Healthcare Cybersecurity

Vulnerability Identified in Medtronic MiniMed 600 Series Insulin Pumps

Posted by HIPAA Journal

The Cybersecurity and Infrastructure Security Agency (CISA) and the Food and Drug Administration (FDA) have issued a warning about a recently discovered vulnerability that affects certain Medtronic insulin pumps. The flaw could be exploited by a malicious actor to manipulate patients’ insulin doses, resulting in too much or too little insulin being delivered.

The vulnerability affects the following Medtronic NGP 600 Series Insulin Pumps and their accessory components:

  • MiniMed 620G: MMT-1710
  • MiniMed 630G: MMT-1715, MMT-1754, MMT-1755
  • MiniMed 640G: MMT-1711, MMT-1712, MMT-1751, MMT-1752
  • MiniMed 670G: MMT-1740, MMT-1741, MMT-1742, MMT-1760, MMT-1762, MMT-1762, MMT-1780, MMT-1781, MMT-1782

The flaw exists in the communication protocol used by the pump system to pair with other system components. Successful exploitation of the flaw would allow a threat actor to slow or stop insulin delivery or trigger an unintended insulin bolus. The vulnerability cannot be exploited remotely by a threat actor over the Internet but could be exploited within wireless signal proximity to the patient and device. The vulnerability is tracked as CVE-2022-32537 and has a CVSS severity score of 4.8 out of 10 (medium severity).

Advanced technical knowledge is required to exploit the vulnerability, the flaw can only be exploited when the pump is being paired with other system components, and the attacker must be in close proximity to the pump, which limits the potential for exploitation. The FDA says it is unaware of any cases where the vulnerability has been exploited.

Medtronic has issued an urgent medical device correction warning about the vulnerability and has urged all users of the affected insulin pumps to take action to prevent exploitation of the flaw. In their default configuration, all of the above Medtronic NGP 600 Series Insulin Pumps are affected.

To prevent exploitation, Medtronic advises all users to turn off the Remote Bolus feature on the pump if it is turned on, and users should not conduct any connection linking of devices in public places. Users are advised to keep their pumps and connected system components within their control at all times, to be attentive to pump notifications, alarms, and alerts, to disconnect the USB device from the computer when it is not being used to download pump data, and never to confirm remote connection requests or any other remote actions unless they are personally initiated or have been initiated by their care partner.

Further information on mitigations can be found in Medtronic’s urgent medical device correction notice.

The post Vulnerability Identified in Medtronic MiniMed 600 Series Insulin Pumps appeared first on HIPAA Journal.

Monkeypox Phishing Campaign Targets Healthcare Providers

Posted by HIPAA Journal

A warning has been issued to the healthcare and public health (HPH) sector about an ongoing Monkeypox phishing campaign targeting U.S. healthcare providers that attempts to steal Outlook, Office 365, and other email credentials.

Monkeypox is a highly contagious viral disease caused by a virus from the same family as smallpox. According to the Centers for Disease Control and Prevention (CDC), there have been almost 66,000 cases diagnosed globally in the current outbreak, and more than 25,100 cases in the United States. California, New York, Florida, Texas, and Georgia are the worst affected states, with the cases mostly confined to the LBGTQ+ community.

Malicious actors often piggyback on major news stories and use these themes to conduct convincing phishing campaigns. Campaigns using monkeypox lures were therefore inevitable, and they are likely to continue and increase in line with the rising numbers of cases. Monkeypox and COVID-19-related phishing campaigns have a high success rate as there is considerable interest in the outbreak and concern about infections.

The Health Sector Cybersecurity Coordination Center (HC3) warns that these emails may be sent from the email account of an HPH-related entity that has previously been compromised, or from a non-HPH-related entity. When a phishing email is sent from a trusted email account it increases the probability of the email being opened.

The emails claim to offer important information about the current monkeypox outbreak in the United States and have the subject line, “Data from (Victim Organization Abbreviation): “Important read about -Monkey Pox– (Victim Organization) (Reference Number).” The message body includes the text, “Please see the attached important read about “Monkey Pox” for your reference. It is a good read; thought I’d share with you. Stay safe.”

The emails have a PDF file attachment named, “MPV Update_070722F.pdf” although other names may also be used. The attached file includes a malicious hyperlink that directs the recipient to a Lark Docs site, which has an Adobe Cloud theme and offers a secure fax document from Xerox Scanner to download. If the user attempts to download the file they will be directed to another website, where the user is told they must enter their valid email credentials in order to view the file. If those credentials are entered, they will be harvested and used by the threat actor to remotely access the user’s email account.

