Healthcare Cybersecurity

Global Healthcare Cyberattacks Increased by 74% in 2022

Posted by HIPAA Journal

The latest data released by the cybersecurity firm Check Point has confirmed that 2022 was a particularly bad year for cyberattacks, which increased globally by 38% year-over-year fuelled by a sizeable increase in attacks on healthcare organizations. Globally, the healthcare industry had the highest percentage increase in weekly cyberattacks of any industry sector, with an increase of 74% from 2021 to an average of 1,463 attacks per week.

With that increase, healthcare rose to become the third most attacked industry globally behind the government/military with 1,661 attacks a week (+46%) and education/research with 2,314 attacks a week (+43%). In the United States, healthcare ranked second with 1,410 attacks per week, which is an 86% increase from 2021. Across all industry sectors, cyberattacks in the United States increased by 57% year-over-year.

The healthcare industry is an attractive target for cybercriminals due to the volume of easily monetizable data that can be stolen, and the higher-than-average probability of extortion demands being met to prevent the release of stolen data. The Check Point Research team also points out that as an added advantage, ransomware gangs gain a lot of publicity from attacks on hospitals, with the attention increasing their notoriety.

There were notable changes in the threat landscape in 2022, especially concerning ransomware attacks. While in previous years large ransomware groups dominated the threat landscape, in 2022 these larger groups evolved into much smaller, more agile cybercriminal groups that are better able to evade law enforcement. Check Point also notes a diversification in cyberattacks on businesses that now exploit a much wider range of business collaboration tools, including Slack, Microsoft Teams, Google Drive, and OneDrive, all of which are rich sources of valuable data that can be obtained through phishing attacks.

Tracking specific types of cyberattacks in healthcare can be a challenge, as there is no standardized reporting. HIPAA requires data breaches to be reported, but the HHS only tracks cyberattack-related data breaches as hacking/IT incidents. Further, many breached entities choose not to disclose the exact nature of attacks, such as if ransomware was involved. Data collected by Emsisoft suggests ransomware attacks have leveled off, but the cybersecurity firm only analyzed data breaches at hospitals, not the broader healthcare ecosystem which includes healthcare industry vendors which were heavily targeted in 2022.

While the data from Check Point Research indicates an increase in healthcare cyberattacks in the United States, these attacks do not always result in data breaches. The HHS’ Office for Civil Rights breach portal currently indicates a slight reduction in reported data breaches, although data for 2022 is still being added to the breach portal. HIPAA Journal will publish its end-of-year healthcare data breach report next week when there is a clearer picture of the year’s totals but, as it stands on January 10, 2023, 701 data breaches of 500 or more records have been reported to the HHS in 2022, 13 short of the record-breaking total of 714 data breaches in 2021.

While it appears that healthcare data breaches have declined slightly, it is worth noting the increase in the number of breached healthcare records in 2022. Across the 701 data breaches, the records of 51,884,675 individuals have been breached, which is more than any year other than 2015, which included the 78.8 million-record breach at Anthem Inc. That 13.1% increase in breached records is concerning.

2022 also saw two major milestones reached. In 2009, the HHS started publishing a summary of reported healthcare data breaches of 500 or more records. In 2022, the number of reported data breaches surpassed 5,000. The second unwelcome milestone is more healthcare records have now been breached than the entire population of the United States. Since the HITECH Act required OCR to start publishing healthcare data breaches in 2009, more than 382 million healthcare records have been reported as having been exposed or impermissibly disclosed.

The post Global Healthcare Cyberattacks Increased by 74% in 2022 appeared first on HIPAA Journal.

HPH Sector Warned About Clop Ransomware-as-a-Service Operation

Posted by HIPAA Journal

The Health Sector Cybersecurity Coordination Center (HC3) has shared information on the Clop (Cl0p) ransomware-as-a-service operation, the affiliates of which are known to conduct attacks on the healthcare and public health (HPH) sector.

Clop ransomware was first detected in February 2019 and is the successor to CryptoMix ransomware. The group is highly active and was apparently unaffected by the arrest of six operators of the ransomware in 2021, with activity continuing despite the arrests. The group was active throughout 2022, with one month seeing the group conduct attacks on 21 organizations.  The group typically targets organizations with annual revenues in excess of $10 million, which allows large ransom payments, to be demanded although attacks have been conducted on smaller healthcare organizations such as doctors’ and dentists’ offices with revenues over $5 million.

