Cyberattacks against hospitals increased over 1000% last year : cybersecurity IICS Delhi Ethical Hacking Digital Forensics services
Source: Cyberattacks against hospitals increased over 1000% last year
What happens when hackers attack a hospital?
 
|
 
|
May 27 2019
Cyberattacks against hospitals increased over 1000% last year
Jul 20 2011
8 tactics for mobile data privacy and security
By Mary Mosquera
With the sweeping use of mobile devices by healthcare providers, physicians and hospitals need to embrace best practices for protecting sensitive patient data, privacy experts say. For example, encrypt sensitive data when it is necessary to store on wireless devices.
Sixty-four percent of physicians own a smartphone and one third of them have an iPad, with another 28 percent planning to buy one within six months, according to research cited by ID Experts, which offers data protection and response services, in a July 20 announcement
Many of the current 10,000 mobile healthcare applications were designed to enable their users to access to electronic health records (EHRs). At the same time, in the past two years, the Office of Civil Rights has reported that 116 data breaches of 500 records or more were the direct result of the loss or theft of a mobile device and led to the exposure of the personal health information of 1.9 million patients, which started many consumers questioning the security of EHR systems and the data they house.
The Office of Civil Rights oversees health information privacy in the Health and Human Services Department and publishes on its website incidents involving the sensitive information of at least 500 individuals.
To more effectively protect patient data, Rick Kam, president of ID Experts recommended the following practices:
1. Donât store sensitive data on wireless devices. If required, encrypt data.
2. Enable password protection on wireless devices and configure the lock screen to come on after a short period of inactivity.
3. Turn on the âremote wipeâ feature of wireless devices.
4. Enable Wi-Fi network security. Do not use wired equivalent privacy (WEP). Wi-Fi protected access (WPA-1) with strong passphrases offers better security. Use WPA-2 if possible.
5. Change the default service set identifier (SSID) and administrative passwords.
6. Donât transmit your wireless routerâs SSID.
7. Only allow devices to connect by specifying their hardware media access control (MAC) address.
8. Establish a wireless intrusion prevention system.
âMany Wi-Fi networks in hospitals and doctorâs offices are not secure,” Kam cautioned, “and coupled with the increased mobile device usage, patient data is at risk.”
Apr 04 2011
HIPAA poses greatest compliance challenges for information security
The Health Insurance Portability and Accountability Act (HIPAA) is the most challenging information security regulation for businesses to implement, according to a survey by IT management products firm Ipswitch.
According to an Ipswitch survey of 100,000 network administrators, 38.2% said that HIPAA was the most challenging information security regulation to implement, followed by the Sarbanes-Oxley Act with 29.3% and the Federal Information Security Management Act with 9.3%.
âEnterprises, financial institutions and health care providers are under intense scrutiny to protect the confidential information of their patients and clientsâ, said Ennio Carboni, president of Ipswitchâs Network Management Division. âRegulations are updated regularly, as are the hackersâ and thievesâ methods of exploiting them.â
Kurt Johnson, VP of strategy and corporate development at identity access management product firm Courion, noted that the Department of Health and Human Servicesâ HIPAA checklist is quite extensive.
âThe overwhelming majority of those checklist items for IT are doing things such as establishing user access for new and existing employees, understanding individuals and contractors with access to electronic health information, terminating user access, and monitoring system use to see what is authorized and not authorizedâ, he told Infosecurity.
A major driver of HIPAA compliance is the health care industryâs move to electronic patient records. âYou have this perfect storm brewing where youâve got more electronic health information available than ever before, youâve more people needing that dataâŠand more electronic devices [to share the information] than ever beforeâ, Johnson said.
In addition, âdoctors are a pretty tough user base to deal with. They are well educated and think they know more about everything than anybody else, and that includes ITâŠ.So if you put too much security in front of them, they are going to subvert that processâŠin the name of patient care”, he observed.
âThe need for the medical community to share information in the name of patient care has given rise to a lot of security issues, such asâŠhow from an IT security perspective do we put the proper controls in place to ensure that the people accessing the information have that need to knowâŠwhile at the same time keeping out the people who donât need itâ, Johnson said.
The revision of the HIPAA rules and the passage of the Health Information Technology for Economic and Clinical Health (HITECH) Act in 2009 have increased the regulatory compliance burden on organizations, Johnson observed. First, the changes have increased enforcement and fines. Second, the disclosure requirements for patient data breaches have been expanded significantly.
âIf there is a breach, it has to be disclosed, not only to the individual, but via a media outletâŠ.The requirement to notify is a significant concern to the hospital because they donât want their name broadcast on the news due to a patient privacy violationâ, he concluded.
This article is featured in:
Compliance and Policy âą Data Loss âą Identity and Access Management
Nov 30 2010
Due diligence is the cost of doing business for healthcare
According to an estimates, the Healthcare in US may be vulnerable to $6 billion annually from data losses in various forms.
A survey done by the privacy and data-management firm Ponemon Institute found that Healthcare organizations are still using primitive data management techniques and run the risk of spending an average of US $1 million per year dealing with data losses. These can be in the form of damage control, litigation and loss of revenue from clients transferring to other facilities, among others.
From October 2009 to March 2010, patient information from insurance company WellPoint was accessible to the public through its website, revealing information on 32,000 new clients. Meanwhile, insurance company AmeriHealth Mercy recently admitted to misplacing a USB drive that contained information for 280,000 Medicaid members.
