Chat with us, powered by LiveChat
678-389-6200

Protecting Healthcare Facilities from Ransomware in a Post-Pandemic World

Over the weekend, Universal Health Services (UHS), which operates over 400 healthcare facilities, was struck by one of the largest ransomware attacks in the U.S history that left multiple facilities without access to computer and phone systems.

A data breach can bring a healthcare organization to its knees from a financial perspective. According to the University of North Dakota, the healthcare industry lost $25 billion to data breaches in 2019. However, since healthcare facilities are part of society’s critical infrastructure, financial ruin isn’t the only potential outcome of a cyberattack. In addition to threatening a facility’s finances, a ransomware attack can threaten patients’ lives by taking down critical patient records systems and smart medical equipment.

Ransomware Attacks Accelerate Post COVID-19

Many healthcare organizations simply don’t know how to prevent ransomware attacks, but there are steps they can take to harden their cyber defenses, especially password security. Weak or stolen passwords are responsible for over 80% of data breaches, and most ransomware attacks happen after successful brute-force cyberattacks. In these attacks, cybercriminals take lists of weak or previously compromised passwords, then attempt to use them to access healthcare systems. Once inside, they can steal data, plant ransomware, or both.

Hardening password security is simple and inexpensive:

  • Require that employees use strong, unique passwords for all accounts.
  • Require that employees use multi-factor authentication (2FA) on all accounts that support it.
  • Require that employees use a password manager.
  • Subscribe to a Dark Web monitoring service. These services scan Dark Web forums and notify organizations in real-time if any of their employee passwords have been compromised, allowing IT administrators to force password resets right away.

Are you interested in learning more on how an MSP could help your organization stay safe? Give us a call at 678-389-6200 or visit mPoweredIT.com.

Consequences of a Data Breach

Data breaches reveal the personal information of millions of Americans each year. In healthcare, the trend causes even greater concern due to the nature of the data. The consequences of a data breach are costly to healthcare providers, and more importantly, damaging to the victims.

Here is a sample of developments in this area during the start of 2018

All 50 States Require Breach Notification

On May 1, the Alabama Data Breach Notification Law of 2018 came into effect, making Alabama the final U.S. state to enact such legislation. The law requires notification of breach victims within 45 days of a breach’s discovery, which is 15 days shorter than HIPAA’s 60-day limit. Failure to comply with the notification guidelines can result in a penalty of up to $5,000 per day of the violation.

CT Residents Can Sue for Medical Data Breach


The Connecticut Supreme Court unanimously ruled in January that residents can file lawsuits against healthcare providers seeking damages for negligent disclosure of their medical records resulting in harm. The state joins Massachusetts, Missouri, and New York in allowing such lawsuits, which are not explicitly allowed by HIPAA.

States Looking to Cut Notification Window


A bill to amend Colorado’s data breach notification laws is advancing through the state legislature (not passed as of May 14, 2018). Among other changes, the bill would require organizations to notify individuals affected by a data breach within 30 days of discovery.

Massachusetts Launches Breach Portal

Perhaps following the lead of the OCR’s infamous HIPAA Breach Portal, Massachusetts launched a web portal in February for organizations to submit breach notifications. The portal is later expected to host information on reported breaches, including the organization breached, when the breach occurred, and the number of people affected.

Is Your Practice Vulnerable to a Cyber Security Breach?

It is a common misconception that small business or small medical practices are immune to cyber attacks. The thought being that since they pale in comparison to larger corporations, the appeal to steal sensitive information is low. However, this is not the case. Larger corporations have tighter security measures. Cyber thieves know they can easily access and obtain confidential data from small practices that have many vulnerabilities in their security.

Vulnerabilities are an intractable part of the cyber security landscape. As long as healthcare organizations rely on computer hardware and software, security flaws will be found and exploited. The vast majority of vulnerabilities (99%) leveraged in cyber attacks are publicly known beforehand. This fact should ring alarms for every healthcare IT professional.

Exploits of known vulnerabilities:

71% experienced a security incident attributed to an exploit of a software vulnerability greater than three months old.

66% experienced an incident attributed to a vulnerability less than three months old. This was the third-most common driver of security incidents found.

Zero-day vulnerabilities – those that are not publicly known before they are exploited in an attack – are rare. They make great headlines, but they are expected to play a role in less than 0.1% of cyber attacks through 2020. However, 48% of IT security professionals surveyed said their organization experienced a zero-day attack in the last 12 months, according to the same Ponemon report.