The group uses double extortion tactics, where sensitive data are stolen prior to file encryption and a ransom payment is necessary to prevent the publication of the stolen data and to obtain the keys to decrypt files. Some attacks linked to the group have only involved data theft and extortion. The group follows through on its threats to publish stolen data when the ransom is not paid, as was the case with the attack on the pharmaceutical giant ExecuPharm, where emails, financial records, documents, and database backups were posted on the group’s leak site.

The group works with several other cybercriminal groups, including the financially-motivated threat group tracked as FIN11. A threat group with ties to the Clop ransomware group was behind a series of attacks that exploited a vulnerability in the Accellion File Transfer Appliance (FTA) in December 2020. Several healthcare providers were affected and had sensitive data leaked.

The tactics, techniques, and procedures used by affiliates of the Clop ransomware gang are highly varied and are constantly changing. Initial access is known to have been gained to victims’ networks through phishing, remote desktop compromise, credential abuse, and the exploitation of unpatched vulnerabilities. In late 2022, several attacks were conducted using TrueBot malware to gain initial access to networks.

The group has a good understanding of healthcare IT systems and workflows which has helped the threat actor to conduct several successful attacks on the HPH sector. In 2022, the group allegedly started having difficulties collecting ransom payments which led to a change in tactics. Intercepted communications between group members revealed it had started targeting medical practices that offer telehealth services. In these attacks, the affiliates register as new patients online and request telehealth consultations. Emails are then sent ahead of the appointments with file attachments masquerading as medical images that contain malicious code, in the hope that the files will be opened ahead of the arranged appointments.

The Clop ransomware gang is highly capable, well-funded, and prolific, and is considered to pose a significant threat to the HPH sector.

The post HPH Sector Warned About Clop Ransomware-as-a-Service Operation appeared first on HIPAA Journal.

Urgent Patching Required to Fix Critical Citrix, Netgear, and Zoho ManageEngine Vulnerabilities

Posted by HIPAA Journal

Vulnerabilities have been discovered in Citrix solutions, Netgear routers, and Zoho ManageEngine products that require immediate patching. One of the Citrix vulnerabilities is being actively exploited by an APT actor, and it is likely that attempts will be made to exploit the Netgear and Zoho flaws on unpatched devices.

Citrix Gateway and Citrix ADC Vulnerabilities Being Actively Exploited

In mid-December, organizations that use the Citrix Gateway remote access and/or Citrix ADC load balancing solutions were advised to urgently update to the latest software versions to fix two critical vulnerabilities, CVE-2022-27510 and CVE-2022-27518. Both the National Security Agency (NSA) and the Health Sector Cybersecurity Coordination Center (HC3) issued security alerts about the flaws, one of which is known to have been exploited by a Chinese APT actor to achieve remote code execution on vulnerable servers.

Despite active exploitation, a concerning number of servers remain vulnerable to the flaw, most of which are located in the United States, according to a recent scan by Fox-IT. Since at least one of the vulnerabilities has been actively targeted for several weeks, any organizations that have not yet upgraded to the latest version should do so immediately and also check for potential compromise, per the NSA and HC3 security advisories.

Critical Zoho ManageEngine Vulnerability Requires Immediate Patching

Zoho is urging all users of its ManageEngine Password Manager Pro, PAM360, and Access Manager Plus solutions to update the software to the latest version as soon as possible to fix a critical SQL injection vulnerability. The vulnerability, CVE-2022-47523, could be exploited by an adversary to gain unauthenticated access to the backend database and execute custom queries.

The patches, which were released in late December, add proper validation and escaping special characters to prevent exploitation of the flaw. Users should upgrade to Password Manager Pro v12210, PAM360 v 5801, and Access Manager Plus v4309.

ManageEngine vulnerabilities have previously been targeted by nation-state threat actors, with a 2021 vulnerability suspected of being exploited on Internet-facing servers by a Chinese APT actor, according to a security advisory from CISA and the FBI, so exploitation of the recently disclosed flaw can be expected. Around 11,000 servers are running the affected solutions and will be vulnerable if not updated to the latest versions.

High-Severity Vulnerability Identified in Netgear Routers

Netgear has issued a security advisory about a high-severity pre-authentication buffer overflow vulnerability affecting several models of its routers, which could be exploited by an adversary to trigger a denial-of-service condition. The vulnerability is tracked as PSV-2019-0104 and has a CVSS v3 severity score of 7.4.