Data included full names, birth dates, addresses, SSNs, telephone numbers, email addresses, financial information, and health records. Patients risk suffering public embarrassment and identity theft, which can be used for both medical and financial purposes.
Build your own Information Secrity Management System which cover the HIPAA controls, basic due diligence for information security and privacy controls will pay its dividend in the long run and simply is the cost of doing business for healthcare industry.
Jul 05 2010
Risky business
- Image by purpleslog via Flickr
By Mary Mosquera
Last yearâs HITECH Act toughened the rules and enforcement penalties health information handlers must follow to protect patient privacy.
Under the new policy regime, providers will have to pay more attention to the confidentiality and safety of patient information as they move more of their operations toward electronic health record-keeping.
Without sound security policies and practices, privacy âwill be just a principle,â said Sue McAndrew, deputy director for privacy in the Office of Civil Rights, the Health and Human Services Department office that was given responsibility for health privacy and security policy under the new law.
OCR-draft-guidelines-for-security-risk-analysis
âWe want it to be a reality for consumers,â she said at a recent privacy and security conference sponsored by OCR and the National Institute for Standards and Technology.
One of the most basic requirements is that providers must now perform a security assessment, a first step in understanding systems and electronic data over which they are temporary stewards.
OCR recently drafted guidance to help providers and payers figure out what is expected of them in doing a risk assessment. While it might sound onerous, a risk assessment might not be as difficult or costly as some providers might believe, even for small practices, privacy.
âWhen you say, âdo a security risk assessmentâ, peopleâs eyes glaze over,â said Lisa Gallagher, security director of privacy and security for the Healthcare Information and Management Systems Society. âBut really, itâs asking, âwhat are the risk areas?â, âhow could someone get to it?â and âwhat controls can you put in place to protect it.ââ
In its guidance, OCR said organizations should identify and categorize their data collections, document threats to information that might lead to a disclosure of protected data and check to see if their current security measures are adequate.
âFor a small organization, it sounds overwhelming and time-consuming, but in a lot of ways, itâs things that they already do,â said Pat Toth, a computer scientist in NISTâs computer security division.
âWhat small providers need to do is get an understanding of the framework and break down each step,â she said. âIt is something thatâs going to be living in their organization, so if they do their categorization and get that right, it will set the correct tone for the rest of the process.â
NIST has developed a quick-start guide, a âCliffâs Notesâ of its security publications detailing its risk management framework and risk assessment, in addition to frequently asked questions, to help providers, especially small practices.
For large organizations, risk management starts in the planning and architecture of systems across the enterprise and system life cycle, Toth said.
Besides a risk assessment, OCR is planning stricter reporting of disclosures of health information when electronic health records are used, even when the disclosure is for treatment and billing purposes. Providers will also have to give the reason for the disclosure. In May, OCR published a request for comments on its rulemaking.
The most effective method of accounting for disclosures is by using automated logging features in electronic health records and other computer systems, according to Mac McMillan, chief executive officer of Cynergistek Inc., an IT security consulting firm.
System logs are used to document and maintain a permanent record of all authorized and unauthorized access to and disclosure of confidential information so providers can recover evidence of that access.
âA lot of the difficulty to get accounting of disclosures in place is because of a lack of industry auditing capabilities,â he said at the OCR and NIST conference. âMost systems donât have the functionality.â Moreover, IT security folks he works with have logging activated, âbut they are still manually digesting them,â McMillan said, adding that manual audits are a time-consuming and imprecise process.
Even so, such practices must now be the order of the day under the new privacy and security framework. âThe security rule says wherever you have electronic health information, you need to protect it,â said HIMSSâs Gallagher. âYou may not even apply for meaningful use incentives. But if youâre keeping data in electronic form, you have to comply with the security rule.â
Related articles
hitech-act-increases-hipaa-security-requirements
healthcare-organizations-may-not-be-prepared-for-hitech-and-other-security-challenges
Related articles by Zemanta
- NIST Releases Revised Assesment Guide Targeting Federal Information Security Controls (infosecurity.us)
- OCR draft guidelines for security risk analysis (deurainfosec.com)
- Ben Rothke – Effective Data Destruction Practices (slideshare.net)
- HHS publishes new guidance on conducting risk analysis (securityarchitecture.com)
Jun 30 2010
Security glitch exposes WellPoint data again
- Image via Wikipedia
By Tom Murphy
INDIANAPOLIS â WellPoint Inc. has notified 470,000 individual insurance customers that medical records, credit card numbers and other sensitive information may have been exposed in the latest security breach of the health insurer’s records.
The Indianapolis company said the problem stemmed from an online program customers can use to track the progress of their application for coverage. It was fixed in March.
Spokeswoman Cynthia Sanders said an outside vendor had upgraded the insurer’s application tracker last October and told the insurer all security measures were back in place.
But a California customer discovered that she could call up confidential information of other customers by manipulating Web addresses used in the program. Customers use a Web site and password to track their applications.
WellPoint learned about the problem when the customer filed a lawsuit about it against the company in March.
“Within 12 hours of knowing the problem existed, we fixed it,” said Sanders, who declined to identify the outside vendor.
WellPoint is the largest commercial health insurer based on membership, with nearly 34 million members. It runs Blue Cross Blue Shield plans in 14 states and Unicare plans in several others.
Sanders said the insurer notified customers in most of its states. That includes about 230,000 customers of its Anthem Blue Cross subsidiary in California.
