Protecting Patients Data 101

Protecting data in the healthcare industry is an enormous challenge. Healthcare providers and their business associates must strike a delicate balance between maintaining patient privacy, delivering quality care, and adhering to stringent regulatory frameworks like HIPAA and the Health Information Technology for Economic and Clinical Health (HITECH) Act. Given the sensitivity and value of Protected Health Information (PHI) to both individuals and criminals, healthcare organizations are bound by rigorous data protection rules, with severe penalties for non-compliance.

Unlike other industries, healthcare data protection regulations such as HIPAA do not prescribe specific technologies. Instead, they require that healthcare organizations and covered entities ensure that patient information is secure, accessible only to authorized personnel, and used strictly for authorized purposes. It’s up to each organization to decide which security measures best suit their needs to meet these objectives.

In today’s threat landscape, the healthcare industry faces heightened risks. Organizations that proactively adopt best practices for healthcare data protection are better positioned to maintain compliance and reduce their exposure to costly breaches. Below are 10 key strategies healthcare organizations should implement to protect sensitive health data and comply with applicable regulations.

1. Educate Healthcare Staff

Human error remains one of the most significant threats to healthcare data security. Simple mistakes or carelessness can have devastating consequences. Regular security awareness training equips healthcare staff with the knowledge needed to make informed decisions, reducing the risk of accidental data breaches.

Training should cover common risks like phishing, secure use of systems, and appropriate handling of sensitive information. Informed employees are more likely to recognize suspicious activity and adhere to the organization’s security protocols, helping to create a strong first line of defense.

2. Restrict Access to Data and Applications

Restricting access to data is crucial for safeguarding sensitive health information. By implementing strong access controls, healthcare providers can ensure that only authorized personnel have access to patient data, limiting exposure to unauthorized individuals.

Multi-factor authentication (MFA) adds an extra layer of security, requiring users to verify their identity using two or more validation methods. These can include something the user knows (like a password), something the user possesses (such as a smart card), or a biometric factor (such as a fingerprint). MFA helps ensure that only legitimate users can access sensitive healthcare applications and data.

3. Implement Data Usage Controls

While access controls limit who can view the data, usage controls take it a step further by monitoring how that data is used. Data usage controls help identify risky behaviors or malicious activity in real-time and can automatically block or flag certain actions, such as sending unauthorized emails, uploading sensitive data to the web, or copying data to external devices.

Data discovery and classification tools play a critical role in this process by identifying and tagging sensitive data, ensuring that it receives the appropriate level of protection.

4. Log and Monitor Use

Comprehensive logging and monitoring of data access and usage provide a clear picture of who is accessing patient information, when and from where. This allows organizations to track user behavior and detect any abnormal activity, which could signal a security breach.

Logging can also be valuable for auditing purposes, helping to ensure compliance with HIPAA and other regulations. If a breach occurs, logs can help identify the root cause, enabling organizations to quickly respond and mitigate damage.

5. Encrypt Data at Rest and in Transit

Encryption is one of the most effective ways to protect sensitive healthcare data. By encrypting data at rest and in transit, organizations make it much harder for attackers to gain access to readable information, even if they intercept or breach systems.

HIPAA recommends—but does not mandate—encryption, leaving healthcare providers to decide what’s appropriate for their environment. Encryption ensures that only authorized individuals can decrypt and access data, keeping patient information confidential and secure.

6. Secure Mobile Devices

Mobile devices such as smartphones and tablets are increasingly used in healthcare, making them a target for cyberattacks. To mitigate the risk, healthcare organizations must implement robust mobile device security measures. This includes enforcing strong password policies, encrypting sensitive data stored on devices, and enabling the ability to remotely wipe or lock lost or stolen devices.

Additionally, healthcare organizations should monitor mobile devices for suspicious activity and ensure that staff are trained on mobile security best practices.

7. Mitigate Connected Device Risks

The rise of the Internet of Things (IoT) means more devices in healthcare are connected to networks, from blood pressure monitors to surveillance cameras. These connected devices are vulnerable to cyberattacks, so it’s essential to secure them properly.

IoT devices should be placed on separate networks, regularly monitored, and kept up to date with the latest security patches. Organizations should also disable non-essential services on devices and use strong authentication methods to prevent unauthorized access.