The vulnerability affects the company’s RAX40, RAX35, R6400v2, R6400v3, R6900P, R7000P, R7000, R7960P, and R8000P routers. Users should update the firmware as soon as possible to prevent exploitation of the flaws. The updated firmware versions are:

  • RAX40 + RAX35 – Version 1.0.2.60
  • R6400v2 + R6700v3 – Version 1.0.4.122
  • R6900P + R7000P – Version 1.3.3.152
  • R7000 – Version 1.0.11.136
  • R7960P + R8000P – Version 1.4.4.94

The post Urgent Patching Required to Fix Critical Citrix, Netgear, and Zoho ManageEngine Vulnerabilities appeared first on HIPAA Journal.

290 Hospitals Potentially Affected by Ransomware Attacks in 2022

Posted by HIPAA Journal

Ransomware attacks continue to be conducted on healthcare organizations in high numbers but determining the extent to which healthcare organizations are being targeted by ransomware gangs is a challenge. Victims of ransomware attacks do not always report the incidents as involving ransomware, and ransomware gangs do not publicly disclose attacks when ransoms are paid.

The nature of the attacks conducted by ransomware gangs is also changing, with some ransomware gangs opting to conduct extortion-only attacks, where sensitive data is exfiltrated from networks and a ransom demand is issued to prevent its publication or sale, but malware is not used to encrypt files. The decision whether or not to encrypt appears to be taken on an attack-by-attack basis.

The cybersecurity firm Emsisoft tracks ransomware attacks and produces annual reports that provide insights into the extent to which ransomware is used in cyberattacks, but Emsisoft admits that it is difficult to produce reliable statistics. This year’s report shows more than 200 large organizations in the United States have been attacked in the government, education, and healthcare verticals. Attacks in the education sector have remained fairly consistent over the past 4 years with between 84 and 89 attacks conducted each year, as has the number of attacks on state and local governments – 105 in 2022 with an average of 102 attacks a year.

Compiling meaningful data on attacks on healthcare organizations has been particularly challenging as while there are reporting requirements under HIPAA, it is not necessary to disclose the exact nature of the attacks or release details. For this reason, and due to the volume of reports, for the 2022 report, Emsisoft did not compile data for healthcare organizations and instead focused on hospitals and multi-hospital health systems.

For the report, Emsisoft’s researchers compiled data from public breach notices, reports, dark web data leak sites, and from third-party intelligence, with its data confirming that at least 105 counties, 45 school districts, 44 universities, and 25 healthcare providers suffered ransomware attacks in 2022. The true figure is likely to be significantly higher due to the lack of detailed reporting.

Across all ransomware attacks and verticals, hackers stole data prior to using encryption in around half of the attacks, but data theft was much more common in ransomware attacks on hospitals. Out of the 24 confirmed attacks on hospitals, data theft occurred in 17 of those attacks (68%). Due to the lack of accurate data released by healthcare organizations and their business associates, it is not possible to definitively determine whether ransomware attacks have plateaued, are increasing, or declining. What is clear is that the healthcare sector continues to be targeted and a great many patients have been affected by the attacks.

Several of the attacks were conducted on multi-hospital health systems, with 290 hospitals across the country potentially affected by the attacks. That includes the 150 hospitals operated by CommonSpirit Health, which recently confirmed that the protected health information of 623,774 patients was compromised in the attack. CommonSpirit Health has recently confirmed that only a small number of the hospitals it operates were affected.

These attacks often result in the theft of patient data, which can negatively affect patients and put them at risk of identity theft and fraud, but the most serious consequences are to patient health. Studies have been conducted that indicate an increase in mortality following a ransomware attack and a negative impact on patient outcomes due to delays in receiving test results, postponed appointments, and canceled surgeries. While no deaths have been attributed to ransomware attacks, patient outcomes are affected by the delays in receiving treatment. Emsisoft draws attention to one attack that resulted in a computer system used for calculating medication doses being taken offline, which caused a 3-year-old patient to be given a massive overdose of pain medication.

The post 290 Hospitals Potentially Affected by Ransomware Attacks in 2022 appeared first on HIPAA Journal.

HITRUST Cybersecurity Framework Gets 2023 Update

Posted by HIPAA Journal

The information risk management, standards, and certification body, HITRUST, has announced that it will be releasing a new version of its popular cybersecurity framework this month. Version 11 of the HITRUST CSF includes several improvements to ensure the framework stays relevant, with improved mitigations against evolving and emerging cyber threats, while reducing the burden on healthcare organizations for certification.

