Latest HIPAA News

FBI Urges Enterprises to Upgrade Windows 7 Devices to a Supported Operating System

Posted by HIPAA Journal

The FBI Cyber Division has issued a Private Industry Notification advising enterprises still using Windows 7 within their infrastructure to upgrade to a supported operating system due to the risk of security vulnerabilities in the Windows 7 operating system being exploited.

The FBI has observed an increase in cyberattacks on unsupported operating systems once they reach end-of-life status. Any organization that is still using Windows 7 on devices faces an increased risk of cybercriminals exploiting vulnerabilities in the operating system to remotely gain network access. “As time passes, Windows 7 becomes more vulnerable to exploitation due to lack of security updates and new vulnerabilities discovered,” warned the FBI.

The Windows 7 operating system reached end-of-life on January 14, 2020 and Microsoft stopped releasing free patches to correct known vulnerabilities. Microsoft is only providing security updates for Windows 7 Professional, Windows 7 Enterprise, and Windows 7 Ultimate if users sign up for the Extended Security Update (ESU) program. The ESU program will only run until January 2023, and the cost of continued support increases the longer a customer participates in the program. While security updates are being released for customers that have signed up for the ESU program, the FBI and Microsoft strongly advise users of Windows 7 to upgrade to Windows 10 or a fully supported operating system.

Updating an operating system is not without its challenges. New devices may need to be purchased and new software comes at a cost, but the cost will be negligible compared to the cost of the loss of intellectual properly and threats to an organization from the continued use of an operating system that is no longer supported.

Many organizations around the world are still using Windows 7 on at least some of their Windows devices. Data from Statcounter indicates around 20% of all Windows devices are still running Windows 7, even though free security updates are no longer being issued. An open source report published in May 2019 found that 71% of Windows devices used in healthcare were using Windows 7 or other operating systems that became unsupported in January 2020.

The FBI warned that increases in successful cyberattacks have been observed in healthcare when operating systems have reached end of life. When support for Windows XP ended on April 28, 2014, the industry saw a large increase in the number of exposed and compromised healthcare records the following year.

The FBI explained that cybercriminals are continuing to search for entry points into legacy Windows operating systems in order to leverage Remote Desktop Protocol (RDP) exploits. In May 2019, following the discovery of the BlueKeep vulnerability, Microsoft released patches for all supported operating systems and also a patch for Windows XP and other unsupported operating systems in order to prevent a WannaCry-style attack.  Since the vulnerability was discovered, working exploits have been developed to exploit the flaw and are still being used to attack unpatched Windows devices.

Vulnerabilities will be found and exploited on unpatched systems. When Microsoft released the MS17-010 patch to address several SMBv1 vulnerabilities in March 2017, many organizations were slow to apply the patch, even though there was a high risk exploitation. The WannaCry ransomware attacks exploiting the flaws started in May 2017. 98% of systems infected with WannaCry were running Windows 7.

“With fewer customers able to maintain a patched Windows 7 system after its end of life, cybercriminals will continue to view Windows 7 as a soft target” warned the FBI.

When organizations use an actively supported operating system, patches are automatically made available to fix newly discovered security vulnerabilities. Upgrading to a supported operating system is one of the most important steps to take to improve security.

“Defending against cyber criminals requires a multilayered approach, including validation of current software employed on the computer network and validation of access controls and network configurations,” explained the FBI in the alert.

In addition to upgrading the operating system and applying patches promptly, organizations should ensure antivirus software is installed, spam filters are used, and firewalls should be implemented, properly configured, and kept up to date.

Network configurations should be audited and any computer systems that cannot be updated should be isolated. The FBI also recommends auditing the network for systems using RDP and closing unused RDP ports. 2-factor authentication should be implemented as widely as possible and all RDP login attempts should be logged.

If there are reasons why Windows 7 devices cannot be updated and devices cannot be completely isolated, they should not be accessible over the internet and organizations should enroll in Microsoft’s ESU program.

The post FBI Urges Enterprises to Upgrade Windows 7 Devices to a Supported Operating System appeared first on HIPAA Journal.

