The cyber-attack against Anthem Inc., which the insurer says may have started with a spear-phishing campaign targeting five of its employees, is a warning sign of the kinds of sophisticated schemes that may be common in the year ahead.   If the Anthem breach is a result of phishing it’s emblematic of what many security experts are expecting to see in the evolution of attacks against companies and their employees.   Risks From Social...

Sony, Target, Home Depot, Wyndham, T.J. Maxx, Apple, Staples, Hannaford Brothers, Anthem.   You’re probably glad that your company hasn’t been in the news for the last few years like those companies. What do they all have in common? They all had their customers’ personal data stolen in a data breach. Every single on of these companies has paid or will pay hundreds of thousands or millions of dollars as a result of their breaches.   Is...

In January, 2015, the Office for of Civil Rights (OCR) at the Department of Health and Human Services (DHHS), highlighted increased cybersecurity risks for healthcare companies under strict obligations to protect sensitive patient data.  As cyber-attacks of these entities increase, so do HIPAA privacy breaches.  The OCR is seeing a rise in the number of people affected by hacking and IT breaches as reported by entities under the breach...

Numerous government regulators have named cybersecurity as one of their top priorities in 2015. One of these regulators, the Securities and Exchange Commission, has emphasized the importance of assessments of cybersecurity risk and preparedness, as well as providing information on priorities and timing of their 2015 examination and audit programs. Securities and Exchange Commission On January 13, 2015, the SEC announced its 2015 examination...

The FBI has reported that hackers have been increasingly targeting health care related IT systems and warned that the hackers may be seeking to obtain patients’ Protected Healthcare Information (PHI). With the January 2015 deadline to transition to EHRs approaching, the FBI warns that hackers are likely to seek to exploit vulnerabilities. The FBI also stated that in addition to targeting PHI “these actors have also been seen targeting...

Due to widespread noncompliance with the HIPAA Security Rule, the next phase of HIPAA audits will focus on electronic protected health information (e-PHI) security. Although this shouldn’t catch anyone off guard, the HHS OCR expects these audits to result in increased penalties for violations. Health care providers and their business associates, who are subject to the Security Rule, need to review the status of their HIPAA Security Rule...

A recent breach at JPMorgan Chase has highlighted the need for anyone who deals with personal information to safeguard all data. While at first glance a data breach at a bank may not seem to be pertinent for a hospital or a clinic that data that was stolen shows otherwise. The hackers responsible for the Chase breach didn’t still account information or other data that most people consider important at first glance. The data stolen was...

$150K HIPAA Fine for Unpatched Software, OCR Imposes Penalty on Alaska Mental Health Provider   Federal regulators sent a message about the importance of applying software patches when they dropped a $150,000 HIPAA sanction on Anchorage Community Mental Health Services. The Department of Health and Human Services’ Office for Civil Rights says ACMHS failure to apply software patches contributed to a 2012 malware-related breach that...

The healthcare sector is increasingly becoming a target for cybercriminals and with a plethora of valuable information and inconsistent security procedures it’s easy to see why it’s an enticing target. In this environment of ever increasing risks, it’s critical that healthcare organizations and their business partners implement information security management practices that go far beyond just focusing on HIPAA compliance.   One of...

Third-party vendor risk management is important and vital for proper governance, but it shouldn’t become an overwhelming chore for your bank. If it is there’s a chance that you’re interpreting the guidance from the Office of the Comptroller of the Currency and the FDIC too literally. The key to everything is risk management, not risk elimination. The OCC’s guidance does not mandate that banks eliminate all risk, just that they...