Latest HIPAA News

Two Chinese Nationals Indicted for 10-Year Hacking Campaign on U.S. Organizations and Government Agencies

Posted by HIPAA Journal

Two Chinese nationals have been indicted by the U.S. Department of Justice (DOJ) for targeting and hacking US companies, government agencies, and others to steal sensitive information, including COVID-19 research data. The hackers are alleged to have been working under the direction of the Chinese government and also hacking organizations for personal financial gain.

LI Xiaoyu, 34, and Dong Jiazhi, 33, were trained in computer application technologies and have been operating as state-backed hackers for more than 10 years. The DOJ said the hackers were operating on behalf of the China’s Ministry of State Security, the Guangdong State Security Department (GSSD), and other government agencies, as well as conducting their own attacks. The hackers have been accused of stealing more than a terabyte of intellectual property estimated to be worth hundreds of millions of dollars.

The hackers were prolific and conducted sophisticated hacks on companies and organizations in the United States, Australia, Belgium, Germany, Japan, Lithuania, Spain, the Netherlands, South Korea, Sweden, and the United Kingdom. The attacks were conducted on companies in many industry sectors, including high-tech manufacturing, medical devices, pharmaceutical, energy, gaming software, and business. The hackers also targeted individual dissidents, clergy, and democratic and human rights activists in the U.S, China, and Hong Kong.

The hackers stole intellectual property and sensitive data and passed the information to the Chinese government and, in at least one case, source code was stolen from a company and the hackers attempted to extort money from the company and threatened to release the source code on the internet if payment was not made. More recently, the hackers turned their attention to hacking companies developing vaccines, technology and treatments for COVID-19. A cyberattack on the U.S. Department of Energy’s Hanford Site in Eastern Washington sparked the investigation that led to the to the indictment.

The hackers exploited unpatched vulnerabilities in popular web server software, software collaboration programs, and web application development suites and took advantage of insecure default configurations. In many cases, the vulnerabilities that were exploited were new, so patches were not available to address the flaws. After gaining access to systems, malicious web shells such as ‘China Chopper’ were deployed which allowed the hackers to steal credentials, elevate privileges, and execute malicious code. Data exfiltration was hidden by concealing data in RAR compressed files and changing the extensions of those files to the more innocuous .jpg. The hackers also changed system timestamps and concealed programs and documents in innocuous locations on victims’ networks, such as in recycle bins. In many cases, the hackers left backdoors that allowed them regain access to victims’ networks and steal further intellectual property and data, often several years after the initial attack.

“China has now taken its place, alongside Russia, Iran and North Korea, in that shameful club of nations that provide a safe haven for cyber criminals in exchange for those criminals being ‘on call’ to work for the benefit of the state, here to feed the Chinese Communist party’s insatiable hunger for American and other non-Chinese companies’ hard-earned intellectual property, including COVID-19 research,” said Assistant Attorney General for National Security John C. Demers.

Charges were filed for conducting attacks on at least 8 companies and stealing trade secrets related to manufacturing processes, and technology designs, as well as chemical structures, source code, and test results. The information would allow competitors to gain a significant market edge and save millions on research and development costs, allowing them to create competing products.

The DOJ filed an 11-count indictment with a federal grand jury in Spokane, which includes one count of conspiracy to commit fraud, one count of conspiracy to commit theft of trade secrets, one count of conspiracy to commit wire fraud, one count of unauthorized access of a computer, and seven counts of aggravated identity theft. In total, the hackers face a maximum sentence of more than 40 years in jail; however, the hackers are unlikely to be brought to justice as there is no extradition agreement between the US and China.

“Today’s indictment demonstrates the serious consequences the Chinese MSS and its proxies will face if they continue to deploy malicious cyber tactics to either steal what they cannot create or silence what they do not want to hear,” said FBI Deputy Director David Bowdich. Cybercrimes directed by the Chinese government’s intelligence services not only threaten the United States but also every other country that supports fair play, international norms, and the rule of law, and it also seriously undermines China’s desire to become a respected leader in world affairs. The FBI and our international partners will not stand idly by to this threat, and we are committed to holding the Chinese government accountable.”