CISA Warns of Increase in Cyberattacks by Chinese Nation State Threat Groups using the Taidoor RAT

Posted by HIPAA Journal

The Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has issued a high priority alert warning enterprises of the risk of cyberattacks involving Taidoor malware, a remote access Trojan (RAT) used by the Chinese government in cyber espionage campaigns.

Taidoor was first identified in 2008 and has been used in many attacks on enterprises. The alert was issued after CISA, the FBI and the Department of Defense (DoD) identified a new variant of the Taidoor RAT which is being used in attacks on US enterprises. Strong evidence has been found suggesting the Taidoor RAT is being used by threat actors working for the Chinese government.

CISA explains in the alert that the threat actors are using the malware in conjunction with proxy servers to hide their location and gain persistent access to victims’ networks and for further network exploitation.

Two versions of the malware have been identified which are being used to target 32-bit and 64-bit systems. Taidoor is downloaded onto victims’ systems as a service dynamic link library (DLL) and consists of two files: A loader that is started as a service, which decrypts and executes a second file in the memory. The second file is the main Taidoor Remote Access Trojan (RAT). The Taidoor RAT provides gives the attackers persistent access to enterprise networks and allows data exfiltration and other malware to be downloaded.

CISA has published a Malware Analysis Report that includes confirmed indicators of compromise (IoCs), suggested mitigations, and recommended actions that can improve protection against Taidoor malware attacks. In the event of an attack, victims should give the activity the highest priority for enhanced mitigation and the attack should be reported to either CISA or FBI Cyber Watch.

CISA recommended actions for administrators include maintaining up to date antivirus signatures, keeping operating systems and software patched, disabling file and printer sharing (or using strong passwords if file and printer sharing is needed), restricting the use of admin privileges, exercising caution when opening email attachments, implementing a strong password policy, enabling firewalls on all workstations to deny unsolicited connection requests, disabling unnecessary services on workstations, monitoring users’ web browsing habits, and scanning all software downloaded from the Internet prior to execution.

The IOCs, mitigations, and recommendations can be found here.

The malware warning follows a joint alert issued by CISA and the FBI in May about attempts by Chinese hackers to gain access to the networks of organizations involved in COVID-19 research and vaccine development to steal intellectual property and public health data. The agencies have observed an increase in attacks spreading malware under the guise of updates on COVID-19 and spear phishing attacks using COVID-19 themes lures. In July, the Department of Justice announced that two Chinese hackers had been indicted for hacking US healthcare firms, government agencies, medical research institutions and other targets.

The post CISA Warns of Increase in Cyberattacks by Chinese Nation State Threat Groups using the Taidoor RAT appeared first on HIPAA Journal.

President Trump Signs Executive Order Calling for Expansion of Telehealth Services

Posted by HIPAA Journal

On Monday, August 3, 2020, President Trump signed an executive order to expand access to telehealth services for the 57 million Americans living in under-served rural areas.  The Executive Order on Improving Rural and Telehealth Access will ensure that the expansion of telehealth services due to the COVID-19 pandemic will continue after the nationwide public health emergency is declared over.

In 2019, Medicare started paying for virtual check-ins with doctors to determine whether an in-person visit was required, but the pandemic saw access to virtual visits expanded significantly in an effort to help prevent the spread of COVID-19. Geographic restrictions were lifted, and telehealth services were made available to Medicare beneficiaries across the country. The Centers for Medicare and Medicaid Services (CMS) also added a further 135 medical services to the list of services that are covered by Medicare if provided virtually.

Figures from the CMS show that virtual visits via phone or video increased to nearly 1.7 million in the last week in April, compared to just 14,000 visits before COVID-19. From mid-March, when the telehealth restrictions were relaxed, to mid-July, 10.1 million Medicare beneficiaries received a Medicare telehealth virtual visit. While there was a fall in the number of virtual visits in May once in-person visits resumed, the number of patients opting for virtual visits remained high, indicating patients are happy with medical services being provided virtually.