The HITRUST CSF is a risk management and compliance framework that healthcare organizations can adopt to reduce the burden and complexity of achieving HIPAA compliance and effectively manage and reduce risks to private and confidential information, including protected health information (PHI). To better protect against emerging and evolving cyber threats, the new version of the HITRUST CSF enables the entire HITRUST assessment portfolio to leverage cyber threat-adaptive controls, appropriate for each level of assurance. Control mappings have been improved as has the precision of specifications, which reduces the level of effort required for HITRUST Certification. HITRUST says the updated version of the CSF reduces the effort required to achieve and maintain HITRUST Implemented, 1-year (i1) Certification over two years by up to 45%.

In the updated version, all HITRUST assessments are subsets or supersets of each other, which means organizations can reuse the work in lower-level HITRUST assessments to progressively achieve higher assurances by sharing common control requirements and inheritance. HITRUST also says CSF v11 is fully integrated across Microsoft Azure, Dynamics 365, Microsoft 365, and Power Platform, and that it is collaborating with various partners and healthcare organizations to introduce advanced capabilities to improve clarity on compliance requirements.

The new HITRUST CSF also sees two new authoritative sources added – NIST SP 800-53, Rev 5, and Health Industry Cybersecurity Practices (HICP) standards – and AI-based standards development capabilities have been developed to aid its assurance experts in mapping and maintaining authoritative sources. The latter will reduce mapping and maintenance efforts by up to 70% and will make it easier to add more authoritative sources in future releases.

“There is no question that frameworks need to stay relevant with current and emerging threats so organizations can conduct assessments as efficiently as possible and provide practical, yet meaningful, assurances to stakeholders,” said Andrew Russell, VP of Standards, HITRUST. “The investments we’ve made in our AI-based standards development platform have dramatically improved our ability to assess threat-adaptive mitigations, add authoritative sources, and reduce redundancies, allowing organizations to achieve the same level of assurance with less effort.”

The post HITRUST Cybersecurity Framework Gets 2023 Update appeared first on HIPAA Journal.

How to Secure Patient Information (PHI)

Posted by HIPAA Journal

The issue of how to secure patient information and PHI is challenging because HIPAA does not require all patient information to be secured. Additionally, if Protected Health Information (PHI) is secured too much, it can prevent the flow of information needed to perform treatment, payment, and healthcare operations efficiently.

To best explain how to secure patient information and PHI, it is necessary to distinguish between what is patient information and what is PHI. The easiest way to do this is by defining PHI first, because any remaining information relating to a patient that is not PHI does not need to be secured under HIPAA – although other privacy and security laws may apply.

What is PHI? And What is Not PHI?

The Administrative Simplification Regulations defines PHI as individually identifiable health information “transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium”. To understand why some patient information might not be PHI, it is necessary to review the definition of individually identifiable health information:

“Information […] collected from an individual […] that relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and that identifies the individual or […] can be used to identify the individual.”

These definitions suggest any information that does not relate to a patient´s condition, treatment for the condition, or payment for the treatment is not protected by the privacy and security standards. However, this is not the case.

Individually identifiable health information protected by the privacy and security standards is maintained in one or more “designated record sets”, and any identifying non-health information added to a designated record set assumes the same privacy and security protections. Therefore:

  • “Mr. Jones has a broken leg” is PHI because it identifies the patient and relates to a present health condition.
  • If Mr. Jones´ address, the name of his wife, and their telephone number are added to the designated record set, it is also PHI.
  • However, if a separate record of Mr. Jones´ wife and telephone number is maintained outside the designated record set (i.e., for contact purposes) it is not PHI because the separate record does not contain any health information.

In conclusion, some patient information can be both protected and not protected depending on where it is maintained. This doesn´t make it any easier to explain how to secure patient information and PHI, but it is important to be aware that not all patient information is PHI all the time.

How to Secure Patient Information that is PHI

To say PHI has to be secured is misleading because it implies Protected Health Information has to be locked away in fortress-like environment, whereas the Privacy Rule allows “permissible” uses and disclosures for a variety of reasons. Therefore, although it is important to apply access controls to ensure only authorized personnel can use or disclose PHI, it is not necessary for PHI to be “secured”.

