HIMSS17 – Are medical devices the weak link in cyber security?

According to a post on HIPAA Journal, 60% of healthcare organizations have already introduced networked medical devices into their technical infrastructure. Networked medical devices are the healthcare version of the “internet of things” (IoT) – smart devices that communicate with applications, such as the EHR, and with one another without human intervention. The problem – many medical devices aren’t cyber-secure!  89% of the organizations reporting the use of networked medical devices also repor ...

Focus on Technology: Change Your Router Passwords!

One of the most common services in healthcare is the connection to the internet. With all the focus on security and cyber breaches, one of the most vulnerable pieces on your connection to the internet is what is called the router / gateway. The router / gateway connects your computers and devices to the public internet and in many cases provides the initial security or barrier through the use of a built-in firewall. The problem is, that while this is the door, the gateway to the internet, it is a two way ...

Why using Gmail, Yahoo Mail, or Hotmail in healthcare is bad

Time and time again we see healthcare organizations using free email accounts. While convenient, it is an extremely dangerous decision in a world where HIPAA fines are increasing in cost and occurrence. If you or your employees have access to or use the free email services from you organization’s network, either officially for business and/or for personal use, you are at an extreme risk of being breached! Why? Think about what can be sent via email. Whether you are using email to send patients r ...

Experian predicts more pain and suffering for healthcare industry

Experian released their fourth annual 2017 DATA BREACH INDUSTRY FORECAST. It covers several industry specific predictions, including Healthcare.  If you haven't heard, healthcare is under attack and it's going to be full on war in 2017.  The cyber attackers are expected to re-invest funds to create more sophisticated software and better targeting of data to steal. A few points made in the report: Protected Healthcare Information (PHI) or patient records are one of the most valuable sources of data ...

Protect your patients, protect your practice, protect yourself.

The healthcare industry is beginning to realize that HIPAA is here to stay and they are probably going to be audited sooner or later.  What physicians and all healthcare providers need to understand is that if you don't protect your patients' PHI/ePHI the following can happen to your patients as a result of their identity being stolen and used. NOT Protecting Your Patients' (PHI/ePHI): You can cause them financial difficulties or even financial ruin. You can cause them undue stress, even a str ...

Misconceptions Lead to False Sense of Security

In mid-August, The National Law Review reported the Office for Civil Rights (OCR) announced it would focus more on smaller breaches, those affecting less than 500 individuals.  I think this reflects the growing concern that Small to Medium Business (SMB) are more vulnerable.  They are also less capable of detecting, responding to and reporting breaches.  IBM estimates that 80% of cyber thefts suffered by SMBs go unreported.  This is due to lack of detection, embarrassment, and fear of social media backl ...

OCR HIPAA Audits: Don’t gamble your organization’s solvency

Risk of Random Selection for an OCR Audit: 1%-5% In July of this year, the OCR began Phase II of their HIPAA Compliance Audit process. They randomly-selected 167 Covered Entities for a “desk audit” and plan to conduct an additional 50-75 onsite audits over the course of the year. A similar process will be used to select and audit a sample of Business Associates beginning in September. Given the hundreds to thousands of Covered Entities and Business Associates in any particular category, the risk o ...

Healthcare under attack by new strain of ransomware

FireEye Labs has identified massive email campaigns by cyber-criminals during Aug, 2016 containing the Locky ransomware embedded in DOCM attachments.  DOCM is Open XML Macro-Enabled Document file used in Microsoft Word.  Which means the file contains a macro which MS Word will execute when you open the file in MS Word.  Healthcare is the leading industry targeted by the campaign. The healthcare industry is now the "industry of choice" by cyber-criminals since Protected Health Information (PHI/ePHI) i ...

Healthcare entity leaves its patients exposed after breach

  Athens Orthopedic Clinic (AOC) in Georgia, suffered a cyber-attack in June of 2016 that impacted roughly 200,000 patients.  If that's not bad enough, AOC is not able to pay for extended credit monitoring for its victims.  The healthcare industry, including small, single doctor practices, needs to sit up and take notice. Cyber criminals are at your back door, front door and trying to crawl through your networks.  You need to take action to Defend, Detect, and Defeat cyber breaches from steal ...

Focus on Security: Top Ten Tips for Cyber-Security for Small Businesses

I know it's getting old and boring, but cyber-criminals are focused on PHI, which means we, in healthcare, need to take action to protect it. The SBA has a helpful list of cyber-security tips posted on their web site.  It's a great starting point to harden your defenses and defend against the highly likely cyber-breach.  Here's a summary of what's covered. Protect against viruses, spyware, and other malicious code Secure your networks Establish security practices and policies to protect ...

1 2 3 4 5