There has been a spate of phishing attacks on healthcare organizations in the past few weeks. The increased threat of attacks prompted the Department of Health and Human Services’ Office for Civil Rights to issue a warning to healthcare organizations, urging them to improve their defenses by conducting regular security awareness training sessions for employees.

Phishing is the number one attack vector for delivering malware and successful attacks can result in the theft of considerable amounts of sensitive data. Email accounts contain a wide range of sensitive data on patients – information that can be used to commit identity theft and medical fraud, although oftentimes attacks are conducted to gain access to emails accounts for the purposes of spamming.

In the case of the phishing attack on MJHS, the motive of the malicious actor is unknown. Fortunately, rapid identification and mitigation of the attack limited the attacker’s window of opportunity. The compromised email accounts were secured before the accounts could be used to send any emails, although it is possible that the protected health information of patients/plan members may have been viewed.

On June 6, 2017, MJHS learned that an unauthorized individual gained access to the email accounts of several employees of Elderplan Inc., and on June 14, 2017 it was discovered that access was also gained to an email account of a MJHS Home Care employee.

MJHS called in a leading third-party forensic firm to assist with the investigation and determine whether any emails had been accessed or forwarded. The firm was unable to detect any suspicious activity during the short time that access to the Elderplan and MJHS Home Care email accounts was possible.

Inspection of the emails in the compromised accounts showed they contained individuals’ names, diagnoses, Medicare numbers, insurance information, treatment dates and the facilities where treatment was provided. MJHS has notified all individuals impacted by the phishing attack and has offered complimentary credit monitoring services for 12 months through Kroll.

MJHS explained to patients that no evidence was uncovered to suggest any ePHI was viewed, stolen or misused by the attacker, although as a precaution, affected individuals have been advised to monitor their Explanation of Benefits statements closely for any sign of fraudulent activity.

The phishing attack has now been reported to Office for Civil Rights. The breach reports show 22,000 Elderplan members have been affected along with 6,000 patients of MJHS Home Care.

The post MJHS Phishing Attack Result in the Exposure of 28,000 Individuals’ PHI appeared first on HIPAA Journal.

Another healthcare organization has been attacked with ransomware, resulting in the protected health information of almost 34,000 patients being encrypted and made inaccessible.

St. Mark’s Surgical Center in Fort Myers, FL experienced the ransomware attack on April 13, 2017, which prevented patient data from being accessed until April 17, 2017. The ransomware was installed on the center’s server which contained patient’s names, dates of birth, Social Security numbers and treatment information.

An investigation into the breach was immediately conducted to determine the extent of the attack and to find out which data had been encrypted and the number of patients impacted. That investigation revealed the protected health information of 33,877 patients was potentially accessed by the attackers.

A third-party cybersecurity firm was called in to assist with the removal of the ransomware and to conduct a thorough forensic investigation. The firm was able to confirm that all traces of the malware were removed and further access to the server was blocked.

The firm also investigated whether the attack involved the accessing or theft of patient data. The investigation did not uncover any evidence to suggest any health information was stolen or viewed by the attackers, although the possibility could not be ruled out with a high degree of certainty.

As the Department of Health and Human Services’ Office for Civil Rights has explained in its guidance on ransomware and subsequent blog posts, any ransomware attack that involves the encryption of ePHI is usually reportable. St. Mark’s Surgical Center followed that guidance and reported the security incident and notified all patients affected by the security breach to allow them to take action to minimize the possibility of misuse of their data.

All patients affected by the incident have also been offered complimentary credit monitoring and related services as an additional precaution against identity theft and fraud.

Prior to the attack, St. Mark’s Surgical Center had taken steps to reduce the risk of malware and ransomware incidents, although the attackers managed to bypass those defenses. To reduce the risk of future attacks, St. Mark’s Surgical Center has taken a number of steps to improve security, including purchasing a more robust firewall, improving patch management policies and ensuring all systems are protected by the latest antivirus software. Unified threat management services are also being used and a new backup and disaster recovery system has been implemented, which performs hourly backups and stores copies of those backups offsite in redundant data centers.

