organizations like the NHS are often prime ransomware targets, because the hackers behind the attacks know that healthcare data is among the most crucial of data types. They take advantage of this fact in the most vicious way possible.  In fact, according to a 2016 Ponemon Institute report, 79 percent of healthcare organizations say they were hit with two or more data breaches in the past two years.

This number is especially striking when you consider that data attacks on hospitals literally put lives at stake. Yet so many healthcare organizations, evidenced by the damages of the WannaCry attacks, are not prepared to address and recover from a disaster when it strikes. In today’s data-reliant environment, if your recovery times are being measured in days or even hours, the damage can be catastrophic from both a corporate asset and patient care perspective.

And, sorry to say, ransomware is not going anywhere. Hackers are only going to get more sophisticated, equating to an increase in both the frequency and severity of attacks. As a result, organizations are increasingly concerned about the cost of defending against attacks. Many are even stockpiling funds to pay ransoms and keep things quiet.

On top of this, healthcare reform is ever-changing and the shifting compliance requirements are hard to keep up with. Now, healthcare organizations must be able to recover data after an outage, like one resulting from a ransomware attack, and demonstrate that they have conducted an annual disaster recovery test.

If a health provider is able to do this successfully and efficiently, it will eliminate the need to pay the ransom when ransomware strikes. A solid disaster recovery plan will help them restore an infrastructure back to just before the attack.

As if looming attacks and audits aren’t enough, on the front-end side, patients have become more demanding and engaged – they expect to be able to view their data online or through a mobile app – which further exposes IT to external threats. Not to mention the numerous self-inflicted issues all types of organizations experience with incidents like a new staff member accidentally shutting down a server, or an incorrectly configured program. One of the more troubling causes of interruptions is regular, routine software patching and upgrades, which are sometimes not of the highest quality and very often exceed the capacity to adequately test an environment.

While IT is a crucial healthcare asset, it’s also creating a stronger dependency on data to keep operations running as normal. With this ever-increasing dependence on data, healthcare IT organizations must put strategies in place to ensure there is never any downtime. One way to achieve this is by leveraging a cloud-based approach that allows for dramatically simpler disaster recovery that makes non-disruptive testing possible, at any time.

Leveraging a hybrid cloud infrastructure, especially, as part of a disaster recovery strategy, introduces certain efficiencies not otherwise available, allowing healthcare IT organizations to accelerate service levels and maximize uptime in the event of an attack or disaster. Lower costs and access to a wide breadth of services offered by using the cloud, can also enable businesses to run tests more easily, a crucial aspect of a sound disaster recovery plan.

Testing the Disaster Recovery Plan Frequently

Non-disruptive disaster recovery testing is key here. You need to be an expert in the event of an outage, and if you’re practicing only once per year, you might not be as on point as you thought when it comes time to bat. Frequent testing is very important – each quarter is ideal. The point of testing is to ensure that each part of the disaster recovery plan is functioning seamlessly.

Testing is extremely important. It doesn’t matter what’s on paper, real scenario testing brings up issues that may have been overlooked. Until testing takes place, on a consistent basis, there is no way to see whether plans will work effectively, especially with today’s increasingly complex systems.

The Impact of Downtime

When most organizations hear the word downtime, the primary concern is the financial impact on the business. According to stats released by healthsystemCIO.com, almost 40 percent of global healthcare organizations experienced a costly unplanned outage in 2016. With an average cost of $432,000 per incident, and at least three incidents per year, downtime costs quickly approach the millions of dollars range.  But in healthcare it’s about so much more. We also must account for the potential detriment to the quality of patient care. This is of course harder to quantify in terms of a dollar amount, but is certainly the highest-priority factor to consider.

Thwarting Cybercriminals

When it comes to cybercrime, Plan A is to keep hackers and malicious actors out. Securing the network and educating employees on the risks is essential to this plan. However, a hacker only needs to be right one time while the corporate IT department has to be right all the time in order to keep hackers out. Therefore, IT needs to also have a Plan B. What happens if hackers do get in, as they did in the case of WannaCry? What is the recovery plan?

