- Department of Health & Human Services’ Office for Civil Rights (OCR) stated that
- so far in 2020, the PHI (protected health information) of 13.7 million patients hasbeen affected by data breaches. Causes:
- 66% = hacking
- 21% = unauthorized access/disclosure
- 7% = theft3% = improper disposal
- 3% = loss
- Premera Blue Cross, headquartered in Mountlake Terrace, Washington, paid the largest HIPAA fine in history, when it agreed to pay the feds $6.85 million in regards to breach that exposed PHI of 10.4 million patients.
- Community Health Services (CHS), a chain of hospitals, with headquarters in Brentwood, Tennessee, agreed to pay the feds $2.3 million HIPAA fine in regards to breach that exposed PHI of 6 million patients.
- Children’s Minnesota notified 160,000 patients that their PHI may have been exposed after ransomware incident.
- Allina Health of Minnesota notified 200,000 patients that their PHI may have been exposed after ransomware incident.
- University of Missouri Health notified an unknown number of patients that their PHI may have been exposed after ransomware incident.
- Gillette Children’s Specialty Hospital of Minnesota notified an unknown number of patients that their PHI may have been exposed after ransomware incident.
- Regions Health of Minnesota notified an unknown number of patients that their PHI may have been exposed after ransomware incident.
- Nebraska Medicine notified patients that they have suffered a “security incident” and gave no other details.
- Hennepin County Medical Center of Minnesota admitted that it had to fire 5 employees for illegally accessing the PHI of George Floyd.
- Starling Physicians of New Britain, CT notified an unknown number of patients that their PHI was exposed after ransomware incident.
- Our Lady of the Lake Hospital of Louisiana notified an unknown number of patients that their PHI may have been exposed after ransomware incident.
- Valpraiso Community School District of California notified an unknown number ofstudents that their info may have been exposed after a 13 year old student was arrested For hacking into network.
- Check Point Research published report entitled “Online Attacks Hit Education Sector Worldwide”
- Significant rise (30%) in cyberattacks against schools, colleges and universities
- Hackers see opportunity to disrupt online education and potentially earn a ransom for ending the attack
- Cisco Corp. published report warning that remote code execution and defense evasion are top tactics now being used in hacking attacks on corporate endpoints
- This includes printers, MFPs and faxes.
- Intsights Security is reporting rise of hacking groups in the country of India, which are attacking organizations in the U.S. and include:
- Dropping Elephant
- Viceroy Tiger
- Dark Basin
- ArbiterSports, headquartered in Sandy, Utah, is notifying 540,000 sports referees in the U.S. that their confidential info may have been accessed after ransomware attack.
- Montefiore Medical Center of New York notified 4,000 patients that their PHI was stolen by a former employee.
- IPC Photonics Corp. of Oxford, Mass notified an unknown number of employees and customers
- Integris Baptist Medical Center of Oklahoma City, OK notified an unknown number of patients that their PHI may have been exposed after a portable hard drive was stolen.
- Spokane Regional Health District notified an unknown number of patients that their PHI was exposed after it was accidentally emailed to school administrators of Northeast Washington Educational School District.
- Community Health Services (CHS), a chain of hospitals headquartered in Brentwood, Tennessee, agreed to pay $2.3 million to feds to settle HIPAA non-compliance charges after a breach that impacted 6 million patients.
- Clair County Government of Alabama notified an unknown number of citizens that their info was exposed after ransomware attack.
- Regional West Health Care of Nebraska notified an unknown number of patients that their PHI may have been exposed after “computer outage”
- Nebraska Medicine and Great Plains Health of Nebraska notified an unknown number of patients that their PHI may have been exposed after “computer outage”
- Athens Orthopedic Clinic of Georgia agreed to pay $1.5 million to feds to settle HIPAA violation charges over a ransomware attack that exposed PHI of 655,000 patients.
- Caron Treatment Centers, headquartered in Wemersville, PA notified an unknown number of patients that their PHI was exposed after ransomware incident.
- HIPAA Journal reports that in August, 2020, there was a 63.9% increase in breached medical records.
- 2,167,179 records (PHI) were exposed, stolen or illegally disclosed.
- Forrester Research published report on breaches in 2019:
- 21% = stolen or lost assets
- 33% = external attack
- 21% = 3rd party attack or incident
- 25% = internal incident.
- Malwarebytes Security published results of survey:What impact is COVID-19 having on your cybersecurity team (both personally and professionally)?:
- 90% – A slight rise in the team’s anxiety and stress levels
- 79% – Little or no added anxiety and stress on the team
- 95% – A moderate rise in the team’s anxiety and stress levels
- 94% – The team is now facing major anxiety and stress
- 20% of organizations experienced breach due to remote worker
- 24% of respondents saying they paid unexpected expenses to address a cybersecurity breach or malware attack following shelter-in-place orders.
- 28% of respondents admitted they’re using personal devices for work-related activities more than their work-issued devices
- 61% of respondents’ organizations did not urge employees to use antivirus solutions on their personal devices, further compounding the increase in attack surface with a lack of adequate protection.
- Misty Dawn Bacon, 44, of Morristown, Tennessee pleaded guilty to charges of wire fraud, health care fraud and identity theft in U.S. District Court in Greeneville, TN.
- Posed as a registered nurse and worked for years at several East Tennessee healthcare institutions
- She could face up to 45 years in prison.
- The Department of Homeland Security issued an Emergency Directive requiring federal agencies to install fixes for Netlogon vulnerability in Microsoft Windows Server
- Only 44% of healthcare facilities adhere to NIST (national institute of standards and technology) cybersecurity framework standards according to report from CynergisTek.
- 76% conform with HIPAA Security Rule
Original Post