Archive | Articles RSS feed for this section

Effectively Combatting Spear-Phishing

August 24, 2012 by Dr. Michael G. Mathews 0 Comments

Many of our customers have been concerned about the growing number of Phishing attack vectors.  Neil Buckley, our VP, Technical Services had the following to say in connection with this recent post on infosecurity.com.

“Proofpoint and many other security products combat spear-phishing and create an excellent foundation to build effective and efficient process to support risk management of the email platform.  If you don’t have a platform to manage these risks, attend the seminar and get something like this in your priority pipeline.  Also consider, spending time on the root cause of a successful spear-phishing attack.  The human behind the keyboard will defeat the best security technology every time, ensure that you are getting the most out of your risk management effort and invest in the training and awareness support programs that truly address the root cause issue, look at complimentary products to Proofpoint, such as Wombat Technologies.”

Articles
, , , ,
AMED News

Patients worried about medical records going digital

August 21, 2012 by jaredwilliams1234 0 Comments

Many Americans — 85% in a new survey — report having fears about the privacy of their records as more physician practices adopt EHRs.

By PAMELA LEWIS DOLAN, amednews staff. Posted Aug. 20, 2012.

It took some time to get a majority of physicians in the U.S. to agree that it would be beneficial to implement electronic health records in their practices. Now, a survey finds, the most skeptical audience for EHRs is patients.

A survey of more than 2,100 patients by Xerox found that only 26% want their medical records to be digital, down two percentage points from a year ago. Only 40% believe EHRs will result in better, more efficient care. And 85% expressed concern about digital records. Their main worries: privacy and security of their information.

When asked what, specifically, worries them about EHRs, respondents said they were concerned that their information could be stolen by a hacker (63%), the files could be lost, damaged or corrupted (50%), their personal information could be misused (51%), or a power outage or computer problem could prevent doctors from accessing their information (50%). Fifteen percent said they had no worries.

There are many things in medicine that patients tolerate but don’t necessarily like. If most physicians will be electronic soon anyway, some physicians may wonder why it’s important to convince their patients that EHRs are a good thing instead of just letting them learn to live with them.

As the health care system shifts from one that focuses on acute care and treating patients who are sick to one that promotes wellness, “We need the patients as active participants,” said Philip Payne, PhD, chair of the Ohio State University College of Medicine’s Dept. of Biomedical Informatics. The EHR is an important tool to engage patients, he said.

Despite the benefits an EHR might bring, major data breaches are announced on virtually a weekly basis. For example, in the summer of 2012, a computer containing the medical information of 2,500 patients from the Stanford (Calif.) Hospital & Clinics and the School of Medicine was reported stolen. In Connecticut, information on more than 7,461 VNA Healthcare patients and 2,097 Hartford Hospital patients was lost when a computer belonging to a data analysis vendor was stolen. Beth Israel Deaconess Medical Center in Boston announced that the health information of 3,900 patients was put at risk when a physician’s personal laptop was stolen.

How to give assurance

The main message physicians should be spreading to patients who are concerned about breaches is that “people do bad things, whether it’s in paper form or electronic form,” said Mary Griskewicz, senior director of ambulatory health information systems for the Healthcare Information and Management Systems Society.

Michael Hobaugh, MD, PhD, chief of medical staff at La Rabida Children’s Hospital in Chicago, said if patients express concerns about data safety, physicians can tell them that there are many safety features of an EHR that patients never had with paper.

“The biggest assurance that patients have regarding electronic medical records is that anytime anybody looks at something or prints something, there is a record of who did it,” Dr. Hobaugh said. “That was not true of paper charts.”

Christine Bechtel, vice president of the National Partnership for Women and Families, said a survey her organization conducted, similar to the one by Xerox, found respondents rating EHRs higher than paper across the board in various safety and quality measures. She said the survey, released in February, shows that even if patients worry about their own information, many are showing confidence in EHRs in general.

Griskewicz said physicians need to be educated on how and when to engage consumers when it comes to technology adoption. HIMSS launched the HIMSS eConnecting with Consumers Committee this year, whose focus is to provide physicians with tools and education surrounding patient engagement and technology.

Many patient concerns stem from the fact that the value of EHRs has not been made clear to patients, Payne said.

“We really have to figure out how we make the EHR a focal point of collaboration between patients and members of multidisciplinary care teams rather than just a thing that’s in the room that we have to use to document so we can bill,” he said.