The post Two Chinese Nationals Indicted for 10-Year Hacking Campaign on U.S. Organizations and Government Agencies appeared first on HIPAA Journal.

Emotet Botnet Reactivated and Sending Large Volumes of Malicious Emails

Posted by HIPAA Journal

The Emotet botnet has been reactivated after a 5-month period of dormancy and is being used to send large volumes of spam emails to organizations in the United States and United Kingdom.

The Emotet botnet is a network of compromised computers that have been infected with Emotet malware. Emotet malware is an information stealer and malware downloader that has been used to distribute a variety of banking Trojans, including the TrickBot Trojan.

Emotet hijacks email accounts and uses them to send spam emails containing malicious links and email attachments, commonly Word documents and Excel spreadsheets containing malicious macros. If the macros are allowed to run, a PowerShell script is launched that silently downloads Emotet malware. Emotet malware can also spread to other devices on the network and all infected devices are added to the botnet.

The emails being used in the campaign are similar to previous campaigns. They use fairly simple, yet effective lures to target businesses, typically fake invoices, purchase orders, receipts, and shipping notifications. The messages often only include one line of text requesting the recipient click a link or open the email attachment. The emails are often personalized and contain the name of the targeted company and typically have a subject line starting with “RE:” that suggests the email has been sent in response to an email previously sent by the targeted individual – RE: Invoice 422132, for example. Several of the emails in this campaign have an attachment called “electronic.form.”

The latest campaign was been detected by several security companies. The first test emails were sent on July 13, and the spam campaign commenced on July 17. Proofpoint detected 30,000 messages on July 17, but now around 250,000 emails are being sent each day.

Malwarebytes rates Emotet as the biggest malware threat of 2018 and 2019, even with the regular breaks in botnet activity. Typically, activity stops around holiday periods for a few days or weeks, but the latest hiatus is one of the longest breaks in activity since the malware first appeared.

Emotet itself is a dangerous malware variant, but it is the additional payloads that Emotet downloads that cause the most damage. The TrickBot Trojan is a modular malware that can perform a range of malicious functions, such as stealing login information, sensitive files and emails, and Bitcoin wallets. The TrickBot Trojan often downloads Ryuk ransomware after the operators have achieved their own objectives.

If Emotet malware is detected, a rapid response is required to isolate the infected device and remove the malware. If Emotet is found on one device, it is likely that other devices will also have been compromised.

To reduce the risk of infection, organizations should send an alert to their employees warning them of the threat and advising them to take extra caution, especially with emails containing Word documents and Excel spreadsheets, even if those emails appear to have been sent from trusted contacts.

The post Emotet Botnet Reactivated and Sending Large Volumes of Malicious Emails appeared first on HIPAA Journal.

Russian APT Group is Targeting Organizations Involved in COVID-19 Research

Posted by HIPAA Journal

The APT29 hacking group, aka Cozy Bear, is targeting healthcare organizations, pharma firms, and research entities in the United States, United Kingdom, and Canada and is attempting to steal COVID-19 research data and information about vaccine development.

On July 16, 2020, a joint advisory was issued by the DHS’ Cybersecurity and Infrastructure Security Agency (CISA), UK National Cyber Security Centre (NCSC), Canada’s Communications Security Establishment (CSE), and the National Security Agency (NSA) to raise awareness of the threat.

APT29 is a cyber espionage group that is almost certainly part of the Russian intelligence services. The group primarily targets government entities, think-tanks, diplomatic and energy targets in order to steal sensitive data. The group has been highly active during the COVID-19 pandemic and has conducted multiple attacks on entities involved COVID-19 research and vaccine development.

The group conducts widespread scanning to identify unpatched vulnerabilities and uses publicly available exploits to gain a foothold in vulnerable systems. The group has successfully used exploits for the Citrix vulnerability CVE-2019-19781, the Pulse Secure vulnerability CVE-2019-11510, the FortiGate vulnerability CVE-2019-13379 and the Zimbra vulnerability CVE-2019-9670. Other exploits may also be used by the group.

APT29 uses variety of tools to obtain access credentials and achieve persistent access to systems and uses anonymizing services when using stolen credentials. APT29 is using custom malware variants to attack organizations, including WellMess and WellMail, two malware variants that have not previously been used by APT29.