About 356 million records of U.S. residents have been compromised or exposed due to security breaches since 2005, according to Privacy Rights Clearinghouse, a consumer advocacy group that tracks such reports.
WellPoint’s security breach doesn’t crack the top 10 in terms of number of people who may have had information exposed, said Paul Stephens, the organization’s director of policy and advocacy. Even so, he labeled the breach “very serious” because it possibly involved both financial and medical information.
“There are obviously multiple concerns there for consumers,” he said.
Two years ago, WellPoint offered free credit monitoring after it said personal information for about 128,000 customers in several states had been exposed online. In 2006, backup computer tapes containing the personal information of 200,000 of its members were stolen from a Massachusetts vendor’s office.
WellPoint’s latest breach affected only individual insurance customers and not group coverage or people who buy Medicare Advantage insurance. Sanders said the company believes a “vast majority” of the unauthorized access of customer information came from the plaintiff and her attorneys.
The insurer notified all individual insurance customers who had information in its application tracking program from October through March. It will provide a year of free credit monitoring.
WellPoint shares fell 69 cents to $50.10 in Tuesday afternoon trading, while broader trading indexes slid more than 2 percent.
Related articles and books
- Online security glitch exposes sensitive customer information of health insurer WellPoint (taragana.com)
- Security glitch exposes WellPoint customer data (sfgate.com)
May 11 2010
OCR draft guidelines for security risk analysis
- Image by veeliam via Flickr
The Health & Human Services Department published draft guidance to help healthcare providers and payers figure out what is expected of them in doing a risk analysis of their protected patient health information.
The security rule of the Health Insurance Portability and Accountability Act (HIPAA) requires that providers, payment plans and their business associates perform a risk assessment, but does not prescribe a method for doing so, according to draft guidance from HHSâ Office of Civil Rights (OCR). The HITECH Act directed that OCR oversee health information privacy.
Risk analysis is a technique used to identify and assess threats and vulnerabilities that may hamper the success of achieving bsuiness goals. In risk analysis determines if the security controls are appropriate compare to the risk presented by the impact of threats and vulnerabilities.
The guidance is not intended to provide a one-size-fits-all blueprint for compliance with the risk analysis requirement. Rather, it clarifies the expectations of the Department for organizations working to meet these requirements. An organization should determine the most appropriate way to achieve compliance, taking into account the characteristics of the organization and its environment.
Some of the content contained in this guidance is based on recommendations of the National Institute of Standards and Technology (NIST), OCR said
OCR guidance document explains several elements a risk analysis must incorporate, regardless of the method employed. So basically the auditor will be looking for all the elements required by the guidelines during an audit.
Information Security Risk Analysis, Tom Peltier
Apr 12 2010
Healthcare ID theft may rise with digital records
By Margaret Collins BLOOMBERG NEWS
Sierra Morgan was billed $12,000 on her health care credit card in November for liposuction, a procedure she never requested or received.
“It’s depressing to know that someone used my name and knows so much about me,” said Morgan, 31, a respiratory therapist from Modesto, Calif.
There were more than 275,000 cases in the U.S. last year of medical information theft, twice the number in 2008, according to Javelin Strategy & Research, a market research firm. The average fraud cost $12,100, Javelin said.
“A trend we’ve seen over the past few years is using stolen information to file false claims,” said Louis Saccoccio, executive director of the National Health Care Anti-Fraud Association, a nonprofit research group.
Criminals set up fake clinics to bill for phony treatments, said Pam Dixon, founder of the World Privacy Forum, a nonprofit consumer-research group based in San Diego, which has worked with more than 3,000 victims. Thieves also may impersonate a patient, as in Morgan’s case, and some medical workers download records to sell, she said.
The economic stimulus bill of 2009 includes $2 billion to create a national system of computerized health records and as much as $27 billion over 10 years in payments to Medicare and Medicaid providers who adopt the technology, according to the Department of Health and Human Services. The digital files will improve care and help lower costs, the government said, without projecting savings.
“Once files are in electronic form, the crime scales up quickly,” said Dixon, whose group analyzed a decade of consumer data from the Federal Trade Commission and medical identity theft cases from the Department of Justice.
“There are cases where someone has walked out with thousands and thousands of files on a thumb drive,” she said. “You can’t do that with paper files.”
Patients’ medical records are altered to reflect diseases or treatments they never had, which can be life-threatening if they receive the wrong treatment or find their health insurance exhausted, Dixon said. A thief may change the billing address for a victim’s insurance so they’re unaware of charges, she said.
“Once you aggregate and put data in one place, it’s easier for you to see it, but it’s also easier for a criminal to see and use it,” said Scott Mitic, chief executive of TrustedID, a consumer data-protection firm. “The digitization of medical records over the next years is certainly going to make this more of an issue.”
Fraud at a high cost
Brandon Sharp, 38, found more than $100,000 of unpaid medical bills on his credit report when he went to buy a home. The charges included $19,501 for a life-flight helicopter trip and emergency room visits he never used, said Sharp, a project manager for a Houston-based oil company.
“I’m as healthy as they come,” he said.
Sharp said he spent six to nine months correcting his medical files, outstanding charges and credit report.
Medical identity theft is about 2œ times more costly than other types of ID frauds, said James Van Dyke, president of Javelin, in part because criminals use stolen health data an average of four times longer than other identity crimes before the theft is caught.