Monkeypox phishing website used to harvest email credentials. Source HC3

In addition to raising awareness of the monkeypox phishing campaign, healthcare organizations should be providing regular security awareness training to the workforce covering security best practices, such as the importance of setting long, complex passwords for all accounts, not clicking links or opening attachments in unsolicited emails, and to only download files from trusted publishers. Security awareness training should cover the phishing and social engineering techniques commonly used by threat actors, and it is recommended to also conduct phishing simulations on the workforce. Phishing simulations have been proven to significantly reduce susceptibility to phishing attempts.

Some employees will still click links and open attachments even with training, so it is important to ensure that technical measures are implemented to protect against phishing, such as spam filters to block phishing emails, web filters to block malicious websites, and multifactor authentication for email accounts to prevent unauthorized access to accounts using stolen credentials.

The post Monkeypox Phishing Campaign Targets Healthcare Providers appeared first on HIPAA Journal.

August 2022 Healthcare Data Breach Report

Posted by HIPAA Journal

For the third successive month, the number of healthcare data breaches reported to the Department of Health and Human Services’ Office for Civil Rights has fallen, with 49 breaches of 500 or more records reported in August– well below the 12-month average of 58 breaches per month. The 25.75% percentage decrease from July 2022 was accompanied by a significant reduction in breached records, which dropped almost 30% month over month.

healthcare data breaches in the past 12 months

Across the 45 data breaches, 3,741,385 healthcare records were exposed or impermissibly disclosed – well below the 5,135,953 records that were breached in August 2021, although slightly more than the 12-month average of 3,382,815 breached healthcare records per month.

Breached healthcare records over the past 12 months

Largest Healthcare Data Breaches Reported in August 2022

18 healthcare data breaches of 10,000 or more records were reported to the HHS’ Office for Civil Rights in August 2022, which have been summarized in the table below. It should be noted that the exact nature of the data breach is not always reported by the breached entity, such as if ransomware was used to encrypt files.

As the table below shows, the largest reported data breach of the month occurred at Novant Health and was due to the use of the third-party JavaScript code snippet – Meta Pixel on the healthcare provider’s website. The code snippet is used on websites to track visitor activity but can send PHI to Meta (Facebook), which can then be used to serve targeted ads. Novant Health said there had been a misconfiguration that saw the code added behind the login on the patient portal.

So far, Novant Health is the only healthcare provider to report such a breach, even though investigations have revealed many other healthcare organizations have used the code snippet on their websites, several of which added the code to their patient portals. Multiple lawsuits have been filed over these privacy breaches.

Name of Covered Entity State Covered Entity Type Individuals Affected Location of Breached Information Business Associate Present
Novant Health Inc. on behalf of Novant Health ACE & as contractor for NMG Services Inc. NC Business Associate 1,362,296 Electronic Medical Record Unauthorized disclosure to Meta through Meta Pixel code snippet on website
Practice Resources, LLC NY Business Associate 942,138 Network Server Ransomware attack
Warner Norcross and Judd, LLP MI Business Associate 255,160 Network Server Hacking and data theft incident
California Department of Corrections and Rehabilitation CA Healthcare Provider 236,000 Network Server Hacking incident
Conifer Revenue Cycle Solutions, LLC TX Business Associate 134,948 Email Hacking of Microsoft 365 Environment
Common Ground Healthcare Cooperative WI Health Plan 133,714 Network Server Ransomware attack on a business associate (OneTouchPoint)
Methodist McKinney Hospital TX Healthcare Provider 110,244 Network Server Hacking and data theft incident
First Choice Community Health Care, Inc. NM Healthcare Provider 101,541 Network Server Hacking incident
Onyx Technology LLC MD Business Associate 96,814 Network Server Hacking incident
EmergeOrtho NC Healthcare Provider 68,661 Network Server Ransomware attack
Lamoille Health Partners VT Healthcare Provider 59,381 Network Server Ransomware attack
Henderson & Walton Women’s Center, P.C. AL Healthcare Provider 34,306 Email Hacking incident
St. Luke’s Health System, Ltd. ID Healthcare Provider 31,573 Network Server Hacking incident at billing vendor
San Diego American Indian Health Center CA Healthcare Provider 27,367 Network Server Hacking and data theft incident
Rock County Human Services Department WI Healthcare Provider 25,610 Email Unauthorized access to email accounts
NorthStar HealthCare Consulting LLC GA Business Associate 18,354 Email Unauthorized access to email accounts
Methodist Craig Ranch Surgical Center TX Healthcare Provider 15,157 Network Server Hacking and data theft incident (Methodist McKinney)
Valley Baptist Medical Center – Harlingen TX Healthcare Provider 11,137 Network Server Ransomware attack (Practice Resources)