WelMess is a lightweight malware variant written in Golang or .NET that can execute arbitrary shell commands and upload and download files and uses HTTP, TLS and DNS for communication. WellMail is a lightweight tool that uses hard-coded client and certificate authority TLS certificates to communicate with C2 servers. A third malware variant, named SoreFang, is also being used. SoreFang is a first stage downloader that exfiltrates data via HTTP and downloads a second state malware. The malware is used to target SangFor devices.

Attacks on organizations involved in COVID-19 research are likely to continue and any organization involved in COVID-19 research should consider itself a target. Organizations have been advised to take steps to secure their systems and monitor for attacks.

Organizations should ensure that all software is patched and up to date, and the patches for CVE-2019-19781, CVE-2019-11510, CVE-2019-13379 and CVE-2019-9670 should be prioritized. Antivirus software should be used and kept up to date, and regular scans should be conducted to identify downloaded malware variants.

Multi-factor authentication should be implemented to prevent stolen credentials from being used to gain access to systems. All staff should be educated about the threat from phishing and all employees should be confident in their ability to identify a phishing attack. All staff should be instructed to report any suspected phishing attacks to their security teams and reports should be investigated promptly and thoroughly.

Organizations have been advised to set up a security monitoring system to ensure that all necessary data is collected to support investigations into network intrusions. Networks should be segmented, and steps taken to prevent and detect lateral movement within networks.

The post Russian APT Group is Targeting Organizations Involved in COVID-19 Research appeared first on HIPAA Journal.

At Least 41 Healthcare Providers Experienced Ransomware Attacks in the First Half of 2020

Posted by HIPAA Journal

The New Zealand-based cybersecurity firm Emsisoft has released ransomware statistics for 2020 that show there have been at least 41 successful ransomware attacks on hospitals and other healthcare providers in the first half of the year.

There were 128 successful ransomware attacks on federal and state entities, healthcare providers, and educational institutions in the first 6 months of 2020, with the healthcare industry accounting for 32% of those attacks.

The large number of ransomware attacks in 2020 follows on from a spike in attacks in late 2019. 2019 saw more than double the number of ransomware attacks as 2018, attacks on healthcare providers increased by 350% in the final quarter of 2019. 966 entities were successfully attacked with ransomware across all industry sectors in 2019 and those attacks are estimated to have cost $7.5 billion.

2020 started badly for the healthcare industry with 10 successful ransomware attacks on healthcare providers in January, followed by a further 16 successful ransomware attacks in February. There was a marked decrease in attacks in March as COVID-19 spread throughout the United States. Three successful ransomware attacks were reported by healthcare providers in March and April and a further 4 attacks in May. While it is certainly good news that the number of successful attacks has declined as the year has progressed, the figures do not indicate any lowering of risk. The number of successful attacks has declined, but the number of attempted attacks has remained fairly constant. Emsisoft has predicted an increase in ransomware attacks on healthcare providers over the summer, as often happens at this time of year. Employees are also starting to return to the office. Ransomware attacks decreased as the COVID-19 pandemic hit the United States, but Emsisoft has started to see attacks increase once again.

One in Ten Ransomware Attacks See Data Stolen Prior to Encryption

Several threat actors are now conducting double extortion attacks, where data is stolen before the ransomware payload is deployed. The Maze ransomware gang was the first to start stealing data and issuing threats to publish the files if the ransom is not paid. The gang followed through on the threat and started publishing data on its website in November 2019. Several other ransomware gangs have also adopted similar tactics, including REvil/Sodinokibi, DoppelPaymer, and NetWalker.

With these groups, ransomware is often deployed many days, weeks, or even months after the initial system breach. During that time, the attackers move laterally to gain access to as many devices as possible and then time their attacks to cause maximum disruption. It is likely that several healthcare providers have already had their systems compromised, but the ransomware has not yet been deployed.