With regards to electronic PHI (ePHI), Covered Entities and Business Associates have to take greater care about how it is protected because healthcare data is highly sought after by cybercriminals. Consequently, many compliance experts suggest organizations adopt a defense in depth strategy that includes as a minimum:

  • A firewall to prevent unauthorized access to networks and data
  • A spam filter to block malicious emails harboring malware
  • A web filter to prevent staff accessing malicious websites
  • An antivirus solution to detect malware from other sources
  • Data encryption on all workstations and portable devices
  • Encryption to protect data in transit – encrypted email for instance
  • An intrusion detection system that monitors for irregular network activity
  • Auditing solutions that monitor for improper accessing of PHI
  • Disaster recovery controls to ensure continued access to data in the event of an emergency
  • Extensive backups to ensure PHI is recoverable in the event of an emergency
  • Security solutions allowing the remote deletion of data stored on mobile devices in the event of loss or theft
  • Security awareness and anti-phishing training for all members of the workforce
  • Physical controls to prevent data and equipment theft
  • Good patch management policies to ensure software is kept up to date and free from vulnerabilities

Informing Patients that Health Information is Protected

Although protecting PHI is a requirement of HIPAA, it can be beneficial to highlight to patients that the security of health information is taken seriously. Research has shown that, when patients trust their health information is being protected, they are more willing to share intimate details about themselves with healthcare providers.

Having more information about a patient´s condition enables healthcare providers to make better informed decisions and more accurate diagnoses to determine the best course of treatment. This in turn leads to better patient outcomes and a reduction in patient readmissions, which can reflect in higher satisfaction scores from patients and their families.

Informing patients that health information is secured doesn´t have to go into details – a few lines of text added to a Notice of Privacy Practices is often sufficient. The important thing to remember is that if an organization claims that health information is protected but fails to implement the necessary standards to secure patient information – and a data breach occurs – this could discredit the organization and will likely be taken into account by an investigation into the data breach.

How to Secure Patient Information FAQs

What privacy and security laws apply other than HIPAA?

Many states now have privacy and/or data security laws with stronger patient protections than HIPAA. Some laws may only apply to certain types of data (i.e., Illinois´ Biometric Information Privacy Act), while others apply across state borders to protect the personal data of any citizen of the state wherever they are (i.e., Texas´ Medical Records Privacy Act).

What can happen if you secure too much information?

Securing too much information can negatively impact healthcare operations. For example, a nursing assistant needs to phone Mr. Jones´ wife urgently but cannot not access the telephone number because they do not have the right credentials to access the designated record set in which the telephone number has been secured.

Not only will the lack of access result in a delay in contacting Mr. Jones´ wife, but the nursing assistant will have to find a colleague with the right credentials to access the designated record set and interrupt what they were doing in order to get the phone number to make the call – an unnecessarily waste of resources.

What are the Administrative Simplification Regulations?

The Administrative Simplification Regulations are the section of the Public Welfare regulations (45 CFR) containing most of the standards that HIPAA Covered Entities and Business Associates have to comply with – i.e., the Privacy Rule, the Security Rule, and the Breach Notification Rule. The Department of Health and Human Services has compiled an unofficial version of the text here.

What are the permissible uses and disclosures of PHI?

The permissible uses and disclosures allowed by the Privacy Rule generally relate to uses and disclosures for treatment, payment, and healthcare operations. However, other uses and disclosures are allowed when (for example) they are covered by a Business Associate Agreement with a third party organization or when a patient has authorized the use or disclosure.

How can a patient check health information is being protected?

Patients can request an accounting of disclosures from their health plan or healthcare provider which should list the times when PHI has been disclosed for purposes other than those permitted by the Privacy Rule in the previous six years. Although it is no guarantee of data security, the accounting of disclosures can be a good indicator of an organization´s HIPAA compliance.

The post How to Secure Patient Information (PHI) appeared first on HIPAA Journal.

HPH Sector Warned About Threat of DDoS Attacks by Pro-Russian Hacktivist Group

Posted by HIPAA Journal

The healthcare and public health (HPH) sector has been warned about the risk of cyberattacks by a pro-Russian hacktivist group dubbed KillNet, following a recent attack on a U.S. healthcare organization. KillNet is believed to have started operating around the time that Russia invaded Ukraine, between January and March 2022. Since then, the hacktivist group has targeted government institutions and private sector organizations in countries that are providing support to Ukraine, especially NATO countries.