Vulnerabilities vs. Reality

Resource constraints contribute to vulnerability problems. For example, an MRI machine can cost up to $3 million. The devices are often network-enabled and paired with a control PC. If a vulnerability is discovered in the machine and no patch exists, then the organization will likely tolerate the flaw and perhaps mitigate or ignore it long before the system is replaced. The burden falls on the IT staff to “make it work” perhaps by isolating the system on the network and tightening access controls.

However, even these mitigations can encounter constraints. Medical environments – and hospitals in particular – rely on fast and easy access to data to improve patient outcomes. This can pressure IT departments to “loosen” security controls and ease constraints, potentially elevating the risk of data breach.

These factors and others help to explain why healthcare organizations continue to rely on outdated systems known to have severe security flaws. According to a July 2017 survey of 305 healthcare IT professionals in the UK and US by Infoblox:

  •  22% have systems running Windows 7, which was originally released in 2009. Windows 10 was released in 2015.
  • 20% have systems running Windows XP, which reached end-of-life and stopped receiving routine patches in 2014.

Medical Device Security

Vulnerabilities discovered in medical devices – such as CT scanners, pacemakers, and drug infusion pumps – are a growing concern to healthcare professionals, and even lawmakers.

More than half (55%) of health IT security professional said medical device security is not part of their overall cyber security strategy, according to the Ponemon study. When asked to select their greatest concern with medical device security, 39% of healthcare IT security professionals cited patient safety.

While some devices can be updated or replaced, this is not always the case. In the Infoblox survey, 15% of healthcare IT professionals said they either cannot update these systems or are unsure if they can.

Misconfiguration

Misconfiguration can open a security flaw in even the most rock-solid systems. This can cause major data leaks, especially when the system is a public-facing database. On Jan. 25, 2018, a security researcher discovered a database owned by a Long Island medical practice had been misconfigured and left publicly available. This revealed the medical information of more than 42,000 patients, including more than 3 million “medical notes” such as a doctor’s observations. Accessing the information required only knowing the server’s IP address.

In March 2018, a nonprofit healthcare conglomerate based in St. Louis notified 33,420 patients affected by a data leak caused by a server misconfiguration. The leak publicly exposed scanned images of patient driver’s licenses, insurance cards, and medical documents.

Spectre and Meltdown

On Jan. 3, 2018, security researchers revealed two security vulnerabilities present in billions of systems worldwide. Known as Spectre and Meltdown, they are among the most widespread data security flaws ever discovered. In short, the flaws are related to how most modern processors handle data. When exploited, they can allow an attacker to bypass data access controls and steal sensitive data – including data from the kernel or other applications.

What Can You Do About It?

You need an IT support partner who thoroughly understands both HIPAA compliance and network security, as they have to work in tandem to keep your medical practice secure and clear of HIPAA violations. To learn more, call 678-389-6200 or see HIPAA Compliance and Network Security for Medical Practices.

Insider Abuse and Errors –The Biggest Threat to Healthcare Security

Insiders are among the biggest threats to data security in healthcare. Research suggests the problem has reach epidemic proportions – with staff members snooping, stealing, or otherwise leaking sensitive data on a scale much broader than in other industries.

The trend is consistent:

  • Insiders caused 58% of the healthcare security incidents reviewed for the 2018 Verizon PHI Data Breach Report.
  • Insiders caused 37% of 2017 healthcare data breaches reviewed in the 2018 Protenus Breach Barometer Report.
  • An insider caused the largest healthcare data breach reported to OCR in 2017, allegedly stealing data affecting 697,800 individuals.

The trend has extended into 2018. A Calyptix review of the data breaches reported to the OCR from Jan. 1 to May 15 this year revealed:

  • 45% were caused by “unauthorized access / disclosure”, a type of breach typically associated with insiders. The breaches accounted for 55% of the total records exposed during the period.
  • 9% were caused by “loss” or “improper disposal”, which are also often associated with insiders.

The numbers might be inflated by the stringent breach reporting requirements in HIPAA. However, other industries – such as the public sector – also have stringent reporting requirements. While they often see higher levels of insider incidents, they are nowhere near the levels seen in healthcare, suggesting the severity of the problem may be unique to the industry.