These prolific ransomware gangs have concentrated their attacks on entities in sectors that have the most to lose from the publication or sale of their data, including legal firms, healthcare providers, and firms in the financial sector. These attacks often make headline news, but they only account for around 1 in 10 successful ransomware attacks. From January 1, 2020 to June 30, 2020, ID Ransomware received 100,001 submissions about ransomware attacks and only around 11% – 11,642 submissions – involved ransomware variants used by groups known to steal data prior to encrypting files.

Emsisoft notes however that while several ransomware gangs alert the victim to the theft of their data to increase the probability of the ransom being paid, other ransomware gangs are likely to covertly steal data.

“All ransomware groups have the ability to exfiltrate data. While some groups overtly steal data and use the threat of its release as additional leverage to extort payment, other groups likely covertly steal it,” explained Emsisoft. While groups that steal covertly may not exfiltrate as much data as groups seeking to use it as leverage, they may well extract any data that has an obvious and significant market value or which can be used to attack other organizations.”

Ransomware Prevention and Damage Limitation

As long as ransomware attacks remain profitable and relatively low risk, the attacks will continue. Healthcare organizations therefore need to take steps to improve their defenses against attacks. To prevent attacks and limit the harm caused if they are successful, Emsisoft recommends healthcare organizations should patch promptly, limit admin rights, use multi-factor authentication, disable PowerShell when not needed, use web and email filtering, segment the network, and disable RDP if it is not being used… and lock it down if it is. Employees should be provided with regular security awareness training and all vendors that have access to healthcare systems should be audited to make sure they are adhering to best practices.

The post At Least 41 Healthcare Providers Experienced Ransomware Attacks in the First Half of 2020 appeared first on HIPAA Journal.

HHS Adopts Changes to 42 CFR Part 2 Regulations to Improve Care Coordination

Posted by HIPAA Journal

The Confidentiality of Substance Use Disorder Patient Records regulations (42 CFR Part 2) have been revised by the Department of Health and Human Services’ Substance Abuse and Mental Health Services (SAMHSA).

The 42 CFR Part 2 regulations, first promulgated in 1975, were written at a time when there was great concern that information relating to substance use disorder could be used against an individual. The main purpose of 42 CFR Part 2 was to ensure that a person who seeks help and receives treatment for substance use disorder is not placed at any greater risk or is made more vulnerable than a person who does not seek treatment. Under the 42 CFR Part 2 regulations, before information relating to a substance use disorder treatment program can be shared, consent must be obtained from the patient in writing, except in limited circumstances.

42 CFR Part 2 was important at the time and remains so, but a lot has changed since 42 CFR Part 2 took effect. Many healthcare providers find the regulations burdensome, they can hamper care coordination, and can put a patient’s safety at risk.

42 CFR Part 2 protects the privacy of patients, but the regulations often discourage primary care providers from providing care to SUD patients or recording SUD information. In some cases, physicians are required to fill out 11 different kinds of paperwork related to 42 CFR Part 2 and the treatment of SUD records is itself stigmatizing.

Many healthcare industry stakeholders have called for 42 CFR Part 2 regulations to be updated and aligned with HIPAA, which also serves to protect the privacy of patients and ensure the confidentiality of healthcare data.

In 2019, the HHS proposed changes to 42 CFR Part 2 regulations to support care coordination while improving privacy protections for SUD patients. After seeking comment from stakeholders, some of the proposed changes have now been adopted.

The updates do not change the basic framework for the protection of SUD records created by federally funded treatment programs and restrictions are still in place to prevent the use of SUD patient records in criminal prosecution against the patient. Written consent is still required from a patient before their SUD records can be shared, except in very limited circumstances. Records can only be shared with out consent if a court order is received, in a genuine medical emergency, and for the purpose of scientific research, audits, and SUD program evaluations.

The changes align 42 CFR Part 2 more closely with HIPAA and are intended to make it easier for healthcare providers to share SUD records if consent has been obtained from a patient. The changes will help to improve patient safety, support better care coordination, improve claims management and training, and ensure quality improvement, while reducing the burden on healthcare providers.

“This reform will help make it easier for Americans to discuss substance use disorders with their doctors, seek treatment, and find the road to recovery,” said HHS Secretary Alex Azar, in a statement. “Thanks to the valuable input of stakeholders, our final rule will make it easier for Americans to seek and receive treatment while lifting burdens on providers and maintaining important privacy protections.”

