Difference between revisions of "Security of Protected Health Information"

Revision as of 01:35, 27 April 2022

Introduction

Medical identity theft is one of the fastest growing crimes in the U.S., costing an estimated $30 billion a year and growing ^[1]. For the healthcare industry in 2020, ransomware attacks were responsible for $20 billion lost in impacted revenue, lawsuits and ransom paid, impacting over 600 hospitals, clinics and other healthcare organizations. ^[2] More than 1 in 3 health care organization globally reported being hit by ransomware in 2020 ^[3]

Motivations for cyberattacks

Electronic health record information is extremely valuable: the price of complete record of a single patient can be sold for 100s of dollars on the dark web ^[4] Medical information could allow individuals to gain access to prescription medication, receive medical care or access to their financial data. ^[5] Ransomware attacks can be used to extort money for decrypting as well as not leaking stolen data.

Additional motivations can range from local political, foreign state-sponsored, and terrorist: attackers may seek to disrupt critical human services as a form of political retaliation ^[6]. For example, Boston Children's hospital received a DDoS attack as part of a campaign related to Justina Pelletier, a teen involved in a high-profile custody battle between her parents and the state of Massachusetts ^[7] In the wake of the Russian war in Ukraine, CISA revealed that Russian state-sponsored threat actors were targeting healthcare and pharmaceutical industries and organizations. ^[8]

Cyberattack methods

Threat actors can intercept unencrypted or poorly encrypted data on improperly disposed of electronic media (hard drives, floppy disks, optical media) that contain ePHI. Actors can also plant malicious code onto network machines through email or web downloads^[9]

Insider threats can be particularly damaging – employees with administrative access can physically destroy hardware, plant malicious code, intentionally corrupt data, crash systems quickly and surreptitiously ^[10]

Third party vendors, contractors, temporary employees often have access to valuable data, and they can be exploited or extorted by external parties to leak data. Even housekeepers and maintenance workers may be able to access computer stations left unlocked.^[1]

Social media can be used to conduct social engineering attacks – attackers may use information from social media pages to impersonate or trick healthcare providers into performing actions beneficial to the hacker.^[6]

The COVID pandemic has also heightened vulnerabilities as telemedicine and remote work added more ways into systems, such as through unsecured virtual private networks and compromised home work stations. It has also resulted in the furloughing of network security staff who can prevent and handle threats ^[11]

Data breach consequences

Information breaches can incur both response and logistic expenses as well as loss of productivity and revenue. Secondary losses can include the effect on healthcare provider's reputation. Hospitals may have to pay large legal defense fines as well as judgments from legal or regulatory actions from the government. ^[12]

Cyber attacks can also affect patients: Intermingled records for still in medical identity can lead to dangerous medical outcomes by introducing medical inner inaccuracies.^[1]

Prevention

HIPPA Security Rule Standards:

1. Information Access Management (administrative safeguard)
2. Access control (technical safeguard)

HIPAA regulated entities must implement required implementation specifications, or else document why and implement equivalent alternative measures if reasonable and appropriate. ^[13]

Frequent password changes may help in the case of security leaks, yet make it more likely that they will need to call IT for password resets or write down their passwords on paper notes. Static challenge questions no longer provide necessary safeguards and should be switched to multi-factor authentication ^[1]

A policy that allows providers to “bring your own device” can increase productivity and decrease costs yet create more work due to lack of uniformity ^[6].

Physical safeguards should also be considered: locked doors, property controls (tags, engraving on equipment), personal controls (ID badges, visitor badges), private security ^[14]

A recent report found that external threat actors perpetrated 61% of data breaches, insiders accounted for39%. ^[15] Hospitals should use carefully audited maintenance log to track equipment and facility repairs that affect physical security ^[1]. Human resources should screen new employees for potential liabilities, using criminal records, credit check, drug test, and a search for aliases ^[1]

Recommendations from the American Hospital Association

• Hospital and health system IT and cyber infrastructure teams should subscribe to cybersecurity alerts from the AHA.
• Employ geo-fencing restricting inbound and outbound traffic to certain countries
• Put into place four-to-six buisness continuity plans for all internal and third-paprty mission-critical operations
• Frequently check the redudancy, resiliency and security of the organization's network and data backups - ensure there are multiple copies, including some that exist off-line
• Have a cross-function leadership-level cyber incident response plan which is fully documented, updated and practiced ^[16]