8. Conduct Regular Risk Assessments

Conducting regular risk assessments is critical for identifying potential vulnerabilities and weaknesses in a healthcare organization’s security posture. Risk assessments should evaluate not only the internal processes and systems but also the security practices of vendors and business associates that handle PHI.

By proactively identifying risks, healthcare organizations can address potential issues before they lead to a breach, ensuring that they are continuously improving their security defenses.

9. Back up Data to a Secure, Offsite Location

Cyberattacks like ransomware can not only expose sensitive data but also disrupt operations and compromise the availability of critical patient information. Offsite data backups provide a safeguard in the event of a disaster, ensuring that healthcare organizations can recover data and continue operations.

Data backups should be encrypted and stored in secure locations, and organizations should establish clear policies for backup frequency and disaster recovery procedures.

10. Evaluate Business Associates’ Compliance

Healthcare organizations are increasingly reliant on third-party vendors to process and store sensitive information, making it essential to carefully evaluate the security practices of all business associates. HIPAA requires healthcare providers to obtain “satisfactory assurances” from their partners and subcontractors that PHI will be adequately protected.

Under the HIPAA Omnibus Rule, organizations are responsible for the security practices of their business associates. As such, organizations must ensure that vendors comply with HIPAA and other relevant regulations and implement stringent security measures.

How Protected Harbor Secures Health Data

At Protected Harbor, we understand the unique challenges faced by healthcare organizations in safeguarding patient data. Our approach to healthcare, IT is designed to offer robust security, ensuring that health information is protected at every stage—from transmission to storage. We implement the latest encryption techniques, secure mobile device management, and continuous monitoring to detect and address threats in real-time.

We also conduct regular risk assessments and ensure that all our services comply with HIPAA, GDPR and HITECH requirements, helping healthcare organizations avoid costly penalties and maintain compliance. In addition to providing secure cloud solutions, we partner with organizations to back up their data to secure locations, safeguarding against ransomware and other data loss scenarios.

To learn more about how Protected Harbor can help secure your healthcare data Download our Whitepaper Today.

Ready to enhance your healthcare data protection strategy? Contact Protected Harbor to see how our tailored IT solutions can protect your organization’s sensitive information and ensure compliance.

The Fallout of the Change Healthcare Ransomware Attack

In the realm of cybercrime, the recent ransomware attack on Change Healthcare, a unit of UnitedHealth Group, has sent shockwaves through the healthcare industry, exposing vulnerabilities that could have far-reaching consequences. As details emerge, it becomes evident that the repercussions of this attack extend beyond mere technical disruptions, delving into the murky world of ransom payments, criminal disputes, and cybersecurity lapses.

The attack, orchestrated by the notorious Blackcat ransomware gang, also known as AlphV, unfolded with devastating efficiency. Pharmacies across the United States found themselves crippled, unable to process prescriptions and leaving patients stranded in a whirlwind of uncertainty. The disruption, now stretching into its tenth day, highlights the critical role that digital infrastructure plays in healthcare delivery and the severe consequences of its compromise.

What makes this attack particularly concerning is the revelation of a $22 million ransom payment made to the hackers behind AlphV, as evidenced by a transaction on Bitcoin’s blockchain. This sizable sum not only serves as a testament to the profitability of ransomware attacks but also sets a dangerous precedent for future extortion attempts, especially within the healthcare sector. The decision to pay such a substantial ransom underscores the immense pressure faced by organizations grappling with the aftermath of cyberattacks, as they weigh financial losses against the imperative to restore operations swiftly.

However, the saga took an unexpected turn when an affiliate of AlphV alleged that the group had reneged on their agreement to share the ransom proceeds, sparking a dispute within the criminal underground. This revelation sheds light on the volatile dynamics within cybercriminal networks and underscores the inherent risks associated with engaging with such actors. Furthermore, it raises concerns about the potential exposure of sensitive medical data held by affiliated hackers, adding another layer of complexity to an already fraught situation.

In response to the attack, the U.S. Department of Health and Human Services (HHS) has taken proactive steps to mitigate the impact on healthcare providers, emphasizing the need for coordinated efforts to ensure continuity of care. CMS, a division of HHS, has issued guidance aimed at assisting providers affected by the outage, including flexibility in claims processing and encouraging payers to expedite solutions. These measures reflect the urgency with which authorities are addressing the crisis and underscore the interconnectedness of the healthcare ecosystem.