KillNet primarily conducts distributed denial of service (DDoS) attacks. DDoS attacks involve flooding servers and websites with thousands of connection requests from compromised devices to deny access to legitimate users of those servers and websites. These attacks can last for several hours or even days, during which time the servers/websites will run slowly, with prolonged attacks causing outages that can last for several days. Generally, these attacks do not cause any major damage to hardware.

Members of the group have threatened to target organizations in the U.S. healthcare sector in response to the U.S. policy of providing support to Ukraine. Those threats include cyberattacks, data theft, and the publication of the health data of Americans. In December 2022, KillNet claimed responsibility for a cyberattack on a large U.S. healthcare organization that provides healthcare to members of the U.S. military and claims to have stolen a large amount of user data.

Members of the group have threatened to conduct attacks on organizations in other countries if their demands are not met. For instance, in response to the arrest of a suspected member of the KillNet group in Romania in May 2022, a member of the group threatened to target the UK Ministry of Health and claimed attacks would be conducted on life-saving ventilators in British hospitals.

The Health Sector Cybersecurity Coordination Center (HC3) says the group has a tendency to exaggerate, so any claims made by the group should be taken with a pinch of salt. HC3 says it is possible that some of the claims made by members of the group have been to garner attention from the public and across the cybercriminal underground. That said, the group is considered to be a threat to government and critical infrastructure organizations, including organizations in the HPH sector. HC3 has suggested some practical steps for HPH sector organizations to take to mitigate the risk of DDoS attacks, which are detailed in the KillNet Analyst Note.

The post HPH Sector Warned About Threat of DDoS Attacks by Pro-Russian Hacktivist Group appeared first on HIPAA Journal.

Medical Device Cybersecurity Provisions Included in Omnibus Appropriations Bill

Posted by HIPAA Journal

The text of a $1.7 trillion omnibus appropriations bill has been released by the House and Senate Appropriations Committees which, if passed, will ensure that the government remains funded until September 30, 2023. The Senate has already started debating the bill and the House is due to consider the bill this week. The bill must be signed by the president on Friday this week, when government funding is set to expire.

The 4,155-page bill includes many healthcare provisions that will help hospitals and health systems provide better care for patients. These include the prevention of the 4% Medicare PAYGO cuts to providers, financial support for rural hospitals to ensure they can continue to operate, measures to help states prepare for Medicaid eligibility changes when the COVID-19 Public Health Emergency comes to an end, and extensions and expansions of telehealth flexibilities until December 31, 2024. This will help to ensure that telehealth and hospital-at-home programs can continue to provide convenient and accessible medical treatment for patients. The bill will also provide funding for essential behavioral health programs and several provisions that will help to increase the healthcare workforce.

The bill proposes $120.7 billion in funding for the Department of Health and Human Services, increasing HHS funds by a further $9.9 billion from last year. Funding for the Centers for Medicare and Medicaid Services will increase by $100 million, the National Institutes of Health will receive an additional $2.5 billion to focus on research on a range of diseases and medical conditions, the Centers for Disease Control and Prevention will receive a further $760 million, primarily to fund fundamental public health activities and emergency preparedness, and the Substance Abuse and Mental Health Services Administration will receive an additional $970 million for mental health programs and for expanding access to its services.

In September, the Food and Drug Administration (FDA) appropriations bill was passed to ensure the FDA continued to be funded, but in order for the bill to be passed, the FDA was forced to drop its proposed medical device cybersecurity requirements, many of which were taken from The Protecting and Transforming Cyber Health Care (PATCH) Act. Those requirements were blocked by the Senate Republican leadership.

There is good news in this regard, as the omnibus appropriations bill includes new requirements for medical device manufacturers to ensure that their devices meet certain minimum standards for cybersecurity. Those requirements will take effect 90 days after the bill is enacted. These include submitting a plan to the Secretary of the FDA to monitor, identify, and address postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures, and they must ensure their devices and associated systems are secure and must release postmarket software and firmware updates and patches. Medical device manufacturers will also be required to provide a Software Bill of Materials (SBOM) to the Secretary of the FDA that includes all off-the-shelf, open source, and critical components used by the devices.

The bill calls for the FDA to provide additional resources and information on improving the cybersecurity of medical devices within 180 days, and annually thereafter, including information on identifying and addressing cyber vulnerabilities for healthcare providers, health systems, and device manufacturers. Within one year, the Government Accountability Office is required to issue a report that identifies the challenges faced by healthcare providers, health systems, patients, and device manufacturers in addressing vulnerabilities, and how federal agencies can strengthen coordination to improve the cybersecurity of devices.