Causes of August 2022 Data Breaches

The above table shows hacking incidents continue to be a major problem for the healthcare industry, with ransomware often used in the attacks. There has been a growing trend for attackers to conduct data theft and extortion attacks, without using ransomware. While the consequences for patients may still be severe, the failure to encrypt files causes less disruption; however, a recent study by Proofpoint suggests that patient safety issues are still experienced after cyberattacks when ransomware is not used. Around 22% of healthcare providers reported seeing an increase in mortality rate following a major cyberattack and 57% reported poorer patient outcomes.

Healthcare organizations are vulnerable to email attacks, with phishing attacks a common cause of data breaches. There has also been an increase in the use of reverse proxies in attacks, which allow threat actors to steal credentials and bypass multifactor authentication to gain access to Microsoft (Office) 365 environments.

Causes of August 2022 Healthcare Data Breaches

35 of the month’s breaches (71.4%) were attributed to hacking/IT incidents and involved the exposure or theft of 2,337,485 healthcare records – 62.48% of the month’s reported breached records. The mean breach size was 66,785 records and the median breach size was 7,496 records.

There were 10 reported unauthorized access/disclosure incidents involving 1,398,595 records – 37.38% of the month’s breached records. The mean breach size was 139,860 records and the median breach size was 1,375 records. 1,362,296 of those records were breached in the Novant Health incident. There were 4 loss/theft incidents (2 losses; 2 theft) involving 5,305 records. The mean breach size was 1,326 records and the median breach size was 1,357 records.

The number of hacking incidents is reflected in the location of breached PHI, as shown in the chart below.

Location of Breached PHI in August

Data Breached by HIPAA Regulated Entity

Health plans were the worst affected HIPAA-regulated entity, with 35 data breaches reported. 9 breaches were reported by business associates, and 5 breaches were reported by health plans. Data breaches are not always reported by business associates directly, with some HIPAA-covered entities choosing to report breaches at their business associates. The chart below takes this into account and shows data breaches based on where they occurred. While 14 data breaches occurred at business associates in August, this is a notable reduction from the previous few months. In July there were 36 data breaches at business associates, and 40 in June.

August 2022 healthcare data breaches - HIPAA-regulated entity type

Geographic Distribution of Data Breaches

Healthcare data breaches of 500 or more records were reported to the HHS’ Office for Civil Rights in August by HIPAA-regulated entities in 26 states, with Texas the worst affected with 8 reported data breaches.

State Breaches
Texas 8
North Carolina 4
Arkansas, California, & Michigan 3
Colorado, Florida, Illinois, New York, Vermont, Washington, & Wisconsin 2
Alabama, Arizona, Georgia, Idaho, Indiana, Louisiana, Maryland, Mississippi, New Hampshire, New Jersey, New Mexico, Ohio, Pennsylvania, & Virginia 1

HIPAA Enforcement Activity in August 2022

There was one HIPAA enforcement activity announced by OCR in August, and somewhat unusually given the focus on the HIPAA Right of Access over the past three years, it related to the improper disposal of PHI. Out of the past 25 enforcement actions that have resulted in financial penalties, only 5 have been for non-HIPAA Right of Access violations.

OCR launched an investigation of New England Dermatology and Laser Center after receiving a report on March 11, 2021, about the improper disposal of the PHI of 58,106 patients. In addition to failing to render PHI unreadable and indecipherable, OCR determined there was a failure to maintain appropriate administrative safeguards. The improper disposal of empty specimen containers with patient labels spanned from 2011 to 2021. New England Dermatology and Laser Center agreed to settle the case and paid a $300,640 penalty.

Lisa J Pino stepped down as OCR Director in July 2022 and has now been replaced by Melanie Fontes Rainer. It remains to be seen where she will lead the department regarding the enforcement of HIPAA compliance, although HHS Secretary Xavier Becerra has stated that HIPAA Privacy Rule violations with respect to unauthorized disclosures of PHI related to abortion care and other forms of sexual and reproductive health care will be an enforcement priority of OCR.

The post August 2022 Healthcare Data Breach Report appeared first on HIPAA Journal.

FBI Warns of Ongoing Cybercriminal Campaigns Targeting Healthcare Payment Processors

Posted by HIPAA Journal

The Federal Bureau of Investigation (FBI) has Issued a TLP:WHITE Private Industry Notification warning about ongoing cybercriminal campaigns targeting healthcare payment processors that attempt to redirect victim payments to accounts under the control of the attackers.

