Global Cybersecurity Agencies Release Principles for Securing Operational Technology

Tools & Practices

On October 2, 2024, a set of principles titled Principles of Operational Technology Cybersecurity was released by cybersecurity agencies from Australia, the U.S., and other international partners. The guide aims to assist organizations, especially those managing infrastructure, in understanding and securing their operational technology (OT) environments against cyber threats. Safety at the Forefront of OT Security Unlike conventional IT systems, which focus primarily on data and business processes, OT is directly tied to physical processes that have a profound impact on safety and security. The guide underscores that safety should be the top priority in managing OT systems. Failures in OT environments ...

Read more

Alert On INC Ransomware Attacks Conducted by Vanilla Tempest (Vice Society) Threat Group

Cyber Threats

Microsoft published an alert regarding a cybercriminal group known as Vanilla Tempest, which is deploying INC ransomware to attack the U.S. healthcare industry. INC ransomware, a popular ransomware-as-a-service (RaaS) operation, has gained traction among cybercriminals since its appearance in July 2023. According to Coveware, INC ransomware ranked as the fifth most common ransomware variant in Q2 of 2024. It has primarily been used to target the healthcare, government, and education sectors. Recent attacks on entities covered by HIPAA laws include McLaren Health Care in August 2024 and the National Health Service (NHS) Scotland in May 2024. The Russian-speaking hacking group, ...

Read more

Windows MSHTML Platform Zero Day Vulnerability Actively Exploited by APT Group

Security Breaches

Microsoft patched a vulnerability on September Patch Tuesday yet attackers are still exploiting the vulnerability to install data-stealing malware. Vulnerability CVE-2024-43461 is identified as a Microsoft Windows MSHTML Platform spoofing vulnerability that has an assigned high-severity CVSS base score of 8.8. The vulnerability is labeled as “important” by Microsoft, which reported that the vulnerability is not yet exploited in cyberattacks. Recent updates confirm that the vulnerability had been used in attacks prior to July 2024. Microsoft has since revised its advisory, revealing that the CVE-2024-43461 vulnerability was part of an exploit chain that included vulnerability CVE-2024-38112, a second MSTML spoofing. ...

Read more

Texas challenges HHS HIPAA rule on reproductive health privacy

Trends & Reports

Texas Attorney General has filed a lawsuit against the U.S. Department of Health and Human Services (HHS) challenging the new HIPAA rule on reproductive healthcare confidentiality. This case raises complex questions about the balance between patient privacy and the right of states to investigate medical procedures, particularly following the overturning of Roe v. Wade in 2022. This upcoming trial could have major repercussions for reproductive rights and medical confidentiality in the United States. The legal context: the reversal of Roe v. Wade The Supreme Court’s reversal in 2022 of Roe v. Wade, which guaranteed the constitutional right to abortion for ...

Read more

Alert Issued About Russian Hacking Group Attacking Critical Infrastructure

Cyber Threats

The Federal Bureau of Investigation (FBI), National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and their partners have published a joint cybersecurity warning regarding Russian military hackers targeting critical infrastructure in the U.S. and other NATO nations. These hackers are believed to be linked to the Russian General Staff Main Intelligence Directorate (GRU), specifically the 161st Specialist Training Center, or Unit 29155. Despite this affiliation, the group operates independently from other established GRU hacking units. Cybersecurity firms are tracking this group under various names, including Cadet Blizzard, Frozenvista, Ember Bear, UAC-0056, and UNC2589. Being active since 2020, this ...

Read more

House of Representatives Reviews the Healthcare Cybersecurity Act

Compliance

The introduction of the bipartisan Senate bill known as the Healthcare Cybersecurity Act was a response to the Change Healthcare ransomware attack and presently has a partner bill in the House of Representatives. Senators Todd Young (R-IN), Jacky Rosen (D-NV), and Angus King (I-ME) introduced the Senate bill in July 2024, while Representatives Jason Crow (D-CO), Andy Kim (D-NJ) and Brian Fitzpatrick (R-PA) introduced the House bill. The healthcare sector has become a prime target for cybercriminals who steal sensitive patient information for financial gain, either by selling it or holding it for ransom. A report from the HHS Office ...