Americans living in rural locations are more likely to die from the five leading causes of death in the United States than individuals living in urban areas, and the gap has widened between 2010 and 2017. “Prior to the pandemic, telehealth was fine, but it wasn’t anything raging, and I guess one of the only good things that we’ve gotten out of this horrible situation is that telehealth has been increased,” said President Trump. “It is the purpose of this order to increase access to, improve the quality of, and improve the financial economics of rural healthcare, including by increasing access to high-quality care through telehealth.”

President Trump also called for officials to develop a plan within 30 days to increase investment in the communication infrastructure to improve healthcare in rural areas and within 30 days, the Secretary of the HHS will announce a new model to test new payment mechanisms to ensure that healthcare providers in rural areas can provide the necessary level of and quality of care to patients. Under the new model, healthcare providers in rural areas will be given more flexibility from current Medicare rules, and the model will establish predictable financial payments and encourage the transition to high-quality, value-based care. A report will also be submitted by the HHS Secretary on policy initiatives to increase rural access to healthcare through the removal of regulatory burdens which limit the availability of clinicians, prevent disease and mortality through rural-specific initiatives to improve health outcomes, reduce maternal mortality, and improve mental health in rural communities.

Shortly after the Executive Order was signed, the CMS announced it is proposing changes that will expand telehealth services for Medicare beneficiaries permanently, consistent with the Executive Order. The proposed CMS rule also includes a multi-year program that aims to reduce the burden on clinicians as part of its Patients Over Paperwork initiative and will ensure that there will be appropriate reimbursement for the time clinicians spend with patients. The CMS is also proposing that some of the additional medical services covered under Medicare during the public health emergency will also continue to be paid for by Medicare if provided virtually, including virtual visits for certain evaluation and management services and some services for patients with cognitive impairments.

The CMS is seeking public input on which services should continue to be covered by Medicare once the public health emergency is declared over. The CMS also wants to temporarily continue telehealth services for emergency department visits to give the industry time to assess whether they should also be made permanent. Comments on the proposed changes are being accepted until October 5, 2020.

“Telemedicine can never fully replace in-person care, but it can complement and enhance in-person care by furnishing one more powerful clinical tool to increase access and choices for Americas seniors,” said CMS Administrator Seema Verma. “The Trump Administration’s unprecedented expansion of telemedicine during the pandemic represents a revolution in healthcare delivery, one to which the healthcare system has adapted quickly and effectively. Never one merely to tinker around the edges when it comes to patient-centered care, President Trump will not let this opportunity slip through our fingers.”

The post President Trump Signs Executive Order Calling for Expansion of Telehealth Services appeared first on HIPAA Journal.

FBI Issues Flash Alert Warning of Increasing NetWalker Ransomware Attacks

Posted by HIPAA Journal

This week, the Federal Bureau of Investigation (FBI) issued a (TLP:WHITE) FLASH alert following an increase in attacks involving NetWalker ransomware. NetWalker is a relatively new ransomware threat that was recognized in March 2020 following attacks on a transportation and logistics company in Australia and the University of California, San Francisco. UC San Francisco was forced to pay a ransom of around $1.14 million for the keys to unlock encrypted files to recover essential research data. One of the most recent healthcare victims was the Maryland-based nursing home operator, Lorien Health Services.

The threat group has taken advantage of the COVID-19 pandemic to conduct attacks and has targeted government organizations, private companies, educational institutions, healthcare providers, and entities involved in COVID-19 research.

The threat group initially used email as their attack vector, sending phishing emails containing a malicious Visual Basic Scripting (.vbs) file attachment in COVID-19 themed emails. In April, the group also started exploiting unpatched vulnerabilities in Virtual Private Networking (VPN) appliances such as the Pulse Secure VPN flaw (CVE-2019- 11510) and Telerik UI (CVE-2019-18935).

The threat group is also known to attack insecure user interface components in web applications. Mimikatz is deployed to steal credentials, and the penetration testing tool PsExec is used to gain access to networks. Prior to encrypting files with NetWalker ransomware, sensitive data is located and exfiltrated to cloud services. Initially, data was exfiltrated via the MEGA website or by installing the MEGA client application directly on a victim’s computer and more recently through the website.dropmefiles.com file sharing service.