These attacks use social engineering techniques to obtain the login credentials of healthcare payment processors to allow them to divert payments, such as phishing attacks that spoof support centers. The attackers have used publicly available personally identifiable information to obtain access to files, healthcare portals, payment information, and websites.

The goal of these attacks is to change direct deposit information, which in one attack on a large healthcare company in February 2022, resulted in changes to direct deposit information for a consumer checking account that saw payments totaling $3.1 million redirected to the attacker’s account. The same month, a separate attack occurred that used similar techniques to redirect around $700,000.

In April 2022, a healthcare company with 175 medical providers discovered an attack where an employee had been impersonated and Automated Clearing House (ACH) instructions of one of their payment processing vendors were sent that redirected payments to a cybercriminal’s account, resulting in two payments totaling $840,000 being sent to the attacker’s account.

The FBI says between June 2018 and January 2019 at least 65 healthcare payment processors were targeted in the United States and contact information and banking details were changed to direct payments to attacker-controlled accounts, with one of those attacks seeing payments totaling $1.5 million being lost, with the initial access to a customer account being gained through phishing. The FBI warns that entities involved in the processing and distributing healthcare payments through payment processors remain vulnerable to attacks such as this.

Phishing emails are sent to employees in the financial departments of a targeted healthcare payment processor. A trusted individual is often impersonated, and social engineering techniques are used to trick employees into making changes to bank accounts. Login credentials are stolen in these attacks that allow the attacker to make changes to email exchange server configurations and set up custom rules for accounts of interest.

Employees that have been targeted have reported receiving requests to reset passwords and 2FA phone numbers within a short time frame. The attackers change account credentials to allow persistent access, and the employees who had their accounts hacked report being locked out of their payment processor accounts due to failed password recovery attempts.

The FBI has made several recommendations on how to defend against these attacks and reduce the risk of compromise. These include:

  • Ensure endpoint detection software is used on all endpoints, including up-to-date anti-virus and anti-malware solutions
  • Conduct regular network security assessments, penetration tests, and vulnerability scans
  • Provide training to the workforce to teach employees how to recognize phishing and social engineering attacks, and provide an easy way for them to report suspicious emails – such as an Outlook plugin that allows one-click reporting
  • Ensure employees are aware that they must only conduct requests for sensitive information through approved secondary channels
  • Set up multi-factor authentication for all accounts, ideally requiring a physical device for authentication – such as a Yubikey – rather than a one-time code sent to a mobile device
  • Verify and modify as needed contract renewals to include the inability to change both credentials and 2FA within the same timeframe to reduce further vulnerability exploitations.
  • Implement policies and procedures for changing existing financial information to include verification through an appropriate, established channel
  • Ensure all accounts have strong, unique passwords set
  • Ensure software is updated and patches are applied promptly to prevent the exploitation of vulnerabilities.

The post FBI Warns of Ongoing Cybercriminal Campaigns Targeting Healthcare Payment Processors appeared first on HIPAA Journal.

FBI Warns Healthcare Providers About Unpatched and Outdated Medical Device Risks

Posted by HIPAA Journal

The Federal Bureau of Investigation (FBI) has issued a private industry notification warning about the rising number of vulnerabilities in medical devices. If medical devices are not promptly patched and are running out of date software, malicious actors could exploit vulnerabilities and gain access to sensitive patient data or the networks to which the devices connect. With a foothold in the network, threat actors could conduct attacks that adversely impact the operational functions of healthcare facilities. Medical devices are often used to sustain patients with mild to severe medical conditions and attacks on those devices have the potential to cause serious harm to patients and even result in the loss of life.

The FBI says vulnerabilities in medical devices predominantly stem from device hardware design and device software management. When medical devices are operated in the default configuration, that often provides threat actors with an opportunity to exploit vulnerabilities. Devices with customized software can be difficult to patch, often requiring specialized procedures, which can slow down updates and leave vulnerabilities unaddressed for longer, increasing the window of opportunity for vulnerabilities to be exploited.

Medical devices have been developed to perform specific functions, but security was never a consideration because the devices were not considered to be a security threat. These devices are vulnerable and if exposed to the Internet could provide threat actors with an easy way to gain access to the devices, alter their functionality, or use them as a springboard to launch an attack on an organization.

