PA: Einstein Healthcare Network Notifies Patients August Email Hack

The following is a press release that appears totally silent as to why it took from August, 2020, when the breach was discovered, until January, 2021 to disclose this breach. PHILADELPHIA, Jan. 20, 2021 /PRNewswire/ — Einstein Healthcare Network (“Einstein”) previously announced that it began mailing letters to patients whose information may have been involved in a data security incident involving unauthorized access to employees’ email accounts. On August 10, 2020, Einstein identified suspicious activity within a limited number of its employees’ email accounts. Einstein immediately took steps to secure the email accounts by resetting email account passwords and an independent computer forensic firm was engaged to assist with the investigation. The investigation indicated that an unauthorized person gained access to the employee email accounts between August 5, 2020 and August 17, 2020. The investigation was unable to determine whether the unauthorized person actually viewed any emails or attachments in the accounts. Out of an abundance of caution, Einstein reviewed the contents of the email accounts to identify patient information that was contained in the email accounts. Through this review, Einstein  identified emails and/or attachments in the accounts that contained patient information, which may have included some patients’ names, dates of birth, medical record or patient account numbers, and/or treatment or clinical information, such as diagnoses, medications, provider names, types of treatment, or treatment locations. In some instances, patients’ health insurance information, Social Security numbers, and/or drivers’ license numbers were also included in the accounts. This incident did not affect all Einstein patients, but only those whose information was included in the affected email accounts. Einstein has no indication that individuals’ information was actually viewed by the unauthorized person, or that it has been misused. However, as a precaution, Einstein mailed notification letters to those whose information was found in the affected accounts. Einstein also established a dedicated, toll-free call center to answer questions that individuals may have about the incident. Patients with questions can call 1-833-689-1142, Monday through Friday, from 9:00 a.m. to 7:00 p.m. Eastern Time. For patients whose Social Security numbers and/or drivers’ license numbers were identified in the email accounts, Einstein is offering complimentary credit monitoring and identity protection services. Einstein also recommends that affected patients review statements they receive from their health insurers or healthcare providers. If they see charges for services not received, they should contact the insurer or provider immediately. To help prevent something like this from happening in the future, Einstein has reinforced education with its staff regarding how to identify and avoid suspicious emails and is making additional security enhancements to its email environment. Additional information is posted on the Einstein website at SOURCE Einstein Healthcare Network

Vendor ransomware attack by Ryuk impacted 21 healthcare entities in 2019

A recent report headlining that 560 healthcare facilities were impacted by ransomware attacks in 2020 may have seemed shocking until you realize any one ransomware attack can impact multiple hospitals or clinics in a network (just think of the Universal Health Services incident where the Pennsylvania-based system took 400 facilities offline when they were attacked).  In their article, Emisoft had reported that there were 80 ransomware incidents that had impacted at least 560 facilities. There’s another example in the news this week:  a third-party mailing service, Metro Presort, was hit with Ryuk ransomware in May, 2019. Metro refused to pay the ransom demand. At the time of the attack, they were currently servicing 21 healthcare entities, providing mailings, invoices, and other services. So some people had their name, address, and health identification compromised. One of the impacted clients was Salem Clinic, who had 20,928 patients impacted. Another entity was Oregon Heart Center, who had 3,172 people impacted. We did not hear about that report in 2019, though. Nor in 2020, it seems. It was just in the news this week with a statement that in December, OCR had ruled that no violation of HIPAA had occurred, and that it was closing its investigation. But were these reports ever on HHS’s public breach tool? When was HHS actually notified? When were patients notified? You can read Virginia Barreda’s report on Salem Statesman Journal.

Jefferson Healthcare hit by ‘phishing’ cyber attack

Brian Kelley reports: The personal information of roughly 2,550 people was compromised by a “phishing” attack on the email account of an employee at Jefferson Healthcare, the organization announced Monday. The information stolen may have included the full names of individuals, as well as their dates of birth, phone numbers, home addresses, and health insurance information….. Read more on The Ledger.

Attacks targeting healthcare organizations spike globally as COVID-19 cases rise again– Researchers

Check Point writes: At the end of October 2020, we reported that hospitals and healthcare organizations had been targeted by a rising wave of ransomware attacks, with the majority of attacks using the infamous Ryuk ransomware. This followed a Joint Cybersecurity Advisory issued by the CISA, FBI and HHS, which warned of an increased and imminent cybercrime threat to US hospitals and healthcare providers. Unfortunately, that cybercrime threat has worsened over the past two months.  Since the start of November, there has been a further 45% increase in attacks targeting healthcare organizations globally. This is more than double the overall increase in cyber-attacks across all industry sectors worldwide seen during the same time. According to Check Point’s findings, we are not seeing as dramatic an increase in North America as in Central Europe, but the increase is still significant at 37%. Of note, Canada reportedly had the largest increase, at 250%. Ryuk is not one of the ransomware threat groups that maintains a dedicated leak site where they post information or data from some of their reluctant victims, and does not have any visibility into their attacks in the healthcare sector other than what makes the news. Sodinokibi (REvil) does maintain a leak site, however, and this site has reported on some of their attacks against healthcare entities. Conti has also attacked a number of U.S. healthcare entities beginning in the second half of 2020, and we likely have greater awareness of their attacks than REvil’s or Ryuk’s. Read more on Check Point.

Securing Picture Archiving and Communication System (PACS) Cybersecurity for the Healthcare Sector:

NIST SP 1800-24 OCR is sharing the National Cybersecurity Center of Excellence’s (NCCoE) at the National Institute for Standards and Technology (NIST) SP 1800-24, Securing Picture Archiving and Communication System (PACS): Cybersecurity for the Healthcare Sector.  This practice guide can help HIPAA covered entities and their business associates implement current cybersecurity standards and best practices to reduce their cybersecurity risk, while maintaining the performance and usability of PACS: NIST CYBERSECURITY and PRIVACY PROGRAM Securing Picture Archiving and Communication System (PACS)—Cybersecurity for the Healthcare Sector: NIST SP 1800-24 A new NIST Cybersecurity Practice Guide, NIST SP 1800-24, is now available: Securing Picture Archiving and Communication System (PACS): Cybersecurity for the Healthcare Sector. Medical imaging plays an important role in diagnosing and treating patients. The system that that manages medical images is known as the Picture Archiving Communications System (PACS) and is nearly ubiquitous in healthcare environments. PACS fits within a highly complex healthcare delivery organization (HDO) environment that involves interfacing with a range of interconnected systems. This complexity may result in cybersecurity risks that could potentially compromise the confidentiality, integrity, and availability of the PACS ecosystem. The National Cybersecurity Center of Excellence (NCCoE) at NIST analyzed risk factors regarding the PACS ecosystem by using a risk assessment based on the NIST Cybersecurity Framework and other relevant standards. The NCCoE developed an example implementation that demonstrates how HDOs can use standards-based, commercially available cybersecurity technologies to better protect the PACS ecosystem. The NCCoE’s practice guide NIST SP 1800-24, Securing Picture Archiving and Communication System, will help HDOs implement current cybersecurity standards and best practices to reduce their cybersecurity risk, while maintaining the performance and usability of PACS. The final practice guide, which in addition to incorporating feedback from the public and other stakeholders, builds on the draft guide by adding remote storage capabilities into the PACS architecture. This effort offers a more comprehensive security solution that more closely mirrors real-world HDO networking environments. Publication details: NCCoE PACS homepage: READ NOW. Source: NIST