Nevertheless, the incident serves as a stark reminder of the pressing need to bolster cybersecurity resilience within the healthcare sector. Despite previous law enforcement actions targeting ransomware groups like Blackcat, the threat persists, underscoring the adaptability and persistence of cyber criminals. As experts warn, digital disruptions alone cannot eradicate the threat posed by ransomware, necessitating a multifaceted approach that prioritizes prevention, detection, and response.

As the dust begins to settle on the Change Healthcare ransomware attack, it leaves in its wake a trail of disruption, payment, and cybersecurity concerns. The ramifications of this incident will reverberate far beyond the confines of the healthcare industry, serving as a sobering reminder of the ever-evolving nature of cyber threats and the imperative for collective action to confront them head-on. Only through concerted efforts to strengthen defenses and foster collaboration can we hope to safeguard the integrity of our digital infrastructure and protect the well-being of patients and providers alike.

Integration of AI with Your Technology: Empowering Healthcare

AI technology holds immense potential to revolutionize business, enhance healthcare systems, and pave the way for a promising future. Healthcare especially can benefit from AI, including practical implementation strategies and how they can assist healthcare organizations in achieving their goals.

1. AI Technology in Healthcare

Integrating AI technology in healthcare has led to remarkable advancements. AI-powered systems and algorithms can analyse vast amounts of medical data with incredible speed and accuracy, aiding diagnosis, treatment planning, and predicting patient outcomes.

AI algorithms can detect patterns and anomalies in medical imaging, leading to earlier and more accurate detection of diseases. Moreover, AI chatbots and virtual assistants can provide patients with essential medical guidance and support, improving accessibility and reducing healthcare costs.

2. AI Implementation Strategy

A well-planned AI implementation strategy is essential to integrate AI into your technology infrastructure. Here are some crucial steps to take into account::

• Identify Goals: Define the goals you want to achieve through AI implementation. Some typical goals are improving customer experience, optimizing operations, or enhancing decision-making. Having clear goals is essential as they serve as a guiding framework for developing and implementing an effective AI strategy.
• Data Collection and Preparation: AI systems rely on quality data for accurate insights. Ensure you have robust data collection processes, and clean and pre-process the data to eliminate errors and inconsistencies.
• Collaboration and Expertise: Engage domain experts, data scientists, and AI specialists to collaborate on implementing AI solutions. Their expertise will be crucial in understanding the intricacies of your business and leveraging AI effectively.
• Start Small, Scale Gradually: Begin with pilot projects to test AI technologies and assess their impact. This approach allows you to learn, adjust, and gradually scale up AI integration across your organization.
• Regular Evaluation and Adaptation: Continuously evaluate the performance and impact of AI systems. Monitor critical metrics, gather user feedback, and adapt your AI strategy to maximize its benefits.

3. How Artificial Intelligence Helps Businesses

Artificial Intelligence offers numerous benefits to businesses across various sectors. Let’s explore some key advantages:

• Improved Efficiency: AI automates repetitive tasks, freeing human resources to focus on more strategic and creative endeavours. This leads to increased productivity and streamlined operations.
• Enhanced Decision-Making: AI algorithms can analyse vast amounts of data, identify patterns, and generate valuable insights. Businesses may now make data-driven decisions more quickly and accurately.
• Personalized Customer Experiences: AI-powered tools can analyse customer behaviour, preferences, and purchasing patterns to deliver personalized recommendations and tailored experiences, fostering customer loyalty and satisfaction.
• Risk Mitigation: AI algorithms can identify potential risks, anomalies, and fraudulent activities, enabling businesses to address them and proactivity minimize losses.
• Competitive Advantage: Businesses can gain a competitive edge by embracing AI technology. AI-powered solutions enable companies to adapt quickly to changing market dynamics and stay ahead of the competition.

Final Words

The integration of AI with technology holds immense potential for businesses across all sectors of Healthcare. From revolutionizing healthcare to reshaping our future, AI’s capabilities are far-reaching. By formulating a well-defined implementation strategy, embracing new AI technologies, and harnessing the power of artificial intelligence, healthcare businesses can unlock new opportunities, improve operational efficiency, and deliver enhanced experiences to their customers. We recommend embracing AI today and opening its endless possibilities for a successful future.