What patients think about EHRs

A survey found that patients have concerns when it comes to electronic health records, mainly about risks to their private information.

63%: With EHRs my information could be stolen by a hacker.
51%: My personal information could be misused.
50%: Digital medical records could be lost, damaged or corrupted.
40%: Digital records mean better, more efficient care.
31%: I feel I am adequately informed about when and how my medical records are used.
26%: I want my records to be digital.
26%: EHRs have improved my interactions with my physician office.
24%: My doctor involved me in the conversion from paper to electronic.
21%: I expect EHRs to improve the quality of service I receive.
14%: I think my health care provider is technically savvy enough to use EHRs.

Source: Third annual electronic health records survey, Xerox, July

Articles
, , , , , , , , , ,
Bloomberg

Hackers Encrypt Health Records And Hold Data For Ransom

August 21, 2012 by jaredwilliams1234 0 Comments

By Jordan Robertson – Aug 10, 2012 12:00 PM CT

As more patient records go digital, a recent hacker attack on a small medical practice shows the big risks involved with electronic files.
The Surgeons of Lake County, a medical facility in the northern Illinois suburb of Libertyville, revealed last month that hackers had burrowed deeply into its computer network, infiltrating a server where e-mails and electronic medical records were stored, Bloomberg.com reported on its Tech Blog.
Unlike many other data breaches, the hackers made no attempt to keep their presence a secret. In fact, they all but fired a flare to announce the break-in, taking the extreme step of encrypting their illicit haul and posting a digital ransom note demanding payment for the password.
The doctors turned the server off and notified the authorities, refusing to pay.
“This story is so ironic — most people worry that their health records will be spread all over their local newspaper,” said Dorothy Glancy, a professor at Santa Clara University’s law school who specializes in digital privacy. “But in this case, the doctors — in fact, nobody — can access these records.”
The Surgeons of Lake County isn’t the first health care provider to be targeted by extortionists. The incident, which was spotted by privacy blogger Dissent Doe in a federal database of health-related breaches, showcases an unsettling new strain of opportunism that is emerging as criminals try to exploit the industry’s shift to digital medical records.

Data Breach

The attackers’ choice of tactics, particularly the use of encryption, indicates a level of sophistication and targeting that suggests they knew what they were doing, said Rick Kam, president of ID Experts, a Portland, Oregon-based company that makes data-breach prevention technology and specializes in health care.
Based on the number of practices moving to electronic health records, “many more” of these types of breaches should be expected, Kam wrote in an e-mail.
Until now, medical-data blackmail has been a niche crime, largely because of the difficulty and risk involved. Spam and online bank fraud are easier ways for fraudsters to make money.
One case involved Express Scripts (ESRX), the large prescription- drug benefits manager, and a threat it received in 2008. Someone sent the St. Louis-based company personal information on about 75 of its members, including identification numbers and prescription records, and demanded an unspecified sum. The company refused to pay, and eventually told 700,000 customers that their information could have been exposed.

Patient Confidentiality

In 2003 and 2004, health care facilities came under fire for outsourcing their transcription chores when several California hospitals were blackmailed by their own workers in India and Pakistan.
The spiraling cost of health care and lack of insurance for millions of people have made medical identity theft a growing risk. Security and privacy risks are also emerging with the creation of “health information exchanges,” vast databases that states are setting up to handle electronic medical records.
It’s unclear whether the Illinois surgical center’s records were backed up or have been recovered. The organization declined to comment.
“Safeguarding every patient’s personal information is a top priority at the Surgeons of Lake County,” Scott Otto, the center’s president, said in a statement. “We are devoting significant people and technological resources to help protect patient confidentiality.”
For all of the benefits of making health records electronic, this incident highlights a downside, said Santa Clara University’s Glancy.
“This is a warning bell,” she said. “Maybe they’re the canary in the coal mine that unpredictable things can happen to data once it’s digitized.”

Articles
, , , , , , , , , , , , ,
LOGO-CIO

One Cheap and Easy Thing All Companies Can Do to Boost Security

July 26, 2012 by Stephanie Crabb 0 Comments

Event logs are the basic text of what happens in your corporate systems. So why do so many companies ignore them?

We love this blog post by Constantine von Hoffman - http://advice.cio.com/security/17256/one-cheap-and-easy-thing-all-companies-can-do-boost-security which we have reposted below.