The FBI cites a recent study that suggests 53% of network-connected medical devices and other IoT devices used in hospitals have known critical vulnerabilities that have not been addressed, with around one-third of healthcare IoT devices having a critical vulnerability that could affect the technical operation or functionality of medical devices. These devices include insulin pumps, intracardiac defibrillators, mobile cardiac telemetry, intrathecal pain pumps, and pacemakers.

Another study suggests medical devices have an average of 6.2 vulnerabilities per device, and more than 40% of medical devices that have reached end-of-life are no longer receiving security patches and software upgrades to correct vulnerabilities, but those devices often remain in use despite the security risks involved.

Unpatched and outdated medical devices provide cyberattack opportunities, so it is vital that vulnerabilities are addressed and risk is reduced to a low and acceptable level. The FBI has made several recommendations for improving the security of medical devices:

  • Ensure endpoint protection measures are implemented including antivirus software and endpoint detection and response (XDR) solutions
  • Use encryption for sensitive data
  • Change all default passwords and set complex, unique passwords, and limit the number of logins per user
  • Ensure an accurate inventory is maintained of all devices, including the patching status, software version, and any vendor-developed software components used by the devices
  • Develop a plan for replacing medical and IoT devices prior to reaching end-of-life
  • Ensure vulnerabilities are promptly patched on all medical devices
  • Conduct routine vulnerability scans before installing any new device onto the operating network
  • Train employees to help mitigate human risks, including teaching employees how to identify and report threats, the attacks that target employees such as social engineering and phishing, and add banners to emails that come from external sources.

The FBI alert – Unpatched and Outdated Medical Devices Provide Cyber Attack Opportunities – and the full recommendations for mitigating vulnerabilities can be viewed on this link.

The post FBI Warns Healthcare Providers About Unpatched and Outdated Medical Device Risks appeared first on HIPAA Journal.

4 Vulnerabilities Identified in Baxter & Sigma Spectrum Infusion Pumps

Posted by HIPAA Journal

Researchers at Rapid 7 have identified four vulnerabilities in Baxter and Sigma Spectrum infusion pumps, which are used to deliver medications and nutrition to patients. The devices are TCP/IP enabled and are usually connected to healthcare networks. Successful exploitation of the vulnerabilities could allow malicious actors to make system configuration changes and access sensitive patient data.

The vulnerabilities were discovered around 5 months ago and were reported to Baxter. Rapid 7 has been working with Baxter to resolve the medium- and low-severity vulnerabilities and recently published a report on the flaws.

The flaws affected the following Baxter and Sigma Spectrum infusion pumps.

  • Sigma Spectrum v6.x model 35700BAX
  • Sigma Spectrum v8.x model 35700BAX2
  • Baxter Spectrum IQ (v9.x) model 35700BAX3
  • Sigma Spectrum LVP v6.x Wireless Battery Modules v16, v16D38, v17, v17D19, v20D29 to v20D32, and v22D24 to v22D28
  • Sigma Spectrum LVP v8.x Wireless Battery Modules v17, v17D19, v20D29 to v20D32, and v22D24 to v22D28
  • Baxter Spectrum IQ LVP (v9.x) with Wireless Battery Modules v22D19 to v22D28

The Baxter Spectrum WBM (v16, v16D38, v17, v17D19, v20D29 to v20D32) does not perform mutual authentication with the gateway server host. This flaw could be exploited in a machine-in-the-middle attack, which would allow the device parameters to be changed which would cause the network connection to fail. The vulnerability is tracked as CVE-2022-26394 and has a CVSS v3 severity score of 5.5 (medium severity). Authentication is already available in Spectrum IQ which resolves the vulnerability.

The Baxter Spectrum WBM (v20D29) is susceptible to format string attacks via application messaging. If the flaw is exploited an attacker could read memory in the WBM and access sensitive information. The flaw could also be exploited to cause a denial-of-service condition on the WBM. The vulnerability is tracked as CVE-2022-26393 and has a CVSS v3 severity score of 5.0 (medium severity). The vulnerability has been addressed in WBM version 20D30.

The researchers discovered that network credentials and patients’ protected health information (PHI) are not encrypted in the Baxter Spectrum wireless battery modules. PHI is only stored in Spectrum IQ pumps using auto programming. If an attacker has physical access to a vulnerable device, without all data and settings erased it would be possible to extract sensitive information. The vulnerability is tracked as CVE-2022-26390 and has a CVSS v3 severity score of 4.2 (medium severity). Baxter said it is adding instructions to the Spectrum Operator’s Manual on how to erase all data and settings on WBMs and pumps before decommissioning and transferring the devices to other facilities. The instructions are also detailed in the CISA ICS Medical Advisory.