The substitute breach notice indicates the medical center learned of the extent of the attack on May 8, 2017, although the breach report on the Office for Civil Rights website shows the notice was submitted on August 9.

The maximum allowable time for notifying OCR and patients of a breach of ePHI is 60 days from the discovery of the breach, although covered entities should not delay the issuing of breach notifications unnecessarily.

Deven McGraw recently explained that breach notification delays are violations of HIPAA Rules, even when breach notices are issued within 60 days. If HIPAA covered entities delay the issuing of breach notices they risk a financial penalty for the violation, as Presense Health discovered. A one-month delay in issuing breach notifications resulted in a settlement of $475,000.

The post 34,000 Impacted by Ransomware Attack at St. Mark’s Surgical Center appeared first on HIPAA Journal.

Ransomware attacks on healthcare organizations have increased, although that is far from the only malware threat. Keylogging malware can be used to obtain sensitive information such as login credentials, or in the case of the San Antonio Institute for Women’s Health (IFWH), credit and debit card information as it was entered into its system.

The keylogging malware was discovered on the IFWH network on July 6, 2017, prompting a forensic investigation of its systems. That investigation revealed the malware had been installed on June 5, although it took until July 11 for the malware to be removed from the majority of its systems and a further two days for IFWH to confirm that the malware had been completely removed from all terminal servers and workstations.

During the time that the malware was present, it recorded and transmitted sensitive data as information was entered into its system. The types of data recorded by the malware between June 5 and July 11 includes names, dates of birth, addresses, Social Security numbers, scheduling notes, current procedural technology and other billing codes and other information that was entered into its system between those dates.

Any patient that paid for medical services using a credit or debit card between the above dates may have had their card data captured by the malware. IFWH said the incident was limited to information entered internally via keyboards. Data entered into its patient portal was not obtained by the hackers.

The Department of Health and Human Services has been informed of the breach and the incident has been reported to the Federal Bureau of Investigation. All patients impacted by the incident have now been notified of the breach by mail and have been offered identity theft protection services via ID Experts MyIDCare program. Patients will also benefit from 12 months of credit monitoring services and protection with a $1,000,000 insurance reimbursement policy.

Since credit card details were obtained, patients have been requested to contact their credit card companies and work with them to resolve any fraud issues and secure their accounts.

IFWH issued a statement confirming layered security defenses had been implemented prior to the malware attack, but those controls failed to prevent the virus from being installed. Those measures included network filtering and security monitoring solutions, firewalls, antivirus solutions and password protection. The malware attack has prompted IFWH to bolster its defenses to prevent further breaches, including enhancing data security on its web server infrastructure.

The post Institute for Women’s Health Hacked: PHI Compromised appeared first on HIPAA Journal.

A log book containing the protected health information of approximately 750 obstetrics patients of TriPoint Medical Center in Concord Township, Ohio has been discovered to be missing.

All obstetrics departments are required by the Ohio Department of Health to maintain a log book detailing deliveries. The log book contained only limited protected health information of patients and the loss/theft of the logbook did not result in the exposure of any highly sensitive information such as Social Security numbers, financial information, or details of health insurance.

However, out of an abundance of caution, all individuals affected by the incident have been notified of the breach by mail and have been offered membership to an identity theft protection program for 12 months without charge.

Lake Health, which operates the medical center, was informed of the lost logbook in June and launched an investigation and conducted a risk assessment the same day. While the logbook has not been located, Lake Health has confirmed that none of the information in the log book has been lost. All information is transferred from the log book to its computer system and the digital copies are stored securely.

The Ohio Department of Health does not stipulate that log books be maintained in physical form. To improve security, Lake Health has updated its policies and procedures and the log book is now maintained in secure, digital form. Additionally, the incident has prompted Lake Health to provide further training for all obstetrics department employees on privacy and security.