Earlier this year, the NetWalker operators started advertising on hacking forums looking to recruit a select group of affiliates that could provide access to the networks of large enterprises. It is unclear how successful the group has been at recruiting affiliates, but attacks have been increasing throughout June and July.

The FBI has advised victims not to pay the ransom and to report any attacks to their local FBI field office. “Paying a ransom may embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or may fund illicit activities,” explained the FBI in the alert. “Paying the ransom also does not guarantee that a victim’s files will be recovered. However, the FBI understands that when businesses are faced with an inability to function, executives will evaluate all options to protect their shareholders, employees, and customers.”

A range of different techniques are being used to gain access to networks so there is no single mitigation that can be implemented to prevent attacks from being successful. The FBI recommends keeping all computers, devices, and applications up to date and applying patches promptly. Multi-factor authentication should be implemented to prevent stolen credentials from being used to access systems, and strong passwords should be set to thwart brute force attempts to guess passwords. Anti-virus/anti-malware software should be installed on all hosts and should be kept updated, and regular scans should be conducted.

To ensure recovery from an attack is possible without paying the ransom, organizations should backup all critical data and store those backups offline on a non-networked device or in the cloud. The backup should not be accessible from the system where the data resides. Ideally, create more than one backup copy and store each copy in a different location.

The post FBI Issues Flash Alert Warning of Increasing NetWalker Ransomware Attacks appeared first on HIPAA Journal.

IBM Security 2020 Cost of Data Breach Report Shows 10% Annual Increase in Healthcare Data Breach Costs

Posted by HIPAA Journal

The 2020 Cost of Data Breach Report from IBM Security has been released and reveals there has been a slight reduction in global data breach costs, falling to $3.86 million per breach from $3.92 million in 2019 – A reduction of 1.5%.

There was considerable variation in data breach costs in different regions and industries. Organizations in the United States faced the highest data breach costs, with a typical breach costing $8.64 million, up 5.5% from 2019.

COVID-19 Expected to Increase Data Breach Costs

This is the 15th year that IBM Security has conducted the study. The research was conducted by the Ponemon Institute, and included data from 524 breached organizations, and 3,200 individuals were interviewed across 17 countries and regions and 17 industry sectors. Research for the report was conducted between August 2019 and April 2020.

The research was mostly conducted before the COVID-19 pandemic, which is likely to have an impact on data breach costs. To explore how COVID-19 is likely to affect the cost of a data breaches, the Ponemon Institute re-contacted study participants to ask their views. 76% of respondents believed the increase in remote working would increase the time taken to identify and contain a data breach and 70% said remote working would increase the cost of a data breach. The average cost increase due to COVID-19 was calculated to be $137,000.

Healthcare Data Breaches are the Costliest

Healthcare data breaches were the costliest to resolve. The average cost of a healthcare data breach is $7.13 million globally and $8.6 million in the United States. The total cost of a data breach may have fallen across all regions and industry sectors, but healthcare data breach costs have increased by 10.5% year-over-year.

The global average cost of a breach per record is $146, which increased to $150 per record when PII was breached, and $175 per record where PII was breached in a malicious attack.

It took an average of 280 days to detect and contain a breach, and 315 days to detect and contain a malicious attack, with each increasing by 1 day from 2019. In the United States it took an average of 186 days to identify a data breach and 51 days to contain the attack. Healthcare industry data breaches took the longest to identify (236 days) and contain (93 days) – 329 days.

The costs of a data breach are spread over several years, with 61% of costs experienced in the first year, 24% in the second year, and 15% in the third year and beyond.  In highly regulated industries such as healthcare, the percentages were 44% (year 1), 32% (year 2), and 21% (year 3+).

For the third year, IBM Security calculated the costs of mega data breaches – those involving more than 1 million records. A breach of 1 million to 10 million records cost an average of $50 million, breaches of 10 million to 20 million records cost an average of $176 million, and a breach of 50 million records was calculated to cost $392 million to resolve.