Information about the changes and why they have been made are detailed in an HHS fact sheet. The key changes to 42 CFR Part 2 regulations are detailed below:

  • Treatment records created by non-Part 2 providers based on their own patient encounter(s) are explicitly not covered by Part 2, unless any SUD records previously received from a Part 2 program are incorporated into such records. Segmentation or holding a part of any Part 2 patient record previously received can be used to ensure that new records created by non-Part 2 providers will not become subject to Part 2.
  • When an SUD patient sends an incidental message to the personal device of an employee of a Part 2 program, the employee will be able to fulfill the Part 2 requirement for “sanitizing” the device by deleting that message.
  • An SUD patient may consent to disclosure of the patient’s Part 2 treatment records to an entity (e.g., the Social Security Administration), without naming a specific person as the recipient for the disclosure.
  • Disclosures for the purpose of “payment and health care operations” are permitted with written consent, in connection with an illustrative list of 18 activities that constitute payment and health care operations now specified under the regulatory provision.
  • Non-OTP (opioid treatment program) and non-central registry treating providers are now eligible to query a central registry, in order to determine whether their patients are already receiving opioid treatment through a member program.
  • OTPs are permitted to enroll in a state prescription drug monitoring program (PDMP), and permitted to report data into the PDMP when prescribing or dispensing medications on Schedules II to V, consistent with applicable state law.

The post HHS Adopts Changes to 42 CFR Part 2 Regulations to Improve Care Coordination appeared first on HIPAA Journal.

Microsoft Shuts Down COVID-19 Phishing Campaign and Warns of Malicious OAuth Apps

Posted by HIPAA Journal

A large-scale phishing campaign conducted in 62 countries has been shut down by Microsoft.  The campaign was first identified by Microsoft’s Digital Crimes Unit (DCU) in December 2019. The phishing campaign targeted businesses and was conducted to obtain Office 365 credentials. Those credentials were then used to access victims’ accounts to obtain sensitive information and contact lists. The accounts were then used for business email compromise (BEC) attacks to obtain fraudulent wire transfers and redirect payroll.

Initially, the emails used in the campaign appeared to have been sent by an employer and contained business-related reports with a malicious email attachment titled Q4 Report – Dec19. Recently, the phishing campaign changed and the attackers switched to COVID-19 lures to exploit financial concerns related to the pandemic. One of the lures used the term “COVID-19 bonus” to get victims to open malicious email attachments or click malicious links.

When the email attachments were opened or links clicked, users were directed to a webpage hosting a malicious application. The web apps closely resemble legitimate web apps that are often used by businesses to improve productivity and security and support remote workers. Users were requested to grant Office 365 OAuth applications access to their Office 365 accounts.

When permission is granted, the attackers obtained access and refresh tokens that allowed them to gain access to the victims’ Office 365 accounts. In addition to gaining access to contact lists, emails, attachments, notes, tasks, and profiles, they also had access to the SharePoint document management system and OneDrive for Business, and any files in those cloud storage accounts.

Microsoft implemented technical measures to block the phishing emails and filed a civil case in the U.S. District Court for the Eastern District of Virginia to obtain a court order to seize six domains being used by the scammers to host the malicious apps. Recently, the court order was obtained and Microsoft has now disabled the domains. Without access to their infrastructure, the cybercriminals are no longer able to conduct cyberattacks. The campaign is believed to be the work of a cybercriminal organization rather than a nation state-sponsored group.

“This unique civil case against COVID-19-themed BEC attacks has allowed us to proactively disable key domains that are part of the criminals’ malicious infrastructure, which is a critical step in protecting our customers,” explained Microsoft.

Microsoft also shared best practices to help organizations to improve defenses against phishing and BEC attacks. The first step to take is to enable multifactor authentication on all email accounts, both business and personal. Businesses should provide training to employees to teach them how to identify phishing and BEC attacks and security alerts should be enabled for suspicious links and files.

Any email forwarding rules should be checked to identify suspicious activity and organizations should educate staff on how Microsoft permissions and the consent framework works.  Audits should be conducted on apps and consent permissions to ensure that applications are only granted access to the data they need.