Recommendations from the FBI and CISA

• Ensure multifactor authentication (MFA) is required for all users and properly configured against "fail open" and re-enrollment scenarios
• Implement time-out and lock-out features
• Disable inactive accounts
• Keep software updated, while prioritizing fixes for known vulnerabilities
• Monitor network logs continuously for suspicious activity
• Implement security alerts ^[17]

Examples of Cyberattacks

• July 2020 attack on Family Medical Center of Michigan. The system paid $30K in ransom to cybercriminals. ^[18]
• July 2021 attack on the University Medical Center of Southern Nevada in which patient data was stolen. ^[19]⁠.
• August 2021 attack on Memorial Health System ^[20].
• September 2021 attack on Missouri Delta Medical Center. Stolen medical information was released online ^[21]

References

1. ↑ ^{1.0 1.1 1.2 1.3 1.4 1.5} Phelan, J. (2012). Creating a Trusted Environment: Reducing the Threat of Medical Identity Theft. Healthcare Information and Management System Society, 29. Retrieved from https://risk.lexisnexis.com/cross-industry-fraud-files/docs/healthcare/Creating-Trusted-Environment-Reducing-Threat-Medical-Identify-Theft.pdf
2. ↑ https://illinois.touro.edu/news/the-10-biggest-ransomware-attacks-of-2021.php
3. ↑ Weiner, S. (2021, July 20). The growing threat of ransomware attacks on hospitals. AAMC.
4. ↑ Forensic Readiness. Journal of Medical Systems, 43(1). https://doi.org/10.1007/s10916-018-1123-2
5. ↑ https://healthitsecurity.com/features/ensuring-security-access-to-protected-health-information-phi
6. ↑ ^{6.0 6.1 6.2} Nieles, M., Dempsey, K., & Pillitteri, V. Y. (2017). An introduction to information security. Gaithersburg, MD. https://doi.org/10.6028/NIST.SP.800-12r1
7. ↑ https://www.securityweek.com/hacktivist-gets-10-year-prison-sentence-ddos-attack-hospitals
8. ↑ https://www.dni.gov/files/ODNI/documents/assessments/ATA-2021-Unclassified-Report.pdf
9. ↑ Wilshusen, G. C., & Barkakati, N. (2012). Information security: better implementation of controls for mobile devices should be encouraged : report to congressional committees. Retrieved from http://purl.fdlp.gov/GPO/gpo33062
10. ↑ Engineering Institute, S. (2008). Introduction to Information Security. Retrieved from www.isc.org/index.pl
11. ↑ Weiner, S. (2021, July 20). The growing threat of ransomware attacks on hospitals. AAMC.
12. ↑ Hutton, A., & Jones, J. (2013). Risk Taxonomy (O-RT), Version 2.0.
13. ↑ https://www.hhs.gov/sites/default/files/controlling-access-ephi-newsletter.pdf
14. ↑ CMS. (2007). Security Physical Safeguards. Retrieved from www.cms.hhs.gov/SecurityStandard/
15. ↑ https://enterprise.verizon.com/resources/reports/dbir/
16. ↑ https://www.aha.org/advisory/2022-02-23-us-declares-start-russias-invasion-ukraine-introduces-sanctions-cyber-shields
17. ↑ https://www.cisa.gov/news/2022/03/15/mitigating-threats-posed-russian-state-sponsored-cyber-actors-exploitation-default
18. ↑ https://www.monroenews.com/story/news/2021/09/20/hackers-target-local-health-care-company/8403463002/
19. ↑ https://healthitsecurity.com/news/hospital-ransomware-attack-in-las-vegas-exposes-pii
20. ↑ https://healthitsecurity.com/news/memorial-health-faces-lawsuit-after-hive-ransomware-cyberattack
21. ↑ https://healthitsecurity.com/news/hive-ransomware-continues-to-attack-healthcare-providers

Submitted by Nikhil Kurapati