In fact, we had a vibrant discussion about this very topic internally yesterday.  We might take a bit of exception to the assertion that log review is “cheap and easy.”  I mean, if it were so cheap and easy, wouldn’t most organizations be doing it?

What we find in healthcare is that the logs are so voluminous because there are so many disparate systems and devices in play.  Most organizations report to us that it is simply impossible, based on the way they are resourced, to have any kind of meaningful log review and log management program.  Further, it is hard to translate for the “non-techies” in risk management how this process is vital to enterprise risk management.  So what happens?

Higher performing organizations are collecting and archiving the logs from most of their systems so that they have them “handy” in the event that they need them to support an investigation or incident response.  Maybe a few of those high performers review logs for their high value/high risk systems routinely.  The highest performers have dedicated the resources required – through the internal investment in tools and/or staff or via outsourcing to an MSSP – to implement an operationally-relevant and compliance-aware log management program.

That said, more often than not, we encounter organizations that don’t know what they are collecting, how they have auditing capabilities enabled in their systems, and have no log review or log management program in place.

The operational relevance is obvious, but in healthcare, we have that little regulation better know as the HIPAA Security Rule that specifically culls out “user activity monitoring” as an implementation specification.  An effective log management program goes a long way to meeting this compliance requirement.

Based on the recent summary report from the first 20 OCR audits,  what was the single greatest deficiency or area of non-compliance vis-a-vis the HIPAA Security Rule?  You guessed it (and if you are a regular reader, you’ve read it here before)…User Activity Monitoring.

In our discussions with OCR, it is clear that this facet of an organization’s information security program is going to continue to be carefully reviewed and scrutinized.  So, whether via a formal audit, breach or complaint investigation, be prepared to have your log management program under the microscope.

It is our belief, from our 10+ years of experience and service to the healthcare industry, that few organizations are on a trajectory for IT security staffing to effectively implement an organic log management program.  After all, your core business is healthcare and your team should be focused on the enablement of care.  As we have mused in previous posts, maybe this is the time for organizations to make an active choice to engage security experts to support their security functional requirements, particularly those that really lend themselves well to outsourcing, like log monitoring and management.

Of course, at CynergisTek, we have a solution for this and we would be happy to talk with you more about what we are doing and how we have chosen to help our clients address this gap.  But what we really hope this post compels, is a change in the conversation that you are having internally.  Does it really make sense to build an information security empire within your healthcare organization or does it make better sense to be a healthcare center of excellence that practices good security?  That is a strategy and tactical discussion that we would love to support you with if our experience can be of help.

Make it a good day!

 

————————————————————————————————————————————–

The business equivalent to the personal -security sin of using the word “PASSWORD” as your password: Not collecting and reviewing the data from all your system logs. Chances are you’re not doing that. And you should feel guilty about it. But you can take some comfort in knowing you’re not alone.

“Relatively few do it,” says Sherri Davidoff, co-author of the startlingly well-written new book Network Forensics: Tracking Hackers Through Cyberspace. “Mostly it’s companies in the financial sector which are at risk of losing money directly from being attacked.”

The truth is most companies don’t know when they’ve been hacked. That’s not just Davidoff’s opinion. I’ve been told the same thing by folks in the security industry and in law enforcement. One agent from the FBI said he stopped counting the number of times he told IT execs about attacks that they knew nothing about.

Why does this happen? Companies don’t regularly review their event logs to see what’s going on in their own systems.

It astounds me that checking event logs is so uncommon. It’s kind of like checking to make sure you didn’t leave the key in your door lock, folks. You’re probably wagging your head in disbelief, too, because no CIO.com reader could be that clueless…could they?

Just in case you decide to pass this post along to someone who works at one of those other companies, I will explain why event logs matter:

  • They contain lots of info directly relating to your network, like DHCP lease histories and/or network stats.
  • They include records of network activity including remote login histories.
  • Because they have been transmitted over your network they create network activity.

If you want to find anomalies or unauthorized/unexpected users, the information is all there in event logs.

What is even more baffling about the fact that these logs so frequently go unreviewed is that companies don’t have to check logs manually. They don’t have to sort through all the different log formats to figure this stuff out. There are a lot of programs that will do all of this. All you have to do is read the report.

“You want to make sure you’re not the lowest fruit on the tree; that you’re not the most vulnerable,” says Davidoff. “Fortunately or unfortunately, that’s not that hard to do.”