The average fraud involving health information was $12,100, compared with $4,841 for all identity crimes last year, and consumers spent an average of $2,228 to resolve it, or six times more than other identity fraud, according to Javelin.
“It’s becoming the credit card with a $1 million limit,” said Jennifer Leuer, general manager of ProtectMyID.com, an identity-protection service provided by Experian PLC, a credit reporting firm. “If the health insurance is valid, they’ll treat you and not always check your ID.”
Insurers are improving technology to spot false claims, said Tom McGraw, a senior vice president at Ingenix, a subsidiary of UnitedHealth Group Inc. McGraw leads a group focusing on fraud involving Medicaid and Medicare, the two government-sponsored health programs for the poor and the elderly, he said. The company can now track distances between providers and beneficiaries to identify whether physicians are treating patients who don’t live nearby, he said.
Legislation passed last year requires doctors and hospitals to notify patients when their information has been exposed from a security breach, said Randy Sabett, co-chairman of the Internet and data protection practice at Sonnenschein Nath & Rosenthal, based in the law firm’s Washington office.
Related articles by Zemanta
- Stealing Your Identity for Liposuction (businessweek.com)
- Guard Your Health Insurance Card (bucks.blogs.nytimes.com)
- Credit Card Fraud Now Comprises 75% of ID Crime Cases (pindebit.blogspot.com)
Apr 07 2010
NorCal’s John Muir hospital warns of breach
- Image by Sparticus via Flickr
The Associated Press
Posted: 04/06/2010 08:31:15 AM PDT
WALNUT CREEK, Calif.âMore than 5,000 patients in the John Muir hospital system have been warned of a potential security breach after two laptop computers that contained personal and health information were stolen.
The laptops were stolen from a perinatal office in Walnut Creek in February. The 5,450 potentially affected patients were sent letters Monday. Hospital officials say there have been no reports that patient information has been accessed.
John Muir Health vice president and privacy officer, Hala Helm, says the laptops were password-protected and contained data in a format that would not be readily accessible.
Officials have arranged free identity theft protection for a year and recommend people place a fraud alert on their credit files.
âââ
Information from: Contra Costa Times
Related articles by Zemanta
Mar 02 2010
HITECH Act increases HIPAA security requirements
by Marcia Savage
The health care industry was buzzing with the news: For the first time ever, a hospital was being audited for compliance with HIPAA security requirements. The audit of Piedmont Hospital in Atlanta by the U.S. Department of Health and Human Services’ inspector general in 2007 was surprising for hospitals, health insurers and others in an industry accustomed to a lack of enforcement of federal privacy and security requirements.
A year later, HHS took another unusual step, meting out a $100,000 fine to Seattle-based Providence Health & Services for HIPAA security and privacy violations. The organization had lost backup tapes, optical disks and laptops containing unencrypted protected health information on more than 360,000 patients.
But those enforcement actions could be small potatoes compared to what’s ahead. The Health Information Technology for Economic and Clinical Health (HITECH) Act, part of the American Recovery and Reinvestment Act signed into law last year, earmarks about $19 billion in incentives to encourage adoption of electronic health record technology but also expands on HIPAA’s security and privacy requirements. In addition to instituting new breach notification rules and extending the rules to health care business associates, HITECH implements a new tiered system that increases civil monetary penalties for noncompliance and also allows state attorney generals to file civil actions for HIPAA violations.
“HITECH is perceived as the enforcement arm of HIPAA,” says Barry Runyon, research vice president covering health care providers at Gartner. “The stakes are higher and more people can enforce it.
“What it’s done has kind of jump started HIPAA. Health care delivery organizations’ programs languished for a while,” he adds. “When there’s no enforcement, people tend to get complacent. HITECH is making them revisit their security plans and look at their controls — essentially what they should have been doing.”
Let’s take a look at the ramifications of the HITECH Act on security and privacy in the health care industry and its impact so far.
To read further on HITECH Act increases HIPAA security requirements
Feb 03 2010
UCSF laptop containing patient files stolen
- Image via Wikipedia
The Associated Press
SAN FRANCISCOâThe medical records of more than 4,000 patients at the University of California, San Francisco may have been compromised after a laptop they were on was stolen.
Officials with the university said Wednesday the laptop was recovered earlier this month after it was taken from a medical school employee during a flight in November. It does not appear that anyone gained access to the computer or the confidential patient information, but officials say the records still could have been exposed.
The files contained patients’ names, medical record numbers, ages and clinical information, but no Social Security numbers or financial data.
School officials say they are notifying the 4,400 patients whose records were on the computer. They were all treated in 2008 and 2009.
âââ
Information from: San Francisco Chronicle, http://www.sfgate.com/chronicle
Here we have another unnecessary major security breach in a large healthcare organization which resulted in a loss of patient data demonstrating poor baseline security. They clearly are not ready for the new HIPAA provision ARRA and HITECH. Evaluate your current business and system risks to make sure this does not happen to you.
Contact DISC for any question if you think, this may apply to you.
The Practical Guide to HIPAA Privacy and Security Compliance
Related articles by Zemanta
- UCSF Doc Falls for Phishing Scam, Exposes Patient Data (blogs.wsj.com)
- Physician Practices Gain EHR Connectivity, Interoperability with New McKesson Offering (eon.businesswire.com)
Dec 16 2009
Internet security breach found at UCSF
- Image via Wikipedia
By Erin Allday, SF Chronicle
Hackers may have had access to personal information for about 600 UCSF patients as a result of an Internet “phishing” scam, campus officials said Tuesday.