The post Microsoft Shuts Down COVID-19 Phishing Campaign and Warns of Malicious OAuth Apps appeared first on HIPAA Journal.

Extent of Magellan Health Ransomware Becomes Clear: More Than 364,000 Individuals Affected

Posted by HIPAA Journal

HIPAA Journal previously reported on an April 2020 ransomware attack on Magellan Health. Further information on the attack has now been released that shows the scale of the attack.

The incident has now been listed on the HHS’ Office for Civil Rights breach portal as affecting 6 Magellan entities, each of which has reported the incident separately. Several other entities have also submitted breach reports confirming their patients and subscribers have also been affected.

It is too early to tell exactly how many individuals have been affected by the ransomware attack, but the total as of July 1, 2020 exceeds 364,000, making the attack the third largest healthcare data breach to be reported in 2020. There may still be some entities that have yet to report the breach.

Entities known to have been impacted by the breach are listed in the table below.

Affected Entity Entity Type Individuals Affected
Magellan Healthcare, Maryland Business Associate 50,410
Magellan Complete Care of Florida Health Plan 76,236
Magellan Rx Pharmacy Healthcare Provider 33,040
Magellan Complete Care of Virginia Health Plan 3,568
Merit Health Insurance Company Health Plan 102,748
National Imaging Associates Business Associate 22,560
University of Florida Jacksonville Healthcare Provider 54,002
University of Florida, Health Shands Healthcare Provider 13,146
University of Florida Healthcare Provider 9,182
Total   364,892

In contrast to many of the healthcare ransomware attacks that have been reported in recent weeks, where access to networks was gained through brute force attacks on remote desktop services or the exploitation of vulnerabilities in VPNs, this attack started with a spear phishing email in which a Magellan client was impersonated. That email was sent on April 6 and the ransomware was deployed less than a week later.

Magellan explained in its substitute breach notification letter sent to the California Attorney General’s Office that the attacker downloaded malware that was designed to steal login credentials and passwords, and gained access to a single Magellan corporate server and stole employee information. The data stolen in the attack related to current employees and included the following data elements: Address, employee ID number, and W-2 or 1099 details such as Social Security number or Taxpayer ID number. For a limited number of employees, usernames and passwords were also obtained.

The notice of security incident on the Magellan Health websites confirms patients of Magellan Health and its subsidiaries and affiliates were also impacted, and the following types of data were exposed: Treatment information, health insurance account information, member ID, other health-related information, email addresses, phone numbers, and physical addresses.  In certain instances, Social Security numbers were also affected.

No mention is made on the June 12, 2020 website notice whether protected health information was also stolen in the attack. In all cases, Magellan Health says no evidence has been uncovered to date to suggest any patient or employee information has been misused.

The post Extent of Magellan Health Ransomware Becomes Clear: More Than 364,000 Individuals Affected appeared first on HIPAA Journal.

UnityPoint Health Proposes $2.8 Million+ Settlement to Resolve Class Action Data Breach Lawsuit

Posted by HIPAA Journal

Des Moines, Iowa-based UnityPoint Health has agreed to settle a proposed class action lawsuit filed by victims of two phishing attacks in 2017 and 2018 that saw the protected health information of 1.4 million patients exposed.

The first phishing attack occurred in November 2017 and was discovered on February 15, 2018. The attackers had access to the email accounts of certain employees of its Madison campus for more than 3 months and potentially obtained the protected health information of approximately 16,429 patients. Patients were notified about the breach in April 2018.

The second phishing attach was much more extensive. The campaign saw a UnityPoint executive impersonated in March 2018, and several employees responded to the message and disclosed their login credentials. The breach was detected in May 2018 and the investigation revealed the compromised email accounts contained the protected health information of 1.4 million patients, making it the second largest healthcare data breach to be reported in 2018.  The attackers had access to the email accounts for almost a month before the breach was detected and email accounts were secured. Notification letters were sent to affected individuals in August 2018.