In superuser mode, the Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) are susceptible to format string attacks via application messaging, which could allow an attacker to read memory in the WBM and access sensitive information. The vulnerability is tracked as CVE-2022-26392 and has a CVSS v3 severity score of 3.1 (low severity). Software updates to disable Telnet and FTP to resolve the vulnerability are in process.

The post 4 Vulnerabilities Identified in Baxter & Sigma Spectrum Infusion Pumps appeared first on HIPAA Journal.

Study Confirms Increase in Mortality Rate and Poorer Patient Outcomes After Cyberattacks

Posted by HIPAA Journal

A recent study has revealed that more than 20% of healthcare organizations experienced an increase in mortality rate after a significant cyberattack and more than half of surveyed healthcare organizations (57%) said they experienced poorer patient outcomes, with almost half reporting an increase in medical complications.  The most common consequences of the attacks that contributed to poorer patient outcomes were delays to procedures and tests.

The study was conducted by the Ponemon Institute on behalf of cybersecurity firm Proofpoint on 641 healthcare IT and security practitioners in the United States, with the findings detailed in the report, Cyber Insecurity in Healthcare; The Cost and Impact on Patient Safety and Care.  The findings mirror those of a previous study conducted by the Ponemon Institute in 2021 on behalf of Censinet. That study was conducted on 597 healthcare respondents and one-fifth (22%) said they experienced an increase in their mortality rates following a ransomware attack.

The latest study used a broader definition of cyberattack, which includes the four most common types of attack – cloud compromise, ransomware, business email compromise/phishing, and supply chain, and therefore indicates it is not only ransomware attacks that negatively affect patient outcomes. Ransomware attacks result in file encryption which can take critical IT systems out of action, but oftentimes healthcare organizations are forced to shut down IT systems to contain an attack. The recovery time from a ransomware attack is typically longer than other types of attack, with the survey establishing that ransomware attacks have the biggest impact out of the four most common types of attack. 64% of surveyed healthcare organizations said they experienced delays in medical tests and procedures following a ransomware attack and 59% said the attacks resulted in longer patient stays.

It should be noted that both studies established that there is a correlation between the worst types of cyberattacks and adverse patient outcomes but did not prove causation. Further studies need to be conducted to establish exactly what aspects of the attacks are having the biggest negative impact on patient outcomes and lead to an increase in mortality rate.

“The attacks we analyzed put a significant strain on healthcare organizations’ resources. Their result is not only tremendous cost but also a direct impact on patient care, endangering people’s safety and wellbeing,” said Larry Ponemon, chairman and founder of the Ponemon Institute. “Most of the IT and security professionals regard their organizations as vulnerable to these attacks, and two-thirds believe that technologies such as cloud, mobile, big data, and the Internet of Things—which are all seeing increased adoption—further increase the risks to patient data and safety.”

The Proofpoint survey also showed the extent to which healthcare organizations are being attacked. 89% of surveyed organizations experienced an average of 43 attacks in the past 12 months, although the extent to which those attacks were successful is unclear. Cyberattacks on healthcare organizations have a significant financial impact. A previous study, conducted by the Ponemon Institute on behalf of IBM Security, found the average cost of a cyberattack has increased to $4.4 million, with the healthcare industry having the highest breach costs out of all industry sectors, with the average cost of a healthcare data breach rising to $10.1 million.

Healthcare Cybersecurity Challenges and Biggest Security Risks

One of the biggest challenges faced by healthcare organizations is recruiting the necessary talent to defend against attacks, with the lack of in-house expertise rated as a major challenge by 53% of respondents. 46% said they lacked sufficient staffing in cybersecurity and both factors had a negative effect on organizations’ security posture.

Respondents were asked about their biggest security concerns, with one of the main worries being medical device security. On average healthcare organizations have 26,000 medical devices connected to the network, and these were considered a cybersecurity risk by 64% of respondents, yet only 51% of respondents said they included these devices in their cybersecurity strategy.

The biggest perceived vulnerability was cloud compromise, with 75% of respondents saying they were vulnerable to cloud compromise, and 72% saying they were vulnerable to ransomware attacks. 54% of organizations said they had experienced a cloud compromise in the past 2 years, with those organizations experiencing an average of 22 such compromises; however, 64% of organizations said they had taken steps to prepare for and respond to those attacks. 60% of organizations said they were most concerned about ransomware attacks, and 62% said they had taken steps to prevent and respond to ransomware attacks.