The security breach occurred in September when a faculty physician in the UCSF School of Medicine provided a user name and password in response to a scam e-mail message. The e-mail had been sent by hackers and made to look as though it came from UCSF workers who are responsible for upgrading security on internal computer servers.
The university is not identifying the physician.
A UCSF audit in October found that e-mails in the physician’s account included personal information about patients, including demographic and clinical data, and the Social Security numbers of four patients. It is unknown whether hackers actually accessed the e-mails.
The patients have all been notified of the security breach.
Phishing scams are designed to get people to reveal private information – such as Social Security numbers, credit card information and passwords – when they reply to e-mails that pretend to come from legitimate organizations.
For years, financial institutions and other corporations have been educating people to be cautious of such scams and wary of revealing private information on the Internet.
In response to the latest scam, UCSF officials said the university has been re-educating employees about protecting their user names and passwords.
Here we have another unnecessary healthcare data breach in a university due to phishing which resulted in a loss of private data demonstrating poor baseline security and lack of security awareness training. Healthcare organizations are not ready for HIPAA (ARRA and HITECH provision) compliance. Checkout why Healthcare Organizations May Not Be Prepared for HITECH and Other Security Challenges
Review my threats page and evaluate your current business and system risks to make sure this does not happen to you.
Considering healthcare standard electronic transaction (compliance date, Jan 1, 2012) and HITECH provision (compliance date, Feb 17, 2010) are in the pipeline for healthcare organizations. Do you think itâs about time for them to get their house in order?
Related articles by Zemanta
- Verified by Visa Phishing Scam (pindebit.blogspot.com)
- Sophisticated phishing attack and countermeasures (deurainfosec.com)
![Reblog this post [with Zemanta]](https://img.zemanta.com/reblog_e.png?x-id=8658a587-5ff8-42f6-b7db-7381231e3471)
Nov 19 2009
Health Net healthcare data breach affects1.5 million
- Image via Wikipedia
Here we have another unnecessary major security breach in a large healthcare organization which resulted in a loss of patient data demonstrating poor baseline security. They clearly are not ready for the new HIPAA provision ARRA and HITECH. Review my threats page and evaluate your current business and system risks to make sure this does not happen to you.
Contact DISC for any question or high level risk assessment.
The Practical Guide to HIPAA Privacy and Security Compliance
By Robert Westervelt, News Editor
19 Nov 2009 | SearchSecurity.com
Health Net Inc. announced Wednesday that it is investigating a healthcare data security breach that resulted in the loss of patient data, affecting 1.5 million customers.
The Woodland Hills, Calif.-based managed healthcare provider said the lost files, a mixture of medical data, Social Security numbers and other personally identifiable information, were collected over the past seven years and contained on a portable external hard drive, which was lost six months ago. The company said the healthcare data was not encrypted, but was formatted as images and required a specific software application to be viewed. The hard drive contained data on 446,000 Connecticut patients.
The company reported the breach Wednesday to State Attorneys Generals offices in Arizona, Connecticut, New Jersey and New York. Health Net said it was beginning the data security breach notification process of sending out letters to its customers. The company said it expects to send notification letters the week of Nov. 30.
Connecticut Attorney General Richard Blumenthal said he was investigating the matter and why it took Health Net six months to report the healthcare breach.
“My investigation will seek to establish what happened and why the company kept its customers and the state in the dark for so long,” Blumenthal said in a statement. “The company’s failure to safeguard such sensitive information and inform consumers of its loss — leaving them naked to identity theft — may have violated state and federal laws.”
Blumenthal said the hard drive also contained financial data, including bank account numbers. He is seeking coverage for comprehensive, long-term identity theft protection for those customers affected by the breach.
Health Net provides medical coverage for approximately 6.6 million people and its subsidiaries operate in all 50 states. In a statement, the company said the breach took place in its Connecticut office. So far there have not been any reports of fraud tied to the missing data..
“Health Net will provide credit monitoring for over two years – free of charge – to all impacted members who elect this service, and will provide assistance to any member who has experienced any suspicious activity, identity theft or health care fraud between May 2009 and their date of enrollment with our identity protection service,” the company said.
It is the second time in a month that a healthcare provider lost customer data. Anthem Blue Cross and Blue Shield of Connecticut reported a stolen laptop was to blame for a breach compromising the personal information of 850,000 doctors, therapists and other healthcare professionals.
Security experts have long been advocating that enterprises deploy encryption on laptops and other devices that contain sensitive data. Still, all the technology in the world won’t end employee mistakes and carelessness, said Mike Rothman an analyst with Security Incite.
“You can do full disk encryption and all sorts of things to protect the device, but you are still fairly constrained by user sophistication,” Rothman said. “You have to start asking questions from a process standpoint relative to why this stuff was on an external drive in the first place.”
In reality you could turn off all USB ports on your devices, but that could hinder employee productivity, Rothman said. Security always gets back to making sure you have the right processes and policies in place and the right training and awareness so that employees understand what those policies are and ways to audit those processes, he said.
Experts say encryption should be used as a last resort when all other security policies and processes fail. While many enterprises have focused on encrypting laptops at the endpoint, encryption can be a bit trickier for portable hard drives and other removable media. If the drive is being shared between different systems people need to have some way to access the key, said Ramon Krikken, an analyst at the Burton Group.