Most Common Causes of Malicious Data Breaches

Malicious attacks were the most numerous and were most due to cloud misconfigurations and compromised credentials, with each accounting for 19% of breaches. Vulnerabilities in third-party software was cited as the breach cause in 16% of incidents, following by phishing (14%), physical security compromises (10%), malicious insiders (7%), system errors and other misconfigurations (6%), and business email compromise attacks (5%). Breaches involving compromised credentials were the costliest, followed by breaches due to vulnerabilities in third-party software and cloud misconfigurations.

53% of attacks were financially motivated, 13% were attributed to nation state hacking groups, and 13% were caused by hacktivists. The threat actors behind 21% of the breaches were unknown. Financially motivated attacks were the least expensive, with a global average cost of $4.23 million and the most expensive were attacks by nation state hackers, which cost an average of $4.43 million. The average cost of a malicious attack was $4.27 million. Destructive data breaches involving ransomware cost an average of $4.4 million and destructive malware, including wipers, cost an average of $4.52 million.

In healthcare, 50% of data breaches were due to malicious attacks, 23% were due to system glitches, and 27% were caused by human error.

Key Factors Affecting the Cost of a Data Breach

Source: IBM Security: 2020 Cost of a Data Breach Report

The post IBM Security 2020 Cost of Data Breach Report Shows 10% Annual Increase in Healthcare Data Breach Costs appeared first on HIPAA Journal.

OCR Imposes $1 Million HIPAA Penalty on Lifespan for Lack of Encryption and Other HIPAA Failures

Posted by HIPAA Journal

The HHS’ Office for Civil Rights has imposed a $1,040,000 HIPAA penalty on Lifespan Health System Affiliated Covered Entity (Lifespan ACE) following the discovery of systemic noncompliance with the HIPAA Rules.

Lifespan is a not-for-profit health system based in Rhode Island that has many healthcare provider affiliates in the state. On April 21, 2017, a breach report was filed with OCR by Lifespan Corporation, the parent company and business associate of Lifespan ACE, about the theft of an unencrypted laptop computer on February 25, 2017.

The laptop had been left in the vehicle of an employee in a public parking lot and was broken into. A laptop was stolen that contained information such as patient names, medical record numbers, medication information, and demographic data of 20,431 patients of its healthcare provider affiliates.

OCR investigated the breach and discovered systemic noncompliance with the HIPAA Rules. Lifespan ACE uses a variety of mobile devices and had conducted a risk analysis to identify potential risks to the confidentiality, integrity, and availability of ePHI. Through the risk analysis, Lifespan ACE determined that the use of encryption on mobile devices such as laptops was reasonable and appropriate given the level of risk but failed to implement encryption. The lack of encryption was a violation of 45 C.F .R. § I 64.312(a)(2)(iv).

OCR also discovered Lifespan ACE had not implemented policies and procedures that required the tracking of portable devices with access to a network containing ePHI, nor was there a comprehensive inventory of those devices, in violation of 45 C.F.R. § 164.310(d)(1).

Lifespan Corporation was a business associate of Lifespan ACE, but both entities had failed to enter into a business associate agreement with each other. Lifespan ACE had also not obtained a signed business associate agreement from its healthcare provider affiliates, in violation of 45 C.F.R. § 164.502(e).

As a result of the compliance failures, Lifespan ACE was responsible for the impermissible disclosure of the ePHI of 20,431 individuals when the laptop was stolen – See 45 C.F.R. § 164.502(a).

Lifespan ACE agreed to settle the case, pay the financial penalty, and adopt a comprehensive corrective action plan (CAP). The CAP requires Lifespan ACE to enter into business associate agreements with its affiliates and parent company, create an inventory of all electronic devices, implement encryption and configure access controls, and review and revise its policies and procedures with respect to device and media controls. Those policies and procedures must be distributed to the workforce and training must be provided on the new policies. Lifespan ACE’s compliance efforts will be scrutinized by OCR for the duration of the two-year CAP.

“Laptops, cellphones, and other mobile devices are stolen every day, that’s the hard reality.  Covered entities can best protect their patients’ data by encrypting mobile devices to thwart identity thieves,” said Roger Severino, OCR Director.

This is the second HIPAA penalty to be announced by OCR in the past week. On July 23, 2020, OCR announced Metropolitan Community Health Services dba Agape Health Services had been fined $25,000 for longstanding, systemic noncompliance with the HIPAA Security Rule.