Read more

Answers Required from DOL Regarding State Agencies’ Surprise Inspections

Compliance

Two House Democrats wrote to Department of Labor (DOL) Acting Labor Secretary Julie Su requiring replies regarding allegations that California and South Carolina Occupational Safety and Health Administration (OSHA) agencies were warning companies about safety inspections in the workplace. Reps. Alma Adams (D-NC), a Workforce Protection Subcommittee ranking member, and Bobby Scott (D-VA), a House Committee on Education and the Workforce ranking member, composed the letter responding to news reports that indicate inspectors are informing companies regarding impending inspections. One report emerged in a legislative hearing in California in which farmers and their advocates claimed that Cal/OSHA was giving employers ...

Read more

464,000 People Impacted by Kootenai Health Ransomware Attack

Security Breaches

Health system Kootenai Health based in Coeur d’Alene, ID serves northern Idaho and the Inland Northwest. It recently reported a data security breach that affected patients, workers, and their dependents’ personal data and protected health information (PHI). While the incident interrupted some IT systems, Kootenai Health confirmed that its operations and the delivery of patient care were not impacted. On March 2, 2024, Kootenai Health discovered unusual activity in its computer systems. Third-party cybersecurity specialists investigated the incident and found an unauthorized person accessed the system around February 22, 2024. Kootenai Health then reviewed all files on the affected systems ...

Read more

$115K Civil Monetary Penalty Paid by American Medical Response for HIPAA Violation

Compliance

American Medical Response (AMR), a private ambulance provider, paid $115,200 to the HHS’ Office for Civil Rights (OCR) as a civil monetary penalty to take care of the violation of the HIPAA Right of Access. AMR was unable to give a patient prompt access to their health records. It took over a year to give the requested information. The HIPAA Right of Access is a clause under the HIPAA Privacy Rule and protects patients’ rights to get a copy of their health records, upon request, within 30 days of requesting a copy. In selected instances, the duration can be extended ...

Read more

IT Employees Targeted by Hunters International Ransomware Group

Cyber Threats

The Hunters International threat group impersonates legitimate IP and port scanning programs to install malware to obtain IT workers’ initial access to systems. The Hunters International ransomware group first appeared in October 2023. The group is associated with the Hive ransomware group, which was shut down by a law enforcement operation in January 2023. Although security researchers have mentioned Hunters International was Hive rebranded because of a 60% code overlap, the group says it bought the Hive code and that it is a different group. Though Hunter’s International is not the most famous ransomware group, it has performed over 130 ...

Read more

Changes to HHS Mangament of Technology, Cybersecurity, Information, AI, and HealthIT

Compliance

The Department of Health and Human Services (HHS) has reported a restructuring that will enable the department to improve its operations and more efficiently prioritize using digital and upcoming functionalities like artificial intelligence. Work associated with technology, cybersecurity, and information has historically been spread out in three HHS divisions: The Assistant Secretary for Administration (ASA), the Office of the National Coordinator for Health Information Technology (ONC), and the Administration for Strategic Preparedness and Response (ASPR). Prospects in these areas have developed significantly in recent years, and the time to improve operations is now and all tech-based jobs are put under ...

Read more

Change Healthcare Cyberattack Reported to the U.S. Department of Health and Human Services

Security Breaches

The Change Healthcare cyberattack has caused massive disruption to healthcare services in the United States, including huge financial hardship for healthcare providers due to a lengthy outage of Change Healthcare’s systems. That outage has hampered billings and payments for healthcare services, and an as-of-yet unconfirmed number of Americans have had their sensitive data stolen and are potentially at risk of fraud and identity theft. As further information about the Change Healthcare cyberattack and data breach is released, this article will be updated so please check back regularly. HHS’ Office for Civil Rights Notified About Change Healthcare Cyberattack and Data Breach ...