“A lot of these portable hard drives are older without built-in encryption and to the extent to which you can easily deploy encryption has been a challenge for enterprises,” Krikken said.
Some USB makers market the devices with built-in encryption software. In 2008, Seate Technology extended full disk encryption technology to all its enterprise-class hard drives. The company also began pushing for standards for hard drive encryption in storage systems.
Nagraj Seshadri, head of product marketing at Utimaco the encryption software division of Sophos Plc, said healthcare organizations need to be just as responsible as financial firms when it comes to protecting data.
Perhaps healthcare management still doesnât realize that they might be potentially liable for lack of reasonable safeguards to protect organization assets. Do you think itâs time for healthcare management to take information security seriously as a potential business risk?
Related articles by Zemanta
- New HealthCare Data Breach Program Begins September 23rd (ducknetweb.blogspot.com)
- ARRA – HITECH: Health Care Information Breach Notification Regulations Now In Effect (healthcarebloglaw.blogspot.com)
- Son of HIPAA Breach Notification Rules and Business Associate Requirements: Who’s Ready? (healthblawg.typepad.com)
- Laptop Heist Exposes Doctors’ Personal Data (deurainfosec.com)
- HIPAA Enforcement Meets HITECH: HIPAA Administrative Simplification: Enforcement Rule (healthcarebloglaw.blogspot.com)
![Reblog this post [with Zemanta]](https://img.zemanta.com/reblog_e.png?x-id=3c10bd6a-b0f4-49a0-9a48-affdd3288b52)
Nov 06 2009
Laptop Heist Exposes Doctors’ Personal Data
Another stolen laptop puts thousands of people’s personal data at risk but this time it’s the caregivers — not the patients — who are at risk.
November 6, 2009
By Larry Barrett:
More than 10,000 physicians’ and dentists’ personal data was exposed last week in New Hampshire after an employee at Anthem Blue Cross and Blue Shield transferred the health care providers’ Social Security numbers and other data to a personal laptop that was later stolen.
Anthem spokesman Christopher Dugan said the security breach took place at the national level and the files did not include any patients’ personal data.
The Blue Cross Blue Shield Association said the employees’ ill-fated decision to transfer the sensitive information to a personal laptop violated the insurer’s security policies.
Just last week, more than 33,000 patients receiving care from a Daytona Beach, Fla. medical center were notified that their data may have been compromised when a laptop was stolen from an employee’s car.
New Hampshire is one of 43 states that require companies and organizations to notify people when their personal or financial information is accidentally or deliberately compromised.
Anthem officials said it will provide free credit-monitoring services to all the affected physicians and dentists for a year.
It’s not been the best of months for the insurer.
On Oct. 5, Blue Cross warned another 39,000 doctors that a yet another laptop stolen from the company’s Chicago headquarters could have potentially exposed an assortment of personal information including Social Security numbers and tax identification numbers.
A Ponemon Institute by Traverse City, Mich.-based data security researcher Ponemon Institute estimates that more than 12,000 laptops are stolen or lost at airports alone each week.
It also found that the average large company has 640 laptops, 1,985 USB memory sticks, 1,075 smart phones and 1,324 other various data devices stolen or lost each year — ;a total of 800,000 data-sensitive memory devices a year.
![Reblog this post [with Zemanta]](https://img.zemanta.com/reblog_e.png?x-id=9a6ac4f3-959e-410b-bf21-c3cde3da50b9)
Nov 03 2009
Healthcare Organizations May Not Be Prepared for HITECH and Other Security Challenges
Healthcare Organizations May Not Be Prepared for HITECH and Other Security Challenges
HIMSS News
The Healthcare Information and Management Systems Society releases its 2nd Annual Security Survey, sponsored by Symantec
CHICAGO (November 3, 2009) – With the American Recovery and Reinvestment Act underway, healthcare organizations face new challenges to maintain privacy and security of patient health data. However, data gathered from healthcare IT and security professionals indicate that many organizations may not be ready to meet some of the HITECH components of the ARRA legislation and other security challenges, according to the results of the 2009 HIMSS Security Survey, sponsored by Symantec Corp. (Nasdaq: SYMC).
While healthcare organizations recognize that patient data must be protected, the survey results show that:
In addition, the survey reveals that healthcare organizations are not using the current security technologies available to keep patient data safe. Respondents to this survey widely use audit logs with data from firewalls, application logs and server logs as common information sources. Yet, when analyzing the log data, only 25 percent of respondents reported electronic analysis of that data. Respondents indicate they are using firewalls and user access controls, but are not implementing all available technologies to secure data. Only 67 percent of responding organizations use encryption to secure data in transmission, and fewer than half encrypt stored data.
âHealthcare organizations are continually looking for ways to save money,â said David Finn, health IT officer, Symantec Corp. âOne of the best ways to accomplish these goals is through investing in technologies that will automate and reduce the risks of a security incident and lower the chances of a compliance issue. Although awareness about these issues is high, many providers have not yet made significant moves to the address these concerns.â
Other key survey results include:
Security Budget: Approximately 60 percent of respondents reported that their organization spends three percent or less of their organizationâs IT budget on information security. This is consistent to the level of spending identified in the 2008 study.
Maturity of Environment: Respondents characterized their environment at a middle rate of maturity, with an average score of 4.27 on a scale of one to seven, where one is not at all mature and seven is a high level of maturity.