Protected Harbor, as a leading Managed Services Provider, has been using AI within its’ own operations as well as its’ clients. With ongoing advancements in AI and the promise of new technologies in 2023, businesses can leverage AI to drive innovation, optimize operations, and stay ahead of the competition.

Weather it is through improved Workflow, Operations or Application integration, Protected Harbor can assist you in integrating AI with your technology stack. Protected Harbor will guide you through formulating an effective AI implementation strategy and harnessing the power of artificial intelligence.

Take advantage of the endless possibilities that AI offers. Contact Protected Harbor now.

How Does the Dobbs Ruling Affect Healthcare IT and Patient Record Security?

The apex court of the US recently overturned Roe v. Wade(1973) and Planned Parenthood of Southeastern Pennsylvania v. Casey(1992) in the case of Dobbs v. Jackson Women’s Health Org (2022). The court returned the responsibility for controlling abortion to the individual states after concluding that the US Constitution does not provide a right to abortion.

For healthcare organizations countrywide, the seismic Dobbs v. Jackson Women’s Health Organization decision by the Supreme Court has caused upheaval and confusion regarding patient privacy issues and providers’ obligations for data protection.

If you are a healthcare provider, the Dobbs ruling will not impact your ability to use electronic health records or to communicate and share that information with other providers. This ruling only applies to patient information, not in an “active clinical setting,” Any documents transmitted outside of these settings must still be protected health information under HIPAA.

Question of Vulnerability of Reproductive Health after the Decision

In addition to the decision’s clear systemic ramifications, Dobbs has presented several difficulties for pharmacies and prompted concerns about adhering to Health Insurance Portability and Accountability Act (HIPAA) privacy regulations.

Many reproductive health proponents of HHC have expressed concerns about protecting reproductive health information after last month’s decision. This includes information saved in period tracking apps, text messages, web search history, and other places.

Modern Healthcare fears using the information to prosecute those who seek an abortion or even medical attention after a miscarriage and those who help them. Right now, HIPAA only protects the privacy of health information gathered by covered entities, such as health plans, clearinghouses for health information, and healthcare providers. Data collected by electronic devices and outside apps or organizations are not covered.

Response of Organizations

In the wake of the decision, several companies have taken steps to preserve and prevent using their users’ health data, particularly those about reproductive care. For example, Google announced that it would remove the location information if its search engine determined that a user visited an abortion clinic or another medical facility.

According to Planned Parenthood, a breach of protected health information has not occurred. It deleted marketing trackers from its search sites for abortions that shared data with third-party companies out of caution. It also mentioned that it offers a different appointment scheduling and confirmation tool that is, according to it, HIPAA-compliant.

Similarly, Electronic Frontier Foundation, a digital civil liberties organization, advised users to pay attention to privacy settings on their services, switch off location services on apps that don’t need them, and utilize encrypted messaging services to protect their electronic health data.

Some applications for tracking periods have also made efforts to reassure their users that their health information is safe and secure. As an illustration, Flo said it is creating an “anonymous mode” that will let users delete their names, email addresses, and other unique identifiers from their profiles.

Response of the Government

The Office for Civil Rights (OCR) published guidance on June 29, 2022, outlining how HIPAA constricts disclosures by covered entities and business associates to law enforcement agencies without a court order or other legal mandate.

In light of new state laws forbidding abortion, the guideline offers valuable insight into how OCR may employ HIPAA enforcement to prevent illegal disclosures of protected health information (PHI) to law enforcement personnel.

OCR makes it plain that it wants to protect the privacy of people getting abortions and other reproductive health care. According to OCR, regulations that forbid specific conduct do not authorize the sharing of Personal Health Information(PHI) concerning an individual and such prohibited behavior. Instead, all other requirements in the HIPAA Privacy Rule must be followed, and the law must expressly require such disclosure or disclosure following a legally recognized process. The guidance states that disclosure is only allowed without causing a HIPAA breach.

However, depending on the state, laws that permit criminal or civil action against

• Someone who seeks an abortion
• Someone who performs an abortion,
• Someone who provides the means for an abortion may be used as the justification for revealing PHI for law enforcement purposes, and in states where relevant laws are in force, disclosures may be allowed.

Therefore, HIPAA may not offer the amount of protection against disclosure of PHI that may be inferred based on OCR’s recommendations in light of new state laws that forbid particular conduct by third parties.