HIPAA called for the creation of a unique patient identifier (UPI), but funding has not been provided to date. The appropriations bill continues to prohibit funding for a national patient identifier, even though a UPI would help to ensure that patients can be accurately linked with the correct medical records.

The post Medical Device Cybersecurity Provisions Included in Omnibus Appropriations Bill appeared first on HIPAA Journal.

Most Important Factors for Improving Cyber Resilience

Posted by HIPAA Journal

Cyberattacks have increased in volume and sophistication to the point where it is inevitable that a successful attack will be experienced by all healthcare organizations at some point in their lifespan. Healthcare organizations can hope for the best, but it is vital to plan for the worst and take steps to ensure that the damage caused is kept to a minimum. A major focus for security teams, in addition to reducing risks, is improving cyber resilience. Cyber resilience is the ability of an organization to continue to operate in the event of a cyberattack and to recover quickly.

A recent survey by Cisco indicates executives are aware of the importance of cyber resilience, with 96% of respondents saying cyber resilience is a high priority, and deservedly so, since 62% of respondents said their organization had experienced a security breach in the past two years – a combination of data breaches (51.5%), network/system outages (51.1%), ransomware attacks (46.7%), and DDoS attacks (46.4%). These attacks had severe repercussions for the breached entities, causing disruption to IT systems, communications, supply chains, and internal operations, with four out of 10 breached organizations saying they suffered lasting brand damage.

While the main goal in cybersecurity is still to prevent attacks from occurring, it must be assumed that will not always be possible given the rapidly evolving threat landscape. The cyber resilience lifecycle can be split into five elements: identify, protect, detect, respond, recover, and anticipate. It is important for healthcare organizations of all sizes to address these elements to improve their cyber resilience, and CISCO has identified the most important elements for success.

For CISCO’s Security Outcomes Report, Volume 3: Achieving Security Resilience report, a methodology was developed for scoring organizations on cyber resilience that allowed the researchers to identify seven key factors that are critical to success. All seven of these factors were present in the 90th percentile of cyber resilient organizations and were all lacking in the bottom 10th percentile, these were:

  • Strong security support from the C-suite
  • Excellent security culture
  • Internal staffing and resources for incident response
  • Mostly on-premises or mostly cloud-based technology infrastructure
  • Mature zero trust
  • Advanced endpoint detection
  • Converging networking and security into a mature, cloud-delivered secure access services edge

Organizations with poor security support from the C-suite scored 39% lower than those with strong C-suite support. Organizations with a strong security culture scored 46% higher than those lacking a security culture, which can be achieved through regular workforce training.  There was a 15% increase in resilient outcomes to security incidents when an internal team and resources were available for incident response. Interestingly, there was no difference in resilience scores between organizations with either most of their technology infrastructure on-premises or in the cloud, but those that were transitioning from on-premises to the cloud had scores reduced by between 8.5% and 14%, depending on how difficult their hybrid environments were to manage.

One of the best approaches to take to improve cyber resilience is to adopt zero trust. This approach to security assumes defenses have already been breached and makes it as hard as possible for malicious actors to move laterally within networks. Implementing zero-trust is not a quick process, but its importance in healthcare is well understood. A recent Okta survey indicates 58% of healthcare organizations have started implementing zero-trust initiatives and 96% of all surveyed healthcare respondents said they had either started implementing zero-trust or plan to in the next 12-18 months. Guidance on implementing zero-trust in healthcare was recently published by Health-ISAC.

Cisco reports that organizations with a mature zero-trust model had 30% higher cyber resilience scores on average than those that had none. The most significant boost came not from zero trust, but from advanced endpoint detection and response capabilities, which improved cyber resilience scores by 45%. Converging networking and security into a mature, cloud-delivered secure access services edge increased security resilience scores by 27%.

“The Security Outcomes Reports are a study into what works and what doesn’t in cybersecurity. The ultimate goal is to cut through the noise in the market by identifying practices that lead to more secure outcomes for defenders,” said Jeetu Patel, executive vice president and general manager of security and collaboration at Cisco. “This year we focused on identifying the key factors that elevate the security resilience of a business to among the very best in the industry.”

The post Most Important Factors for Improving Cyber Resilience appeared first on HIPAA Journal.