Read more

Northern Arizona VA Healthcare System Fails to Protect its Employees Against Workplace Violence

Tools & Practices

A VA medical center located in Prescott, AZ, was unable to keep its employees safe from critical and possibly fatal patient violence. This is the second time in four years that the Occupational Safety and Health Administration (OSHA) has reported the VA medical center for allowing its employees to be exposed to violence. OSHA started an investigation of Bob Stump VA Medical Center in December 2023. This followed reports that nurses, nursing aids, and housekeeping personnel were bitten, struck, kicked, slapped, punched, and sexually harassed by unit residents. OSHA’s investigation found that the center failed to protect its employees from ...

Read more

PHI Exposed in HealthEquity Cyberattack

Compliance

Financial technology and business services provider HealthEquity based in Draper, UT encountered a cyberattack that exposed SharePoint data, including protected health information (PHI). HealthEquity offers the following services: health savings account (HSA), and consumer-focused benefits solutions, such as health reimbursement arrangements (HRAs). It handles many HRAs, HSAs, and other benefit accounts. HealthEquity revealed in its recent Securities and Exchange Commission (SEC) 8-K filing that it discovered anomalous activities in the device of a business partner. The initial investigation showed a breach of the third-party device, and a hacker used the device to view some members’ SharePoint data. Malware was not ...

Read more

Cyber Fire Drills: A New Tool to Fight Healthcare Cyberattacks

Compliance

Healthcare is under constant cyberattack by malicious actors. Nearly 6,000 healthcare data breaches that have been reported to the HHS Office for Civil Rights (OCR) between 2009 and 2023.  This is a staggering problem for the healthcare industry — 519,935,970 healthcare records have been breached, with is more than 1.5 times the population of the whole United States. And while we certainly didn’t need another reminder about why cybersecurity is important, the recent attack on Change Healthcare has had a devastating ripple effect through the entire industry.  One-third of Americans had their sensitive health information exposed in that breach.  And thousands ...

Read more

HIPAA Email Encryption Requirements

Insights

The HIPAA email encryption requirements are that, when emails contain electronic Protected Health Information (ePHI), the emails must be encrypted to a minimum standard unless encryption is found to be an unreasonable or inappropriate safeguard in a risk assessment. HIPAA and the HIPAA Email Encryption Requirements Covered entities and business associates that are required to comply with the Health Insurance Portability and Accountability Act (HIPAA) must ensure the confidentiality, integrity, and availability of ePHI. This involves implementing certain safeguards to protect ePHI at rest and in transit. One of those safeguards is the encryption of ePHI. The HIPAA Security Rule ...

Read more

SkinCure Oncology Email Account Breach

Security Breaches

SkinCure Oncology in Burr Ridge, IL has informed 13,434 individuals regarding an email attack that happened in June 2023. SkinCure Oncology has sent personal notifications to patients who had their protected health information (PHI) compromised because of an email breach. Based on the substitute breach notice, it was confirmed by the investigation that an unauthorized third party accessed several email accounts from June 23 to June 25, 2023. When SkinCure Oncology discovered the unauthorized access to its email accounts, the provider immediately secured those accounts and started an investigation. The investigation confirmed the unauthorized access and breach of some patient ...

Read more

Guidance Sought on Notification Requirements Related to the Change Healthcare Data Breach

Compliance

CHIME and some healthcare provider organizations wrote to Melanie Fontes Rainer, the Office for Civil Rights (OCR) Director, for clarity and information for physicians and healthcare providers concerning the reporting requirements associated with the Change Healthcare data breach. The HHS replied immediately to CHIME’s letter and stated that concerning the breach response, the affected HIPAA-covered entities may assign the task of issuing breach notifications to Change Healthcare. According to OCR, if the impacted covered entities collaborated with Change Healthcare, they don’t have to do the HIPAA breach notification obligations themselves. Still, they need to make sure that Change Healthcare delivers ...