Formal Security Position: Fewer than half of respondents indicated that their organization has either a formally designated CISO (Chief Information Security Officer) or CSO (Chief Security Officer).
Patient Data Access: Surveyed organizations most widely implement user-based and role-based controls to secure electronic patient information. Approximately half of respondents reported that their organization allows patients/surrogates to access electronic patient information. Patients/surrogates are most likely to be granted access to high level clinical information, such as diagnosis or lab results.
Management of Security Environment: Nearly all respondents reported that their organization actively works to determine the cause/origin of security breaches. However, only half have a plan in place for responding to threats or incidents related to a security breach.
Security Controls: Most respondents reported that they use the information generated in their risk analysis to determine which security controls should be used at their organization. About 85 percent of respondents reported that they monitor the success of these controls and two-thirds of these respondents measure the success of these controls.
Risk Analysis: Three-quarters of surveyed organizations conduct a formal risk analysis (only half of these conduct this assessment on a yearly basis or more frequently), which has remained the same in the past year. Three-quarters of organizations that did conduct risk assessments found patient data at risk due to inadequate security controls, policies and processes. Conducting this analysis positions organizations to identify gaps in their security controls and/or policies and procedures.
Security in a Networked Environment: Nearly all respondents reported that their organizations share patient data in electronic format. Respondents are most likely to report that they share data with state government entities. Respondents also reported that the area in which they are most likely to share data in the future is with Health Information Exchanges (HIEs)/Regional Health Information Organizations (RHIOs). Approximately half of these organizations (41 percent) indicated that these sharing arrangements have resulted in the use of additional security controls beyond those that were already in place at their organization. This is consistent with the data reported in the 2008 survey.
Future Use of Security Technologies: E-mail encryption and single sign on and were most frequently identified by respondents as technologies that were not presently installed at their organization but were planned for future installation.
Medical Identity Theft: One-third of respondents reported that their organization has had at least one known case of medical identity theft at their organization. However, only a handful of these organizations experienced direct consequences from the breach.
âHealthcare organizations must approach all IT activities, including data security, with effective management and efficient use of their budgets, staff and technologies,â said Lisa Gallagher, HIMSS Senior Director, Privacy and Security. âIT and security professionals must recognize the need for securing patient data by using available technologies and preparing for compliance with current ARRA laws and future regulations. This complex operating environment, as well as our national goals for health IT, demands such action to ensure quality, safety and improved healthcare delivery.â
Targeting Chief Information Officers and Chief Security Officers and other Information Technology (IT) executives, the 2009 HIMSS Security Survey focused on an assessment of 196 information technology (IT) and security professionals in the healthcare field of their own readiness for todayâs risks and security challenges.
About Symantec
Symantec is a global leader in providing security, storage and systems management solutions to help consumers and organizations secure and manage their information-driven world. Our software and services protect against more risks at more points, more completely and efficiently, enabling confidence wherever information is used or stored. More information is available at www.symantec.com.
About HIMSS
The Healthcare Information and Management Systems Society (HIMSS) is a comprehensive healthcare-stakeholder membership organization exclusively focused on providing global leadership for the optimal use of information technology (IT) and management systems for the betterment of healthcare. Founded in 1961 with offices in Chicago, Washington D.C., Brussels, Singapore, and other locations across the United States, HIMSS represents more than 23,000 individual members, of which 73% work in patient care delivery settings. HIMSS also includes over 380 corporate members and nearly 30 not-for-profit organizations that share our mission of transforming healthcare through the effective use of information technology and management systems. HIMSS frames and leads healthcare public policy and industry practices through its educational, professional development, and advocacy initiatives designed to promote information and management systemsâ contributions to ensuring quality patient care. Visit www.himss.org for more information.
For more information, contact:
Joyce Lofstrom/HIMSS
312-915-9237 â jlofstrom@himss.org
Pamela Reese/Symantec
424-750-7858 â pamela_reese@symantec.com
![Reblog this post [with Zemanta]](https://img.zemanta.com/reblog_e.png?x-id=b25c3a4a-2ebf-489a-832b-b3841efa99c9)
Oct 30 2009
HIPAA and business associate
How ARRA and HITECH provisions affect HIPAA compliance
AIS reported taht the new HITECH Act requires hospitals, providers, health plans and other HIPAA covered entities (CEs) to meet a February 2010 deadline for revising their business associate (BA) agreements. New language in BA amendments should require BAs to comply with (a) the HIPAA Security Rule,(b) new security breach notification rules and related strategies that CEs choose to implement, and (c) new privacy obligations imposed on CEs by the HITECH Act. Developing and maintaining effective BA relationships should be a top compliance priority for CEs, since privacy and security breaches often take place at the BA level and can be just as damaging to a covered entityâs reputation. With February approaching and lots of tricky questions to resolve, covered entities need a quick crash course in what their options are for designing and implementing these amendments in the next three months.