The post OCR Imposes $1 Million HIPAA Penalty on Lifespan for Lack of Encryption and Other HIPAA Failures appeared first on HIPAA Journal.

June 2020 Healthcare Data Breach Report

Posted by HIPAA Journal

The sharp drop in healthcare data breaches seen in May proved to be short lived, with June seeing a major increase in data breaches. In June, 52 breaches were reported by HIPAA covered entities and business associates. That represents an 85.71% month-over-month increase in reported breaches.

The number of individuals impacted by healthcare data breaches changed little despite the large increase in breaches, with a month-over-month fall of 1.65% to 1,047,015 records, which is well above the 2020 monthly average of 896,374 breached records.

Largest Healthcare Data Breaches in June 2020

The largest healthcare data breach reported by a single entity in June affected the Texas billing and collections agency, Benefit Recovery Specialists, Inc. (BRS) Malware was detected on its systems that potentially gave unauthorized individuals access to the protected health information of more than a quarter of a million people.

There was, however, a much larger data breach reported in June that affected more than 365,000 individuals but was reported individually by each entity affected by the breach. Magellan Health suffered a ransomware attack that also affected at least 9 healthcare providers, health plans, and business associates, specifically Merit Health Insurance Company, Magellan Complete Care of Florida, the University of Florida Health Jacksonville, Magellan Healthcare in Maryland, Magellan Rx Pharmacy, National Imaging Associates, UF Health Shands, UF Health, and Magellan Complete Care of Virginia. The ransomware attack ranks as the the third largest healthcare data breach so far in 2020.

Name of Covered Entity Covered Entity Type Type of Breach Individuals Affected
Benefit Recovery Specialists, Inc. Business Associate Hacking/IT Incident 274,837
Merit Health Insurance Company Health Plan Hacking/IT Incident 102,748
Magellan Complete Care of Florida Health Plan Hacking/IT Incident 76,236
Healthcare Fiscal Management Inc. Business Associate Hacking/IT Incident 58,000
UF Health Jacksonville Healthcare Provider Hacking/IT Incident 54,002
Magellan Healthcare Business Associate Hacking/IT Incident 50,410
Providence Health Plan Health Plan Unauthorized Access/Disclosure 49,511
American Medical Technologies Healthcare Provider Hacking/IT Incident 47,767
Oral and Maxillofacial Surgery Associates, P.A. Healthcare Provider Hacking/IT Incident 35,498
City of Philadelphia Health Plan Hacking/IT Incident 33,376
Magellan Rx Pharmacy Healthcare Provider Hacking/IT Incident 33,040
Cano Health Healthcare Provider Hacking/IT Incident 28,268
National Imaging Associates Business Associate Hacking/IT Incident 22,560
Legacy Community Health Services Healthcare Provider Hacking/IT Incident 19,000
Human Affairs International of California Business Associate Hacking/IT Incident 15,843
UF Health Shands Healthcare Provider Hacking/IT Incident 13,146
North Shore Pain Management Healthcare Provider Hacking/IT Incident 12,472
Choice Health Management Services, LLC Business Associate Hacking/IT Incident 11,650
Iowa Total Care, Inc. Health Plan Unauthorized Access/Disclosure 11,581
The Kroger Co., for itself and its affiliates and subsidiaries Healthcare Provider Hacking/IT Incident 10,974

Causes of June 2020 Healthcare Data Breaches

There were 37 reported hacking/IT incidents in June, which accounted for 71.15% of the month’s breaches and 91.14% of records breached in June. 957,082 records were exposed or stolen in those breaches. The average breach size was 25,867 records and the median breach size was 9,271 records.

There were 11 unauthorized access/disclosure incidents reported in June that impacted 85,580 individuals. The average breach size was 7,780 records and the median breach size was 1,650 records. There were 4 loss/theft incidents reported that impacted 4,353 individuals. The average breach size was 1,088 records and the median breach size was 910 records.