A lawsuit was filed soon after the announcement about the breach was made. The lawsuit alleged UnityPoint Health mishandled the breach and misrepresented the nature, breadth, scope, harm, and cost of the breach. It was alleged that UnityPoint Health did not notify affected individuals within the 60-day time frame demanded by the HIPAA Breach Notification Rule and when notifications were issued, patients were not informed that their Social Security numbers had been exposed.

In the breach notification letters UnityPoint Health explained that no evidence was found to suggest the protected health information exposed in the attack was or will be used for unintended purposes, suggesting affected patients were not placed at risk. UnityPoint Health also failed to offer breach victims credit monitoring or identity theft protection services, even though Social Security numbers and river’s license numbers had been exposed.

UnityPoint Health attempted to have the lawsuit dismissed and was partially successful. In July 2019, a US District Court Judge partially dismissed some of the claims in the lawsuit, although other claims were allowed to proceed. The judge ruled that the plaintiffs’ alleged facts sufficient to establish there was an objectively reasonable likelihood of future identity theft.

A settlement was proposed on June 26, 2020 to resolve the lawsuit and will provide victims with monetary and injunctive relief. Under the terms of the proposed settlement, UnityPoint Health has agreed to make a minimum of $2.8 million available to class members to cover claims. Each affected individual can submit a claim of up to $1,000 to cover documented ordinary out-of-pocket expenses such as credit monitoring and identity theft protection services, and up to 3 hours in lost time charged at $15 per hour.

A claim of up to $6,000 can be made per person to cover extraordinary expenses which includes documented out-of-pocket expenses and up to 10 hours per person at $15 per hour for time lost arranging credit monitoring services, credit freezes, and other actions taken as a result of the breach.  In contrast to most data breach settlements, UnityPoint Health has not placed a cap on extraordinary expenses claims, so UnityPoint Health will cover actual losses if breach victims submit a valid claim. All victims will also be entitled to a year’s membership to credit monitoring and identity theft protection services and will be protected by a $1 million insurance policy against identity theft. The credit monitoring services and insurance policy are estimated to cost around $200 per class member.

The four breach victims named in the lawsuit will also be entitled to claim an additional $2,500 per person. The full costs of notice and claims administration and attorney fees will be paid by UnityPoint Health up to a maximum value of $1.58 million.

UnityPoint Health has also agreed to make improvements to network and data security and will undergo an annual audit by a third-party security firm to ensure that security measures are adequate, and the healthcare provider is complying with its security policies.

Given the lack of a cap on claims, this could turn out to be one of the largest ever healthcare data breach settlements. The settlement will now need to be approved by a judge and could be finalized by the end of the year.

The post UnityPoint Health Proposes $2.8 Million+ Settlement to Resolve Class Action Data Breach Lawsuit appeared first on HIPAA Journal.

May 2020 Healthcare Data Breach Report

Posted by HIPAA Journal

May 2020 saw a marked fall in the number of reported healthcare data breaches compared to April, with 28 data breaches of 500 or more records reported to the HHS’ Office for Civil Rights. That is the lowest number of monthly breaches since December 2018 and the first time in 17 months that healthcare data breaches have been reported at a rate of less than one per day. The monthly total would have been even lower had one breach been reported by the business associate responsible for an improper disposal incident, rather than the 7 healthcare providers impacted by the breach.

Several cybersecurity companies have reported an increase in COVID-19-related breaches, such as phishing attacks that use COVID-19-themed lures. While there is strong evidence to suggest that these types of attacks have increased since the start of the pandemic, the number of cyberattacks appears to have broadly remained the same or increased slightly. Microsoft has reported that its data shows a slight increase in attacks, but says it only represents a blip and the number of threats and cyberattacks has changed little during the pandemic.

Threat activity does not appear to have dropped, so the fall in reported cyberattacks and data breaches could indicate that threat actors have taken the decision not to attack healthcare providers on the front line in the fight against COVID-19. The Maze ransomware gang publicly stated that it would not target healthcare providers during the COVID-19 pandemic, but many other ransomware gangs appear to have stepped up their attacks and are making no such concessions.

It is also possible that rather than cyberattacks and data breaches falling, covered entities and business associates have not been detecting breaches or have delayed reporting. The reason for the fall in reported breaches is likely to become clearer over the coming weeks and months and we will see if this is part of a new trend or if the drop is simply a blip.