Why Insiders Breach

Why do staff members knowingly violate HIPAA guidelines, causing a data breach? In a review of 306 data breaches in healthcare shown to be caused by insiders, 48% were financially motivated and 31% were motivated by fun or curiosity, according the Verizon report. Interestingly, another 10% were motivated by convenience.

Insider data breaches come in two general types: intentional and accidental. A staff member either mistakenly leaks data – such as by emailing health records to the wrong patient – or purposefully exposes the data – such as by theft or snooping. One snooping case reported in 2017 went undiscovered for 14 years. An employee at a Massachusetts hospital was found to have inappropriately accessed the medical records of as many as 1,176 patients over the years.

The person’s motivation can have a significant impact on the scale of the breach. For example, an insider who is financially motivated to steal patient health data may try to grab as much as possible. Malicious or nosey insiders are also more likely to attempt to hide their actions. On the other hand, an employee who makes an honest mistake will likely try to minimize the impact. This may partly explain why data breaches involving “insider wrongdoing” were shown to impact 14% more patient records in 2017 than breaches caused by “insider error”, according to the Protenus report.

Gaps in IT Security Knowledge

Many factors – including large volumes of sensitive data, legacy systems, and complex networks – combine to support a high level of insider breaches. Another factor may be a lower awareness of cyber security issues among healthcare staff. When tested on their security knowledge in 2017, end users in healthcare came in second-to- last compared to other industries, answering 23% of the questions incorrectly, according to a study by Wombat Security.

Healthcare IT professionals seem to echo this finding. More than half (52%) of those surveyed agreed with the statement, “Employees’ lack of awareness affects our ability to achieve a strong security posture.”

The problem also extends to specialized IT security staff, with 74% of respondents in healthcare IT indicating that “insufficient staffing” had hampered the organization’s cyber security posture – more than any other challenge cited. Filling the gaps is apparently not easy, with 79% reporting it is at least “somewhat difficult” to recruit IT security personnel. Nearly one-third (32%) reported it is “extremely difficult”

More Training Needed

Security awareness training is required by HIPAA – but the necessary quality and quantity of training is open to interpretation. In a survey of 239 IT security professionals completed in Jan.2018 by the Healthcare Information Management and Systems Society (HIMSS), only 8.4% said their organization did not have a security awareness training program – which is a good sign. Unfortunately, more than half of respondents (51.8%) said they conduct training just once per year. About one-in-five (22.9%) train monthly.

What Can You Do About It?

You need an IT support partner who thoroughly understands both HIPAA compliance and network security, as they have to work in tandem to keep your medical practice secure and clear of HIPAA violations. To learn more, call 678-389-6200 or see HIPAA Compliance and Network Security for Medical Practices.

Healthcare Hacking & Malware – Targeting Patient Medical Records

Healthcare hacking and malware is big business for bad guys. Cyber criminals are launching attacks against healthcare networks every single day. Healthcare hacking and malware is generally done by “malicious outsiders” rather than rogue employees. The motivation is almost always money.

 

Hackers Are Drawn to Data

Why do hackers target the healthcare industry? Many speculate one reason is the value of the data stored by hospitals, care providers, and other medical offices. When asked the types of information they believe hackers are most interested in, more than half of healthcare IT professionals surveyed pointed to the following three types:

  • Patient medical records: 77%
  • Patient billing information: 56%
  • Login credentials: 54%

Patient medical records remain a profitable commodity on the dark web. Criminals can use the records to conduct medical fraud schemes – collecting payments from public services such as Medicaid and Medicare – and can go undiscovered for years.

Patient billing information – including credit card numbers – is also valuable to data thieves and can be used for fraudulent transactions.

However, the lifespan of such schemes is often far shorter than medical-related ones. The payment card industry is far more efficient in detecting and blocking fraudulent transactions than government regulators in the medical field. This may partly explain why more healthcare IT professionals say hackers are targeting medical records.

Login credentials, of course, are often targeted to gain access to additional systems storing valuable data. Other types of data – such as clinical research, email content, and employee information – can also be targeted, though fewer respondents cited them than the three data types mentioned above.

The use of stolen credentials was found in nearly half (49%) of all healthcare security incidents attributed to “hacking” in the Verizon 2018 Protected Health Information Data Breach Report.

What can you do about it?

You need an IT support partner who thoroughly understands both HIPAA compliance and network security, as they have to work in tandem to keep your medical practice secure and clear of HIPAA violations. To learn more, call 678-389-6200 or see HIPAA Compliance and Network Security for Medical Practices.

Web Analytics