The most common location of breached protected health information was email. 63.46% of the month’s breaches involved ePHI stored in emails and email attachments, with 36.53% of breaches involving network servers. The majority of the email breaches were due to phishing attacks, with the network server breaches mostly involving malware and ransomware.

June 2020 Healthcare Data Breaches by State

Data breaches of 500 or more record were reported by HIPAA-covered entities and business associates in 21 states. California was the worst affected state with 9 breaches, followed by Florida with 7, Texas with 5, Maryland and New York with 4, and three in Illinois.

There were two breaches in each of Arkansas, North Carolina, Ohio, Oregon, and Pennsylvania, and one breach in each of Colorado, Connecticut, Iowa, Kentucky, Massachusetts, Michigan, Missouri, South Carolina, Tennessee, and Utah.

Healthcare Data Breaches by Covered Entity Type

Healthcare providers were the worst affected covered entity in June with 33 reported data breaches. There was an increase in health plan data breaches with 9 reported incidents, and also an increase in business associate breaches. While there were 10 breaches reported by business associates, a further 7 breaches involved business associates but were reported by the covered entity.

HIPAA Enforcement in June 2020

There were no HIPAA enforcement actions announced by state attorneys general or the HHS’ Office for Civil Rights in June 2020.  The HHS has stated that it is prepared to be flexible with HIPAA investigations during the pandemic, so the lack of enforcement actions so far in 2020 may not be due to any reduction in enforcement, there may just be a delay in imposing penalties until the COVID-19 pandemic is brought under control.

On July 23, 2020, the Secretary of the Department of Health and Human Services, Alex Azar, announced that the nationwide public health emergency has been renewed for a further 90 days so OCR’s Notices of Enforcement Discretion covering good faith uses and disclosures of PHI in relation to telehealth and the operation of COVID-19 testing centers, and the waivers under Section 1135(b)(7) of the Social Security Act remain in effect.

The post June 2020 Healthcare Data Breach Report appeared first on HIPAA Journal.

Small North Carolina Healthcare Provider Fined $25,000 for HIPAA Security Rule Noncompliance

Posted by HIPAA Journal

The HHS’ Office for Civil Rights (OCR) has announced a $25,000 settlement has been reached with Metropolitan Community Health Services to resolve violations of the HIPAA Security Rule.

Washington, NC-based Metropolitan Community Health Services is a Federally Qualified Health Center that provides integrated medical, dental, behavioral health & pharmacy services for adults and children. Operating as Agape Health Services, Metro provides discounted medical services to the underserved population in rural North Carolina. Metropolitan Community Health Services has around 43 employees and serves 3,100 patients each year.

On June 9, 2011, Metropolitan Community Health Services filed a report with OCR over a breach of the protected health information of 1,263 patients. OCR conducted a compliance review to establish whether the breach was the direct result of noncompliance with the HIPAA Rules. The OCR investigation uncovered longstanding, systemic noncompliance with the HIPAA Security Rule.

Prior to the breach, Metropolitan Community Health Service had failed to implement HIPAA Security Rule policies and procedures, in violation of 45 C.F.R. §164.316, and an accurate and thorough assessment of the potential risks to the confidentiality, integrity, and availability of ePHI had not been conducted, in violation of 45 C.F.R. § 164.308(a)(l )(ii)(A). Despite being in business since 1999, no HIPAA security awareness and training had been provided to the workforce prior to June 30, 2016, in violation of 45 C.F.R. §164.308(a)(5).

When deciding on an appropriate settlement, OCR took the size of the organization and several other factors into account.  In addition to paying a financial penalty of $25,000 to resolve the HIPAA violations, Metropolitan Community Health Services has agreed to adopt a robust corrective action plan and will ensure policies and procedures are implemented to the standards required by HIPAA.  Metropolitan Community Health Services will be monitored for compliance with the corrective action plan for a period of two years.

This is the second HIPAA violation penalty to be imposed on a HIPAA covered entity in 2020 to resolve violations of HIPAA Rules, the first being a $100,000 financial penalty in March 2020 for Steven A. Porter, M.D for risk analysis and risk management failures.