Every healthcare organization should be asking themselves these questions if they haven’t already. Ransomware is not always going to be avoidable, but experiencing downtime from it is. The only way to achieve zero downtime (or very close to zero) is to, first, admit that preventative security measures are not enough. Then, with cloud-based tools, put in place a disaster recovery strategy that makes both testing and recovery exceptionally simple and automated. From there, test, test, test and test again.

Follow these steps and the next time a global cybercrime crisis hits, you’ll not only be thankful you did, but you’ll be moving your company forward while others struggle to recover data and avoid downtime.

The post Reducing the Impact of Healthcare-Focused WannaCry-Style Ransomware Attacks appeared first on HIPAA Journal.

OCR Issues Guidance on the Correct Response to a Cyberattack

Posted by HIPAA Journal

Last week, the Department of Health and Human Services’ Office for Civil Rights issued new guidance to covered entities on the correct response to a cyberattack. OCR issued a quick response checklist and accompanying infographic to explain the correct response to a cyberattack and the sequence of actions that should be taken.

Responding to an ePHI Breach

Preparation is key. Organizations must have response and mitigation procedures in place and contingency plans should exist that can be implemented immediately following the discovery a cyberattack, malware or ransomware attack.

The first stage of the response is to take immediate action to prevent any impermissible disclosure of electronic protected health information. In the case of a network intrusion, unauthorized access to the network – and data – must be blocked and steps taken to prevent data from being exfiltrated.

Healthcare organizations may have staff capable of responding to such an incident, although third party firms can be contracted to assist with the response. Smaller healthcare organizations may have little choice but to call in external experts to investigate a breach and ensure access to data has been effectively blocked.

OCR has reminded covered entities that a third-party cybersecurity firm brought in to assist with response and mitigation would be classed as a business associate. Therefore, prior to access to systems being provided, a HIPAA-compliant business associate agreement must be signed by the cybersecurity firm. Failing to obtain a signed BAA prior to access to systems being provided would be a violation of HIPAA Rules and classed as an impermissible disclosure of ePHI.

Cyberattacks Should be Reported to Law Enforcement

A cyberattack is a crime, therefore law enforcement should be notified. Covered entities should alert the FBI and/or Secret Service to any cyberattack or ransomware incident and notify state and local law enforcement. Details of the incident should be provided, although covered entities should not disclose any protected health information, unless otherwise permitted by the HIPAA Privacy Rule (45 C.F.R. § 164.512(f)).

Covered entities have been advised that law enforcement may request breach reporting be delayed when the announcement of a breach may impede an investigation or could otherwise harm national security. Requests by law enforcement should state the duration of the delay and should be honored, while oral requests should result in a delay of no more than 30 days from the original request. (45 C.F.R. § 164.412)

Sharing Threat Indicators

After law enforcement has been notified, covered entities should report cyber threat indicators to federal and information sharing and analysis organizations (ISAOs). The Department of Homeland Security and the HHS Assistant Secretary for Preparedness and Response should be provided with threat indicators, although covered entities should not disclose any protected health information in their reports.

Notifying Affected Individuals and OCR

Covered entities are advised that threat indicator information is not passed to OCR by other federal agencies. Covered entities must therefore submit a separate breach notice to OCR as soon as possible, and certainly no later than 60 days following the discovery of the breach if the incident impacts 500 or more individuals (unless otherwise instructed by law enforcement).

Covered entities can notify OCR of a breach impacting fewer than 500 individuals within 60 days of the end of the calendar year in which the breach was discovered.

According to the guidance, “OCR presumes all cyber-related security incidents where protected health information was accessed, acquired, used, or disclosed are reportable breaches unless the information was encrypted by the entity at the time of the incident.”

In all cases, individuals impacted by a security breach must be notified without unnecessary delay and no later than 60 days following the discovery of a breach.

OCR’s checklist and infographic can be downloaded using the links below:

OCR’s Cyber Security Checklist

Cybersecurity Infographic

The post OCR Issues Guidance on the Correct Response to a Cyberattack appeared first on HIPAA Journal.