To avoid unauthorized disclosure of PHI and HIPAA violations, healthcare organizations should caution their employees and providers not to conflate mandatory reporting laws with state laws that forbid abortion. They should also remind them that legal counsel should review any mandatory reporting. Otherwise, there is a chance of breaking federal or state laws requiring secrecy.

In a nutshell, OCR’s guidance reminds consumers that HIPAA protections do not apply to apps used on personal devices like smartphones that are not directly offered by a Covered Entity or its Business Associate. This covers the numerous applications that provide healthcare-related services but are not offered by Covered Entities, such as period trackers.

However, disclosures needed by law or for law enforcement purposes may apply to Covered Entities and their Business Associates. Additionally, HIPAA does not apply to cell phone service providers, and HIPAA generally does not protect communications made using a mobile device, including calls, messages, and emails. Due to these factors, it will be crucial for people to decide whether and how to communicate with providers electronically for tasks like scheduling appointments.

If privacy is an issue, people should also limit the amount of personal information shared through mobile devices, including apps that might offer health-related services but are not provided through Covered Entities.

Final Words

Regulations concerning data privacy will continue to change in the wake of the Dobbs ruling. Legal counsel should be consulted before pharmaceutical shops or businesses disclose PHI to stay current on the legal climate and guidelines. Reproductive health information will remain a significant concern for patients and application users.

The healthcare industry and application developers should consider updating their online privacy policies to address potential patient and user privacy concerns. Law enforcement agencies should not overstate the protections provided under HIPAA and other state privacy laws against disclosing health information.

With a vision to make the world a healthier place, Protected Harbor’s products are designed to secure and protect the health information of patients and providers in the hospital and clinical environments.

We offer tailored solutions to protect healthcare organizations against current and future cyber threats. Our offerings include network security, endpoint protection, remote monitoring and management, and other cybersecurity services. We have a team of certified engineers who are experts in their fields. A continuous learning and improvement culture helps us stay updated with evolving technological trends and best practices. We are focused on improving the health and wellness of our customers and their customers, which we accomplish by building trust, reliability, and transparency in every aspect of our service.

We are working to protect millions of Americans’ health information and critical data. Contact us today for a free security risk assessment.

How Remote Patient Monitoring Creates Security Threats

Securing data flow is essential for new technologies in a world of cybercrime and security. The potential value of patient data to criminals is significant in today’s healthcare industries.

Even before the COVID-19 crisis, remote patient monitoring was widespread. As clinicians increasingly use technology to support patients’ health and wellness and changes to Medicare CPT codes in 2020, RPM has grown into one of the most lucrative Medicare care management programs.

Between 2015 and 2022, the remote patient monitoring market’s CAGR is anticipated to increase by 13%. However, the quick adoption of telehealth is not without security threats. Security issues must be carefully evaluated, even though they may not outweigh telehealth’s enormous advantages to patients and clinicians.

What Is Remote Patient Monitoring?

Patient monitoring is placing a device on an individual’s body to monitor their vital signs and diagnose or treat medical conditions.

Remote patient monitoring enables patients to be monitored in a remote location away from the hospital, clinic, or another healthcare facility. This can be done using various devices, including smartphones, tablets, and computers.

Remote patient monitoring is becoming more popular as it provides the following:

• Increased convenience for the patient
• Reduced stress on the healthcare team by allowing them to focus on other aspects of treatment rather than dealing with monitoring equipment
• Improved patient outcomes with fewer visits to the hospital emergency room
  

Examples of Remote Patient Monitoring Technology

RPM technology can include everything from mobile medical equipment to websites that let users enter their data. Several instances include:

• People living with Diabetes can use glucose meters.
• Blood pressure or heart rate monitoring.
• Remote monitoring and treatment for infertility
• Drug abuse patients may benefit from at-home exams to help them stay accountable and on track with their objectives.
• Programs for tracking diet or calorie intake.

Security Threats to Remote Patient Monitoring

Here are major security threats to remote patient monitoring:

Credential Escalation

Credential escalation is one of the most common threats to remote patient monitoring. This is because it allows attackers to access devices and systems they would not otherwise have access to, like networked printers and medical devices. It also allows attackers to steal data or turn off your monitoring system.