Read more

HIPAA Compliance for Email

Insights

HIPAA compliance for email involves not only ensuring that the systems used to send, receive, and store emails support HIPAA compliance, but also that members of the workforce understand when it is permitted to send Protected Health Information by email – and when exceptions exist. Because of the different ways in which covered entities and business associates use email, there are no definitive guidelines for HIPAA email compliance. For example, some organizations use on-premises email systems, while others subscribe to cloud email services offered by providers such as Microsoft, Google, and Zoho. Some organizations use secure file-sharing systems to avoid ...

Read more

PHI of 175,195 Patients Exposed in South Texas Oncology and Hematology Cyberattack

Compliance

Cancer treatment center South Texas Oncology and Hematology (STOH) based in San Antonio, TX has informed 176,303 patients about a cyberattack discovered on February 15, 2024. STOH has seven centers located in Texas with over 405 employees and approximately generates $8 million in yearly revenue. After discovering the security incident, STOH deactivated its system and engaged a third-party cybersecurity company to help secure its systems and perform a forensic investigation to know the nature and extent of the incident. On February 19, 2024, STOH reported that an unauthorized party got access to areas of its system that contain the personal ...

Read more

Surgeon Who Exposed Transgender Care to Minors Charged with Criminal HIPAA Violations

Security Breaches

The Department of Justice has revealed the indictment against surgeon Eithan Haim, MD. Haim was the whistleblower who provided the press with documents regarding minors at Texas Children’s Hospital who got gender-affirming care. Haim faces charges of four criminal violations of the Health Insurance Portability and Accountability Act (HIPAA), namely illegally accessing, obtaining, and disclosing Texas Children’s pediatric patients’ protected health information (PHI). Haim anonymously provided records he got from Texas Children’s to Christopher F. Rufo, a senior fellow working at the Manhattan Institute, who publicized an article in the City Journal disclosing the gender-affirming care that Texas Children’s Hospital ...

Read more

Court Ruling Changes OCR’s Website Tracking Technology Guidance

Trends & Reports

A Texas federal judge made a decision that the guidance set by the HHS’ Office for Civil Rights about website tracking technologies was illegal, stating that OCR went beyond its authority when it released the guidance. According to the judge, metadata obtained from an unauthenticated website is not considered individually identifiable health information if combined with an IP address. In December 2022, OCR clarified to hospitals and health systems the scope of using tracking technologies by providing guidance about HIPAA and website tracking technologies. The use of these technologies, including Meta Pixel code, on websites provides useful features; but they ...

Read more

ComplianceJunction HIPAA Training Course Receives AHIMA Approval

Compliance

The Health Insurance Portability and Accountability Act (HIPAA) applies to healthcare providers health plans, healthcare clearinghouses, and their business associates. HIPAA has important privacy and security provisions that restrict the uses and disclosures of healthcare data – termed protected health information (PHI) – and require PHI to be safeguarded at all times. HIPAA requires covered entities to implement policies and procedures to ensure the privacy and security of PHI and for all staff members to be provided with training on the HIPAA Rules. Many healthcare data breaches result from mistakes by employees who are unaware of their responsibilities under HIPAA, ...

Read more

23andMe 2023 Data Breach Investigated by Security Regulators

Security Breaches

Data security regulators in the U.K. and Canada have started a mutual investigation of 23andMe concerning its 2023 data breach where about 7 million individuals or approximately 50% of its clients were impacted. 23andMe is a company offering direct-to-client genetic testing through DNA analysis of customers’ saliva samples and gives clients information regarding their health and ancestral roots. In October 2023, a hacker accessed users’ profile data and sold the data. 23andMe looked into the hacker’s statements and confirmed that its systems were not compromised; nevertheless, customers’ accounts were accessed during a credential-stuffing operation. Credential stuffing attacks entail utilizing passwords ...