While it is certainly good news that the number of breaches has fallen, there was a significant increase in the number of exposed and compromised healthcare records. There were 10 fewer data breaches reported in May 2020 than April, but 1,064,652 healthcare records were breached in May. That is more than twice the number of records breached in April.

Largest Healthcare Data Breaches in May 2020

Name of Covered Entity State Covered Entity Type Individuals Affected Type of Breach
Elkhart Emergency Physicians, Inc. IN Healthcare Provider 550,000 Improper Disposal
BJC Health System MO Business Associate 287,876 Hacking/IT Incident
Saint Francis Healthcare Partners CT Business Associate 38,529 Hacking/IT Incident
Everett & Hurite Ophthalmic Association PA Healthcare Provider 34,113 Hacking/IT Incident
Management and Network Services, LLC OH Business Associate 30,132 Hacking/IT Incident
Sanitas Dental Management FL Healthcare Provider 19,000 Loss
Mediclaim, LLC MI Business Associate 14,931 Hacking/IT Incident
Woodlawn Dental Center OH Healthcare Provider 14,419 Hacking/IT Incident
Mat-Su Surgical Associates, APC AK Healthcare Provider 13,146 Hacking/IT Incident
Mille Lacs Health System MN Healthcare Provider 10,630 Hacking/IT Incident

Causes of May 2020 Healthcare Data Breaches

The largest healthcare data breach of the month affected Elkhart Emergency Physicians, Inc. and involved the improper disposal of paper records by business associate Central Files Inc. Elkhart Emergency Physicians was one of seven Indiana healthcare providers to be affected by the breach. In total, the records of 554,876 patients were exposed as a result of that improper disposal incident. There was one other improper disposal incident reported in May, making this the joint second biggest cause of data breaches in the month. Those improper disposal incidents accounted for 52.17% of breached records in May. The mean breach size was 69,434 records and the median breach size was 938 records.

There were 8 reported unauthorized access/disclosure incidents reported, although those breaches only accounted for 2.35% of breached records in May. The mean breach size was 3,124 records and the median breach size was 3,220 records.

Hacking/IT incidents once again topped the list as the main cause of healthcare data breaches, accounting for 39.28% of the month’s breaches and 43.69% of breached records in May. The mean breach size was 42,290 records and the median breach size was 14,419 records.

There was one loss incident involving a network server that contained the records of 19,000 patients. There were no reports of theft of physical records or devices containing electronic protected health information.

The graph below shows the location of breached protected health information. For the past several months, email has been the most common location of breached PHI due to the high number of healthcare phishing attacks. The number of reported phishing attacks dropped in May, hence the lower than average number of email-related breaches. While the number of incidents fell, there was one major phishing attack reported. An attack on BJC Health System saw 3 email accounts compromised. Those accounts included emails and attachments containing the PHI of 287,876 patients.

May 2020 Healthcare Data Breaches by Covered Entity Type

In line with virtually every other month since the HITECH Act mandated the HHS’ Office for Civil Rights to start publishing summaries of data breaches on its’ Wall of Shame’, healthcare providers were hardest hit, with 21 reported data breaches. It was a good month for health plans, with only one reported breach, but a particularly bad month for business associates. 6 business associates reported data breaches in May, and a further 8 breaches involved business associates but were reported by the covered entity.

Healthcare Data Breaches by State

Data breaches were reported by covered entities and business associates in 17 states in May. Indiana was the worst affected state with 7 reported breaches of 500 or more records, all of which were due to the improper disposal of records by business associate, Central Files, Inc.

There were 3 data breaches reported in each of Michigan and Ohio, two breaches reported by healthcare providers in Pennsylvania, and one breach was reported in each of Alaska, Arizona, California, Connecticut, Florida, Georgia, Illinois, Maryland, Minnesota, Missouri, Nebraska, New York, and Texas.

HIPAA Enforcement Activity in May 2020

There were no announcements about HIPAA penalties from the HHS’ Office for Civil Rights or state attorneys general in May 2020.

The post May 2020 Healthcare Data Breach Report appeared first on HIPAA Journal.