Insecure Ecosystem Interfaces

Many systems that support remote patient monitoring have an interface that allows patients and doctors to control them. These interfaces often use web technology to interact with their users. Still, they also have access to other systems connected via different protocols like UPnP (Universal Plug and Play) or RDP (Remote Desktop Protocol). These protocols are designed for local networks; they cannot be used on a public network without some proxy.

Phishing attacks

Phishing is a social engineering method involving sending an email or text message to an unsuspecting user, pretending to be from the bank or other company they frequent.

Many remote patient monitoring systems have a single point of failure. The system administrator is responsible for ensuring that the backup system is functioning correctly and that it’s up to date with any security patches.

If the system fails, an attacker can take over your RPM system. This can be done by sending out phony emails or fake phone calls, tricking you into clicking on malicious links in those emails or calls. Once inside the network, an attacker could access sensitive information about patients and their medical records.

Malicious Software

All the patient monitoring devices used in hospitals, clinics, and other healthcare facilities have been susceptible to malicious software attacks. The most common cause for this is outdated software versions that do not provide adequate protection from hackers or cybercriminals.

These devices are still vulnerable because they do not have enough security measures to protect them from hackers and cybercriminals. Some hospitals have decided to upgrade their systems to prevent these attacks.

Ransomware

The ransomware attack on Remote Patient Monitoring is a new trend in the digital world. This attack will most likely occur in small and medium-sized businesses focusing primarily on their services and products.

The primary purpose of this attack is to steal vital information or resources from companies or individuals so they can use them later for their benefit.

Ransomware attacks usually target companies with confidential files on their computers and servers because they are easy to access. People who want to get these files will pay money for them, either directly or indirectly.

How to Protect Remote Patient Monitoring?

The remote patient monitoring industry is proliferating, and so are the attacks on it. Here are some steps to protect your business from potential threats.

Keeping Technology Updated

Remote patient monitoring systems contain many components, including cameras, sensors, and software. These systems must be kept up-to-date with the latest security patches and updates. This is especially important if you use a third-party vendor to provide your network security solution.

Protecting the Cloud Environment

The cloud environment can be vulnerable to cyberattacks, especially regarding HIPAA-compliant healthcare information, usually stored in the cloud. To protect your data from being stolen by hackers or other malicious actors, consider using a cloud storage provider specifically designed for healthcare applications – such as a cloud storage provider built for healthcare settings like yours.

Embracing a Zero-Trust Approach

A zero-trust approach means that all interactions between an organization’s devices and its users should be trusted automatically without requiring any permissions or confirmation from human users. This helps minimize the possible points of failure in organizations’ networks and reduces the risk for employees who unknowingly share sensitive information.

Conclusion

While monitoring a patient’s health remotely does seem like a great idea, especially for the chronically ill who may have trouble leaving their homes, remote monitoring also introduces new security threats into the healthcare industry. No system is perfect without precautions and security measures. Healthcare organizations must be aware of these new vulnerabilities, from patients’ privacy to the dangers of cyber hacking and compromising patient information.

With the right partner, you can feel confident that your data stays protected. Our team is dedicated to keeping your data safe and secure, so you can focus on providing the best care possible.

With the Protected Harbor team’s vast experience and proven track record, you can trust that your data is in good hands. With years of experience delivering secure IT, and Cloud solutions in line with industry standards and best practices, Protected Harbor professionals pay close attention to the vulnerability of remote monitoring solutions.

We work with all types of providers, from small to large, to protect your data, reduce risk, and keep your organization secure. Our team of experts will work with you to create a customized solution that meets your company’s requirements. Our cybersecurity solutions are reliable and scalable to fit your organization’s needs.

Feel free to contact our experts if you wish to begin developing a hack-proof medical device or if you wish to schedule an IT audit.

The Recent Medical Data Leaks and What You Can Do About It

Did you know that medical data is the new gold? Unencrypted patient records are worth $300 billion, and that number will keep growing. This blog will explore the recent medical data leaks and their potential consequences. You’ll also learn how to protect your sensitive information — so you can avoid being one of the many victims of medical data breaches.

A recent study by Comparitech covered breaches. Their team of researchers analyzed data from 2009 to June 2022 to find out which US states suffer the most medical breaches and how many records have been affected each year. They also looked at breaches from January 2021 to June 2022 to find the most significant cause of these breaches and the most-affected healthcare organizations.