71% of organizations said they were vulnerable to supply chain attacks and 64% felt vulnerable to BEC and spoofing/phishing attacks, yet only 44% and 48% said they had documented response plans for these attacks.

Defending Against Healthcare Cyberattacks

Cyberattacks on the healthcare industry are increasing in number and sophistication. The key to protecting against these attacks is a defense in depth approach with multiple overlapping layers of protection. It is also important to have a documented and practiced incident response plan in place for each major type of attack. The lack of preparedness for responding to cyberattacks can put patient safety at risk. Having an incident response plan in place, where all individuals involved in the response know their roles and responsibilities can shorten the recovery time considerably, which limits the negative impact on patients and reduces the financial cost. Having consultants and cybersecurity firms in place that fully understand an organization’s infrastructure is a huge advantage and ensures the fastest possible response in the event of a successful attack.

While cyberattacks can be sophisticated, they often start with a social engineering or phishing attack. The importance of employee education cannot be overstated. All employees should be made aware of the importance of good cyber hygiene and what that entails, and they should be trained on how to recognize social engineering and phishing attacks. Providing regular cybersecurity awareness training to employees and testing with phishing simulations can significantly reduce risk over time.

“Healthcare has traditionally fallen behind other sectors in addressing vulnerabilities to the growing number of cybersecurity attacks, and this inaction has a direct negative impact on patients’ safety and wellbeing,” said Ryan Witt, healthcare cybersecurity leader, Proofpoint. “As long as cybersecurity remains a low priority, healthcare providers will continue to endanger their patients. To avoid devastating consequences, healthcare organizations must understand how cybersecurity affects their patient care and take the steps toward better preparedness that protects people and defends data.”

The post Study Confirms Increase in Mortality Rate and Poorer Patient Outcomes After Cyberattacks appeared first on HIPAA Journal.

OIG Calls for Greater Oversight of the Cybersecurity of the Organ Procurement and Transplantation Network

Posted by HIPAA Journal

The HHS’ Office of Inspector General (OIG) has called for the Health Resources and Services Administration (HRSA) to improve oversight of the cybersecurity of the Organ Procurement and Transplantation Network (OPTN).

The OPTN is a national system for allocating and distributing donor organs to individuals in need of organ transplants. The OPTN is a public-private partnership that links all professionals that are involved in the donation and transplantation system which is administered by the United Network for Organ Sharing (UNOS). UNOS is a nonprofit that is responsible for managing systems that contain the personal and medical information of organ donors, candidates for transplants, and transplant recipients.

The IT systems supporting the OPTN ensure the rapid matching of donated organs with patients awaiting organ donation. There is a very short window of opportunity for providing donated organizations to recipients, which can be just a matter of hours or days. The IT systems that support the OPTN are essential for ensuring that process is efficient, and require the confidentiality, integrity, and availability of data to be maintained at all times. The Department of Health and Human Services has designated the OPTN a High-Value Asset.

If hackers were to breach the OPTN systems, they could be disrupted which could prevent organs from being matched, which could be a life and death matter. The OPTN has been criticized for the outdated IT systems that are in use and the lack of technical capabilities to upgrade those IT systems and make them secure and fit for purpose. While UNOS maintains that security controls are in place to ensure the confidentiality, integrity, and availability of data in IT systems, there is concern that vulnerabilities may exist that could be exploited by malicious actors.

Prior to 2018, the OPTN contract did not include any cybersecurity requirements and standards because the HRSA did not feel it could compel compliance, and prior to 2018, the HRSA only conducted limited oversight of OPTN cybersecurity. The HRSA modified the contract with UNOS in 2018 to require FISMA and NIST cybersecurity guidelines to be followed, and oversight of the OPTN was increased, including ensuring there was appropriate monitoring of compliance with FISMA and NIST standards.

OIG conducted an audit to determine whether the HRSA had implemented appropriate cybersecurity controls for the OPTN in line with Federal requirements to ensure the confidentiality, integrity, and availability of donation and transplantation data, and to assess whether there was adequate oversight of UNOS’s implementation of cybersecurity. The OIG review did not include any technical testing, although there were reviews of selected general IT controls to determine if they had been implemented in line with Federal requirements, including the system security plan, risk assessment, access controls, configuration management, system monitoring, flaw remediation, and vulnerability assessments. Reviews were also conducted on two penetration tests of the OPTN.