The fine confirms that healthcare providers, large and small, are required to comply with HIPAA Rules. “Health care providers owe it to their patients to comply with the HIPAA Rules.  When informed of potential HIPAA violations, providers owe it to their patients to quickly address problem areas to safeguard individuals’ health information,” said Roger Severino, OCR Director.

The post Small North Carolina Healthcare Provider Fined $25,000 for HIPAA Security Rule Noncompliance appeared first on HIPAA Journal.

Study Reveals COVID-19 Research Companies are Vulnerable to Cyberattacks

Posted by HIPAA Journal

The biomedical community is working hard to develop vaccines against SARS-CoV-2 and discover new treatments for COVID-19 and nation-state hackers and cybercriminal organizations are targeting those organizations to gain access to their research data.

Recently, security agencies in the United States, Canada, and the United Kingdom issued alerts about state-sponsored Russian hackers targeting organizations involved in COVID-19 research and vaccine development. The security agencies had found evidence that the Russian hacking group APT29 was actively conducting scans against the external IP addresses of companies engaged in COVID-19 research and vaccine development, and that it was almost certain that the hackers were working with the Russian intelligence services.

An joint alert was also issued by the U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency and the FBI indicating hackers linked to China were conducting similar attacks on pharmaceutical companies and academic research facilities to obtain intellectual property and sensitive data related to COVID-19. There have also been reports that hackers in Iran are conducting similar attacks.

In light of the recent attacks and targeting of research facilities, BitSight conducted a study to determine how well COVID-19 vaccine manufacturers and biomedical companies are performing at protecting their systems and data from hackers. BitSight researchers assessed 17 companies for the study, each of which has a major role in COVID-19 research and vaccine development. Those companies ranged from small firms with fewer than 200 employees to large companies with more than 200,000 employees.

BitSight found several security vulnerabilities that could be exploited by hackers to gain access to intellectual property and vaccine and COVID-19 research data. The security vulnerabilities were divided into four areas: Open ports, unpatched vulnerabilities, web application security, and systems that had already been compromised.

BitSight found 8 of the 17 companies had their systems compromised in the past year and had computers that were part of a botnet, and 7 companies had computers added to a botnet in the past 6 months. BitSight searched for software running on systems that the companies likely did not install. These Potentially Unwanted Programs (PUPs) were found on 9 company systems and 8 companies had PUPS installed in the past 6 months. Five companies had computers that were sending spam and the researchers identified unsolicited communications at three companies. Compromised systems show the companies’ security controls have failed and that the companies could, or already have been, hacked by adversaries seeking access to COVID-19 data.

The majority of companies had open ports which exposed insecure services over the internet, including 7 companies with exposed Microsoft RDP and a further 7 with LDAP exposed. 5 companies had exposed MySQL, MS SQL or Postgres SQL databases and a further 5 had an exposed Telnet service. The exposed Microsoft RDP was of particular concern, since hackers and ransomware gangs are actively searching for exposed RDP devices.

14 of the 17 companies were found to have unpatched vulnerabilities that could potentially be exploited remotely by hackers.  10 companies had more than 10 unpatched vulnerabilities and 6 had unpatched vulnerabilities with a CVSS score greater than 9.

Web application security issues were also common, such as insecure redirects from HTTPS to HTTP, insecure authentication, and a mixture of secure and insecure content on web pages. Many of the companies had more than one web application security issue. These security issues placed the companies at risk of man-in-the-middle and cross-site scripting attacks, which could potentially result in hackers capturing sensitive data, obtaining credentials, and compromising email systems.

“In light of these risks, the bioscience community must step up its cyber vigilance. It only takes a misconfigured piece of software, an inadvertently exposed port, or an insecure remote office network for a hacker to gain entry to systems that store scientific research, intellectual property, and the personal data of subjects involved in clinical trials,” warned BitSight. “[Companies] must revisit basic cybersecurity hygiene practices and find proven and efficient ways to continuously discover and manage risk exposure — across the extended attack surface and third-party ecosystem. Only then can remediation be prioritized, and life-saving science innovation assured.”

The post Study Reveals COVID-19 Research Companies are Vulnerable to Cyberattacks appeared first on HIPAA Journal.