Key Findings

• In 2017 alone, there were over 2,800 data breaches, affecting over 178 million patients in the US alone.
• More than half of data breach victims don’t even know they’ve been affected.
• Only 13% of healthcare providers offer free identity protection services.
• Over 50% of data breach victims do not change their passwords after a breach.
• 4,746 medical breaches were reported between 2009 and June 2022.
• These breaches affected 342,017,215 user records.
• 803 documented medical breaches made 2020 the year with the most (the second-highest was 2021 with 711).
• With almost 112 million records affected overall, 2015 saw the most records affected.
• Hospital networks are responsible for the most records that have been compromised in 2021 and 2022 (so far), accounting for 8.8 million records (16 percent of all records affected). Specialist clinics—clinics that specialize in a particular area of medicine—account for the most data breaches (15 percent), with 130 breached entities overall.
• Hacking was the most frequent breach in 2021 and 2022 (so far), making up 40% of breaches (353 out of 862).

Top 5 Medical Data Breaches

Anthem  Inc. – The second-largest health insurance company in the US, was hit with a massive data breach in 2015 – one of the largest on record (78.8 Million records).

Optum360 LLC- From August 2018 to March 2019, hackers gained access to the sensitive financial and personal data of 11.5 million lab patients at the American Medical Collection Agency.

Excellus Health – This breach affected 10 million people and was discovered two months after the Anthem breach was announced.

Premera Blue Cross – This breach impacted 11 million people and was caused by malware that was used for two months. Premera Blue Cross was compelled to pay the OCR $6.85 million.

Laboratory Corporation of America Holdings- In 2019, A hacker gained access to the American Medical Collection Agency, a third party it employed for payments. Over 10.2 million people’s personal, financial, and medical information was compromised.

Biggest Years for Medical Data Breaches

The year with the most medical data breaches, with an overall total of 803, was 2020. A significant number of breaches were also reported in 2021 (711), closely followed by 2019 (520). This demonstrates the exponential growth in medical data breaches over the past three years.

The median number of records affected by each breach between 2009 and 2018 remained roughly 2,000 when we looked at the median number of records affected for each year. In 2019, there was a significant increase from 2018. (rising by 70 percent from 2,284 to 3,893). This persisted through 2020 (with a rise of 26% from 3,893 to 4,916) and from 2021 to 2022. (rising by 4 percent up to 5,122).

Why the increase in data breaches? There are many reasons, including the fact that the healthcare industry is growing, more people are using the Internet, and more sensitive data is being exchanged online. The healthcare industry is still struggling to adapt to the cyber threat landscape.

Most Common Data Breach Type

Data breaches are rising, and data loss is becoming more common. But what type of data breaches are most prevalent in the healthcare sector? Healthcare providers losing control of their data is a common occurrence nowadays.

With 288 out of 711 breaches (41 percent) in 2021 involving medical companies, hacking emerged as the most prevalent method. With 161 attacks (23% of all attacks, excluding unknowns), ransomware was the next most prevalent category. Theft of data is the third most prevalent type of data breach.

2022 for Medical Data Breaches

151 documented medical data breaches impacted 7,997,739 records during the first half of 2022. Even if these numbers seem low, they may increase over the next few months.  Perhaps more focused attacks are the cause of this. This is evident from the MCG Health data leak. The software provider revealed that its systems were breached through unauthorized access on June 10 this year. Nearly 800,000 records have been affected by the breach on MCG Health, and at least eight organizations have reported it thus far.

Conclusion

The healthcare sector is under attack, and the threat is likely to grow as time goes on. The best way to protect sensitive information is to prepare in advance. Encrypt the data before sending it over the Internet or storing it on a device. This protective measure can be applied to nearly any data type, preventing unauthorized individuals from accessing the information.

Protected Harbor helps companies prevent cyber breaches, data loss, and regulatory non-compliance by offering security solutions such as data monitoring, cloud security, and DLP. Our clients include small businesses, enterprises, healthcare, and government agencies.

Protected Harbor is one of the top cybersecurity providers trusted by thousands of businesses across the country for offering robust cybersecurity solutions. With our expert team of engineers and technicians, you can be assured complete security for your business.

Get a free cybersecurity and ransomware audit today and get cyber-secured.

