The cyber-attack against Anthem Inc., which the insurer says may have started with a spear-phishing campaign targeting five of its employees, is a warning sign of the kinds of sophisticated schemes that may be common in the year ahead.   If the Anthem breach is a result of phishing it’s emblematic of what many security experts are expecting to see in the evolution of attacks against companies and their employees.   Risks From Social...

Sony, Target, Home Depot, Wyndham, T.J. Maxx, Apple, Staples, Hannaford Brothers, Anthem.   You’re probably glad that your company hasn’t been in the news for the last few years like those companies. What do they all have in common? They all had their customers’ personal data stolen in a data breach. Every single on of these companies has paid or will pay hundreds of thousands or millions of dollars as a result of their breaches.   Is...

In January, 2015, the Office for of Civil Rights (OCR) at the Department of Health and Human Services (DHHS), highlighted increased cybersecurity risks for healthcare companies under strict obligations to protect sensitive patient data.  As cyber-attacks of these entities increase, so do HIPAA privacy breaches.  The OCR is seeing a rise in the number of people affected by hacking and IT breaches as reported by entities under the breach...

The FBI has reported that hackers have been increasingly targeting health care related IT systems and warned that the hackers may be seeking to obtain patients’ Protected Healthcare Information (PHI). With the January 2015 deadline to transition to EHRs approaching, the FBI warns that hackers are likely to seek to exploit vulnerabilities. The FBI also stated that in addition to targeting PHI “these actors have also been seen targeting...

Due to widespread noncompliance with the HIPAA Security Rule, the next phase of HIPAA audits will focus on electronic protected health information (e-PHI) security. Although this shouldn’t catch anyone off guard, the HHS OCR expects these audits to result in increased penalties for violations. Health care providers and their business associates, who are subject to the Security Rule, need to review the status of their HIPAA Security Rule...

A recent breach at JPMorgan Chase has highlighted the need for anyone who deals with personal information to safeguard all data. While at first glance a data breach at a bank may not seem to be pertinent for a hospital or a clinic that data that was stolen shows otherwise. The hackers responsible for the Chase breach didn’t still account information or other data that most people consider important at first glance. The data stolen was...

$150K HIPAA Fine for Unpatched Software, OCR Imposes Penalty on Alaska Mental Health Provider   Federal regulators sent a message about the importance of applying software patches when they dropped a $150,000 HIPAA sanction on Anchorage Community Mental Health Services. The Department of Health and Human Services’ Office for Civil Rights says ACMHS failure to apply software patches contributed to a 2012 malware-related breach that...

The results of the U.S. Department of Health and Human Services’ (HHS) Office of Civil Rights (OCR) health information audit pilot program may be alarming to many health care providers, health insurers, and their business associates. OCR Senior Adviser Linda Sanches recently reported the results of the audits which were conducted by HHS-contracted KPMG.  The vast majority of the audited organizations failed to comply with mandatory...

Mobile devices in the workplace present challenges for many businesses however, few industries have as much at stake when it comes to the value of the information and government regulation as the health care industry does. Here are six things to keep in mind when dealing with mobile devices in healthcare.   Create an updated inventory of mobile devices. Many healthcare providers don’t keep an accurate inventory of digital devices. Both...

When it comes to preventing IT security breaches in the healthcare industry a little bit of diligence goes a long way. In an annual report to Congress covering breaches of unsecured PHI in 2011-2012, the Department of Health and Human Services established that most breaches could have been prevented with basic security protocols. The vast majority of breaches fall into one of three categories: theft, loss, or unauthorized access/disclosure. In...