OIG determined that most of the IT controls had been implemented in accordance with Federal requirements but identified several areas were identified where HRSA could improve oversight of UNOS. OIG found that HRSA lacked adequate oversight procedures for UNOS to ensure that all Federal cybersecurity requirements were being met in a timely and effective manner. For instance, despite NIST giving policy and procedure controls for each security control family the highest priority code, several of UNOS’s policies and procedures either did not exist or were in draft form. Access controls and risk assessment policies and procedures were still in draft form and system monitoring policies and procedures did not exist. There was also a high risk that local site administrators would not deactivate local site user accounts in a timely manner, and were that to happen, it may go undetected by UNOS for up to a year until the next annual user account audit was conducted.

“Without finalized, written policies and procedures, there is a high risk that UNOS staff may not fully understand or perform as intended their roles and responsibilities as they pertain to certain cybersecurity controls, or that the OPTN will not comply with NIST controls as required by the FISMA,” said OIG in the report. “A lack of finalized, written policies and procedures could result in essential cybersecurity controls not being implemented properly or at all.”

OIG has recommended HRSA improve its oversight to ensure that the OPTN contractor is complying with all Federal cybersecurity requirements and does so in a timely manner. HRSA said it had ensured that most of the cybersecurity controls assessed by OIG had been implemented by UNOS, and that it has taken actions to strengthen oversight and controls, including appointing an OPTN Information System Security Officer to oversee the contractor’s cybersecurity efforts. Action has also been taken to finalize all policies and procedures in draft form, POAMs have been created to ensure the timely disabling and removal of inactive user accounts, and HRSA has ensured UNOS has implemented 2-factor authentication for all users.

The post OIG Calls for Greater Oversight of the Cybersecurity of the Organ Procurement and Transplantation Network appeared first on HIPAA Journal.

Health-ISAC Publishes Guidance for CISOs on Implementing Zero Trust Security Architectures

Posted by HIPAA Journal

Health-ISAC has published a white paper that serves as a guide for healthcare CISOs looking to implement zero trust security architectures.

The traditional security approach is akin to a castle and moat, where perimeter defenses are established to keep unauthorized individuals out. While this security approach has served organizations well in the past, it is not effective in the cloud where there is no perimeter to defend. Further, the threat landscape is rapidly changing, and malicious actors are successfully breaching perimeter defenses with increasing frequency. Once the perimeter defenses are breached, threat actors can move laterally within networks undetected and are free to perform a wide range of malicious activities.

A zero trust security approach continues to provide protection should a malicious actor gain access to internal networks. It makes lateral movement much more difficult and can greatly reduce the harm that can be caused. Zero trust means never trust, always verify. All traffic between devices and systems is untrusted and requires authentication, authorization, and continuous monitoring.

With zero trust there is no single cybersecurity solution to implement. “Implementing a zero trust architecture is not as simple as going to one vendor and picking a solution off the shelf. There are several components that need to be integrated together to create a holistic zero trust architecture,” explains Health-ISAC in the guidance. Those components include identity and access management, a cloud security gateway, data security, network security, workload and application security, and device security.

Following President Biden’s 2021 Executive Order, federal agencies have been implementing zero trust strategies, but zero trust is not easy to implement and it can be particularly challenging for healthcare organizations.  Two of the biggest challenges in healthcare come from the widespread use of IoT-enabled devices.

IoT-enabled devices include defibrillators, nebulizers, oxygen pumps, and patient monitors, which transfer data from patients to workstations for monitoring. These devices all need to be given a unique identity, an accurate and up-to-date inventory of the devices must be maintained, and the devices must be configured to communicate through encrypted channels.

Secondly, in healthcare, employees are often on the move and access devices in multiple locations, and often carry portable devices to perform documentation. Implementing the fine-grained authorization and multifactor authentication that are necessary for zero trust can be a huge challenge and may require additional components and configuration changes.

To help healthcare organizations overcome the zero trust security challenges, Health-ISAC recently published a white paper that serves as a guide for healthcare CISOs on how to implement zero trust architectures.

The guidance explains what zero trust security means and explains how zero trust involves an identity-centric approach to cybersecurity involving granular authorization and prioritizes multi-factor authentication, the principle of least privilege, with all subjects, assets, and workflows requiring specific authentication and authorization.

The new guidance document builds on the advice published by Health-ISAC in 2020 – An H-ISAC Framework for CISOs to Manage Identity – and applies zero trust principles for securing all communications, monitoring the integrity and security of assets, granting access on a per session basis, creating policy-based authorization based on contextual information, and adding devices to the target system and resources. The guidance details the steps that healthcare CISOs need to take to start implementing zero trust infrastructures.

The post Health-ISAC Publishes Guidance for CISOs on Implementing Zero Trust Security Architectures appeared first on HIPAA Journal.