Marketing and Business Development Senior Vice President Richard D. Cicero issued a statement saying Lake Health “deeply regrets this incident” and is committed to protecting the privacy and security of patients’ sensitive information. He explained, “We have rigorous processes and procedures in place to detect breaches of patients’ rights and to protect patients in the event of a breach.”

The post Lake Health Informs OB Patients of TriPoint Medical Center Breach appeared first on HIPAA Journal.

Hackers have gained access to a server maintained by cloud hosting and server management provider TekLinks and have potentially accessed/copied the protected health information of patients of Surgical Dermatology Group in Birmingham, AL.

The intrusion was discovered on or around May 1, 2017, although the breach investigation revealed access to the server was first gained on March 23, 2017. TekLinks said access to the server was blocked on May 1, and its monitoring systems showed no access took place between April 22 and May 1, although it is possible data were viewed or copied in the previous four weeks.

Surgical Dermatology Group has been working with forensic investigators to determine the nature and scope of the breach and reports that a wide range of protected health information was potentially accessed. The types of data stored on the compromised server includes patients’ names, home and work telephone numbers, cell phone numbers, addresses, email addresses, medical record numbers, patient ID numbers, Social Security numbers, health plan numbers, details of charges and payments and physicians’ names. Financial information and credit/debit card numbers were not compromised as they were not stored on the server.

Surgical Dermatology Group has not received any reports to suggest any information on the server has been accessed or misused in any way, although due to the sensitive nature of data involved, all affected individuals have been offered credit monitoring and identity theft protection services for 12 months without charge.

All affected patients have now been notified of the breach and the incident has been reported to appropriate authorities, including the Federal Bureau of Investigation.

The forensic investigation team has confirmed that all servers are now secured and access is no longer possible. Steps have also been taken to improve security to prevent further breaches. A spokesperson for the company said, “Surgical Dermatology Group takes very seriously its responsibility to protect your information and deeply regrets this unfortunate incident.”

The post Surgical Dermatology Group Informs Patients of Cloud Services Provider Breach appeared first on HIPAA Journal.

A ransomware attack on the Los Angeles Pacific Alliance Medical Center has potentially resulted in the attackers gaining access to the protected health information of its patients.

The attack occurred on or around June 14, 2017. Pacific Alliance Medical Center became aware that its systems had been compromised when files started to be encrypted. The incident triggered Pacific Alliance Medical Center’s emergency response procedures and its networked computer systems were rapidly shut down to prevent the spread of the virus.

The Information Technology Department conducted an initial investigation which revealed several computer systems had been attacked. The forensic investigation has now been completed, the virus has been removed and data have been successfully decrypted. It is unclear whether a ransom was paid.

Efforts are continuing to restore its systems and improve protections to ensure incidents such as this are prevented in the future. Those measures include enhanced antivirus protection and other system safeguards.

All affected individuals have now been notified of the breach and the incident has been reported to the FBI. Pacific Alliance Medical Center states in its substitute breach notice that breach notification letters were not delayed as a result of the law enforcement investigation.

Ransomware attacks do not typically result in data being viewed or stolen by the attackers and Pacific Alliance Medical Center has uncovered no evidence to suggest data were viewed/stolen in this attack. However, since the possibility cannot be ruled out with a high degree of certainty, breach notification letters have been sent and all affected individuals have been offered membership to Experian Identity Works identity theft protection services for two years without charge.

The types of PHI stored on the systems affected by the recent attack includes names, dates of birth, demographic information, employment information and Social Security numbers. No financial information or health data were stored on the affected systems and remained secure at all times.

The incident has been reported to the Department of Health and Human Services’ Office for Civil Rights although it is currently unclear how many individuals have been impacted by the security breach.

The post Pacific Alliance Medical Center Announces Ransomware Attack appeared first on HIPAA Journal.