While the HITECH Act did not come right out and say âbusiness associate agreements must be revised,â it does stipulate that certain provisions âshall be incorporated into the business associate agreement between the business associate and the covered entity.â Among them: business associate agreements must be amended to reflect the new mandate that BAs must comply with the Security Rule, should be amended to provide the covered entity with adequate notice in the event of a security breach, and should incorporate new privacy obligations imposed on CEs by the HITECH Act
Related articles by Zemanta
- New HealthCare Data Breach Program Begins September 23rd (ducknetweb.blogspot.com)
- ARRA – HITECH: Health Care Information Breach Notification Regulations Now In Effect (healthcarebloglaw.blogspot.com)
![Reblog this post [with Zemanta]](https://img.zemanta.com/reblog_e.png?x-id=1e7860f2-7905-4d3e-8265-7062415b5fe5)
Jun 10 2009
How ARRA and HITECH provisions affect HIPAA compliance
Image by Kestelnon via Flickr
How ARRA and HITECH provisions will affect HIPAA compliance. We will highlight the changes to HIPAA due to these new provisions and discuss a possible solution, how to comply with these new HIPAA security and privacy requirements. American Recovery and Reinvestment Act of 2009 (ARRA) was signed into a law on February 17, 2009. The Health Information Technology for Economic and Clinical Health Act (HITECH) provisions of ARRA include important changes in Health Insurance Portability & Accountability Act (HIPAA).
âą 2/17/210 applies to business associate â Covered Entity (CE) can apply the HIPAA provisions to Business Associates (BA) through business associate agreement. The HIPAA Administrative Simplification Security Rule âshall apply to a business associate of a covered entity in the same manner that such sections apply to the covered entity. With the change in the HITECH privacy provisions of ARRA, the business associate now has responsibility and liability directly for a breach. CE should revise their business associate contracts to reflect the changes before the deadline.
âą Civil Action & Penalties â State Attorney General can prosecute neglect and individual can receive monetary compensation. HIPAA now have teeth with monetary, civil and criminal prosecution.
âą Breach Notification â Notification to individual, HHS and media â Notification become more formal if the affected residents are more than 500. Use appropriate public media for cases involving more than 500 individuals. A breach requires notification, which is activated when there is an incident of âunsecured protected health informationâ.
âą Accounting for disclosure â CE is accountable for its BA disclosure of Protected Health Information (PHI)
âą Sale of Protected health Information â CE and BA cannot receive payment in exchange of PHI without an individual authorization. CE and BA are required to tell patients about disclosure of PHI for payment, treatment and administrative operation.
HIPAA compliance and how to manage your risks to healthcare assets:
HIPAA requires CE to have appropriate administrative, technical and physical safeguards to protect the privacy of health information. However HIPAA did not provide specific guidance as to what measure and controls will be appropriate.
ISO 27001 provides the basis to build an Information Security management System (ISMS), where organization can develop its own ISMS by applying controls from ISO 27002 code of practice. Only those controls apply which relate to its business objectives and the potential risks to the business. One document which is required to build ISMS is the Statement of Applicability (SoA) which explains why each of the 133 controls from ISO27002 is included in SoA and justification of the remaining controls which are not included. You can build ISMS suitable to your HIPAA needs, a healthcare organization could use its ISMS to ensure that HIPAA security standards required controls were selected from ISO 27002 and appropriately implemented. You need to certify ISMS (ISO 27001) to provide an ongoing assurance to HHS and healthcare business associates which can provide an edge in this downturn economy and more opportunities to enhance business worldwide.
5 HIPAA Rules Regarding Text Messaging
Resources:
CMS audit checklist
NIST guide for implementing HIPAA
![Reblog this post [with Zemanta]](https://img.zemanta.com/reblog_e.png?x-id=d72b1680-f22d-43af-a9d0-a6e58dec37a9)
Mar 04 2009
HIPAA accountability and security program
Last year the department of Health and Human Services (HHS) started penalizing healthcare organizations for security breaches and lack of security program. Healthcare stimulus bill says that HHS will post a breach of healthcare organization on their website. In both cases the intent is clear that HHS want to hold healthcare organizations accountable for security lapses.
![Reblog this post [with Zemanta]](https://img.zemanta.com/reblog_e.png?x-id=28dcae72-914e-4823-9632-cd34145194b7)
World Privacy Forum (WPF) states in recent report that medical identity theft is on the rise and it leaves false information in medical records that can torment victimsâ medical lives for years. Medical identity theft mostly carried out by insiders with legitimate access to medical and insurance billing. Patient medical files, and addresses can be changed to reflect phony medical care, and insurance payments are forwarded to different address.
HHS has given ample warning and time to healthcare organization to get their house in order. Healthcare stimulus bill which require digitizing healthcare records will demand even more stringent security program from healthcare organizations. Time is of the essence for healthcare organizations to start their security strategy planing now to implement their security program before HHS come knocking at their door.
Risk Management Process:
Like other compliance initiatives, HIPAA also require organizations to build a security risk management program to manage their daily risks. The process of risk management consists of risk assessment (analyzing the risks), design/select control, implement control, test control, maintain/ monitor control. At high level, risk management is accomplished by balancing risk exposure against mitigation costs and implementing appropriate countermeasures and controls.
Risk assessment states the security posture of an organization at a given point in time. Therefore organization should conduct risk assessment of their assets on a regular basis. Risk assessment looks at the impact and likelihood of threat/ vulnerability pair to assess the risk. What is the likelihood of a threat to exploit a given vulnerability and what will be the impact of the threat if the given vulnerability is exploited. If either likelihood/impact is low, the overall risk is low.
Performing vulnerability assessment of critical assets on monthly basis is highly recommend to find out new vulnerabilities and making sure the hardened systems configuration have not changed. Also any changes introduced to a system will require checking the necessary system configurations are intact.
A Five-step Roadmap to HIPAA Security Compliance
Related videos by youtube
httpv://www.youtube.com/watch?v=3Srhrow67f8
« Previous Page