Read more

Cyber Attack on the Snowflake Platform

Security Breaches

A financially driven threat actor monitored as UNC5537 is executing a cyber attack on Snowflake client databases. About 165 Snowflake clients are believed to have been impacted. Snowflake is a multi-cloud data storage platform that clients use for storing and analyzing large amounts of structured and unstructured information. Based on Google’s cybersecurity company Mandiant, the threat actor uses stolen credentials to systematically access client accounts. The very first time an account breach was discovered was on April 14, 2024. When account access is acquired, the threat actor extracts data and issues a ransom demand to stop selling the stolen information. ...

Read more

UHG Required to Send Breach Notifications Involving Change Healthcare Not Later Than June 21, 2024

Compliance

On June 7, 2024, Senators Marsha Blackburn (R-TN) and Maggie Hassan (D-NH) sent a letter to UnitedHealth Group CEO Andrew Witty telling him to issue the notifications involving the ransomware attack on Change Healthcare on February 21, 2024. Affected individuals need to know about the ransomware attack promptly. The Office for Civil Rights (OCR) revised its website FAQ to clarify misunderstandings regarding breach notifications and stated that UHG/Change Healthcare is permitted legally to issue individual notifications on behalf of the impacted HIPAA-covered entities. OCR also stated that the burden to ensure that affected individuals receive their breach notifications still rests ...

Read more

FBI Recovers 7,000 Decryption Keys Through Operation Cronos

Compliance

The Federal Bureau of Investigation (FBI) advises LockBit ransomware attack victims to contact the Internet Crime Complaint Center (IC3). The FBI has secured over 7,000 decryption keys that past victims can use to retrieve their data files at no cost. During the 2024 Boston Conference on Cyber Security, it was confirmed by FBI Cyber Assistant Director Bryan Vorndran that the FBI has a substantial number of decryption keys in its possession due to its continuing initiatives to break up the LockBit ransomware activities. The FBI was busy with a worldwide law enforcement campaign called Operation Cronos. The UK National Crime ...

Read more

Cencora/Lash Group Faces Class Action Lawsuit Over Cyberattack

Security Breaches

Cencora Inc. and The Lash Group LLC are facing a data breach-related lawsuit filed by plaintiff Keith Wolford. Allegedly, the defendants were unable to enforce reasonable and proper safety measures to protect the privacy of personally identifiable information (PII) and protected health information (PHI) covered by HIPAA laws. Because of those failures, patient data was impermissibly exposed to threat actors. Cencora, a wholesale drug firm previously called AmerisourceBergen and its parent company called The Lash Group, reported in May 2024 the unauthorized access to its network by a third party and exfiltration of sensitive information. According to the forensic investigation, ...

Read more

Ransomware Attack on Synnovis Affects London Hospitals

Cyber Threats

Synnovis, a UK-based medical laboratory services provider encountered a ransomware attack that disrupted patient services at several NHS hospitals in London. Operations at the following hospitals and care centers were affected: Guy’s Hospital King’s College Hospital St Thomas’ Hospital Evelina London Children’s Hospital Royal Brompton Hospital Care sites in six London boroughs: Bexley, Lewisham, Greenwich, Bromley, Lambeth, and Southwark. Synnovis, a diagnostic and pathology services provider, posted an advisory on its customer service website to notify everyone that its systems are inaccessible. The provider launched an investigation to find out the reason for the outage. Synnovis advised the impacted NHS ...

Read more

Email Accounts Compromised at Children’s Health Care

Compliance

Children’s Health Care in Minneapolis, MN, doing business as Children’s Minnesota, found out that patients’ protected health information (PHI) was compromised in an email security incident that was identified on March 13, 2024. Children’s Health Care is a large pediatric healthcare provider in the U.S. It has two hospital campuses located in St. Paul, and Minneapolis, and specialty clinics. It is the only Level I Trauma Center in Minnesota and the exclusive provider of care for kids from birth to young adulthood. It is an expert in the diagnosis, treatment, and research of diseases that affect babies and kids, which ...

Read more