IT Security Incident Affects Multiple Facilities Across CommonSpirit Health

One of the most significant health systems in the country, CommonSpirit Health, said that the IT security breach happened on Monday, October 3, 2022.

CommonSpirit Health, a faith-based healthcare organization, located throughout the Midwest, recently experienced an unfortunate security incident. At first glance, this security incident may appear innocuous since it only involved exposing sensitive patient information. However, the ramifications extend far beyond a breach of privacy.

In light of these developments, we have compiled a brief overview of the CommonSpirit Health IT security incident to help you identify potential vulnerabilities in your environment.

What Happened?

According to reports, a hack on CommonSpirit Health System that is still ongoing compromised facilities in Tennessee, Nebraska, and Washington. EHRs (Electronic Health Records) are currently among the offline IT systems, and patient visits have since been rescheduled.

The number of facilities impacted by the issue, which started on Monday, is still unknown, as is the number of patient records.

According to a statement from CommonSpirit, “as a result of this situation, we have rescheduled some patient visits in several of our communities.” If a patient’s appointment is impacted, their provider and care facility will contact them directly.

One of the largest health systems in the nation, based in Chicago, runs 142 hospitals and more than 2,200 care facilities throughout 21 states.

It stated, “We take our responsibility to safeguard patient privacy and IT security very seriously.”

According to CHI (Catholic Health Initiatives), the facilities are adhering to procedures for system failures and “[are] taking steps to minimize the disturbance.”

Why This Matters?

In 2019, Trinity Health and CHI merged to create CommonSpirit Health, a new nonprofit Catholic health system with a presence in 21 states.

According to The Chattanoogan.com in Tennessee, the hacking attack impacted the neighborhood of CHI Memorial hospital. According to the report, CHI officials said several patient procedures had to be rescheduled, and some systems had to be shut down.

The Virginia Mason Franciscan Health in Seattle has also stated that the outage has affected their systems. St. Joseph Medical Center in Tacoma is one of the hospitals and clinics in the Puget Sound region run by VMFH. Given this, patients could not access MyChart, an online patient portal.

CommonSpirit is one of several renowned nonprofit health systems reporting significant losses for the most recent fiscal year.

In 2022, the company recorded losses of $1.85 billion.

Wright Lassiter, formerly with Henry Ford Health, was recently named by
CommonSpirit as its new CEO and Lloyd Dean’s replacement.

Protected Harbor’s Take on the Matter

“An ounce of prevention is worth a pound of cure, right? Well, this holds true when it comes to cybersecurity as well as in the case of the CommonSpirit health incident. Even the most diligent and well-intentioned companies can be the victim of a data breach. With the GDPR in effect, it’s now a matter of public record if your data has been stolen.” – Richard Luna, CEO of Protected Harbor.

It is a proven fact that most cyberattacks happen due to negligence. Therefore, it is imperative to have a reliable security system to protect you from all sorts of online threats. At the same time, it is equally essential for you to keep your operating systems, antiviruses, firewalls, and patches up to date with the latest versions available. Without regular updates, your system can become vulnerable to cyber-attacks. Therefore, it is essential that you keep track of all the updates and install them at the right time.

MFA (Multi-Factor Authentication) and IAM (Identity Access Management) are the primary security requirements we suggest all businesses implement to have an extra layer of security.

Cybersecurity awareness should be an integral part of your business plan. It doesn’t matter if you are a large corporation or a small business; cybersecurity is critical for everyone.

For more information, check out a quick guide to proactive cybersecurity measures.

Final Thoughts

Unfortunately, many businesses are unaware of the significance a robust security plan has and thus remain vulnerable to cyber threats. If you are concerned about your business’s security and want a foolproof security plan, then hiring an expert can help you.

Protected Harbor offers a range of security services, including a Web Application Firewall (WAF), data breach response, email security, ransomware security, and cloud security to businesses of all sizes. We keep your data and systems secure, help you comply with regulations, and meet your documentation requirements. Our products are easy to use and come with 24/7 support.

Our focus on ease of use, transparency, and value for your dollar sets us apart from the competition. Protected Harbor is one of the best-reviewed cybersecurity providers. We have a 90+ Net Promoter Score.

Even if you feel you have a solid security plan, it can’t work if it’s not in use. A security audit of your network and systems is equally as important. With that being said, Protected Harbor is here to help and will be offering free cybersecurity assessments for all healthcare providers. Contact us today.