PS: I read a lot of computer-related books. In most cases I would rather try to read machine code. That is why I have to point out that Network Forensics is actually well-written. It is a text book that you can read and really learn things from. You probably went to college, so I don’t have to tell you how rare that is.

Articles
, , , , , , ,
LOGO-EHR Incentive Program

It’s Official…CMS Audits of Meaningful Users Commence

July 24, 2012 by Stephanie Crabb 0 Comments

From Ober Kaler’s Health Law Alert Newsletter, 2012: Issue 12 – Focus on HIPAA/Privacy we learn from James B. Wieland and Joshua J. Freemire that it is “unofficially official” – audits of meaningful users have begun.

Are Mandatory 14/15 the chink in a meaningful user’s armor?  After all, the other core measures are explicit and require daily measurement.  Most meaningful users have cracked the code on such measurement and reporting.  But what is the measurement to demonstrate that your organization is “protecting electronic health information” with the same vigilance and accountability as you perform against the other core measures?

Did you perform or review a risk analysis consistent with the ONC’s published guidance?  A real risk analysis?

Do you have a documented plan to remediate any deficiencies or unacceptable risks? 

How do you document your performance against that plan?  It is probably unrealistic, impractical or of little value to measure daily, but can we agree that a monthly “status” is reasonable?  If so, is your organization performing to that level?

Do not let the simplicity of the “check box” for Mandatory 14/15 on the attestation profile fool you into a false sense of security (no pun intended) about your organization’s performance.  In fact, in its simplicity it may represent the greatest risk to your organization in the event of an audit.

The cost/benefit analysis here is really a no-brainer when you consider the penalty for a fraudulent attestation could be as much as 3x the stimulus your organization has received.  If there is any doubt in your organization’s mind that you have met the requirement of Mandatory 14/15, now is the time to take action.

Wieland and Freemire write:

A number of health care providers that attested to Meaningful Use for Stage 1 have received a letter from an Figloiozzi and Company, acting as CMS’s auditor for the EHR Incentive Program (the “Program” or “Meaningful Use Program”), requesting certain records related to the attestation. CMS has not, as of this writing, made any announcement of this audit initiative or of the engagement of Figloiozzi and Company. While it is always good policy to confirm the identity and authority of any entity claiming a right to review or audit records, these letters are legitimate. Citing its statutory authority under the American Recovery and Reinvestment Act (ARRA), and without any fanfare, CMS has begun to audit the attestation materials.

The letters from Figloiozzi and Company, as the Department of Health and Human Services (HHS) Secretary’s designee, request four categories of information:

  • Audited entities are asked to produce a copy of their certification from the HHS Office of the National Coordinator for Health Information Technology for the technology they used to meet Program requirements. Presumably, this documentation will be used to demonstrate that the entity “possesses” a certified Electric Health Record technology system as required under Program rules.
  • Audited entities are asked to provide documentation to support the method (observation services or all emergency department visits) they chose to report emergency department admissions. This distinction plays a large role in several of the Program requirements as it determines which patients were included in the denominators of certain meaningful use core and menu items.
  • Audited entities are asked to supply supporting documentation with regard to their completion of the attestation module responses as to core set objectives and measures. While the audit letter’s request is not specific, it would appear that this request is intended to solicit information beyond that already provided to CMS as part of the attestation process. A hospital might consider, for instance, producing reports substantiating the encounters that gave rise to the calculation relied upon to successfully attest. Such reports should be deidentified.
  • Audited entities are asked to supply supporting documentation with regard to their completion of the attestation module responses as to “menu set” or voluntary, objectives and measures. Again, the information request appears to solicit a level of information beyond that provided in the attestation documents themselves.

Based on questions from recipients, an amended version of the audit letter has been sent out, adding “(i.e., a report from your EHR system that ties to your attestation)” to the latter two categories of requested documentation. This clarifies that the audit letters seek additional detailed information but are not, at this time, requesting identifiable or detailed patient records.

The audit letters do not provide audited entities much time to respond – a short, two-week response time is specified. Unfortunately, it is also unclear how audit candidates are selected, so hospitals and professionals will not be able to “plan ahead” for an audit they can be certain is coming.

You may also appreciate an article on FierceEMR today by Marla Durben Hirsch on this topic:  CMS starts Meaningful Use attestation audits – FierceEMR http://www.fierceemr.com/story/cms-meaningful-use-attestation-audits-providers/2012-07-23#ixzz21VMMAsFc

To learn more:
- here’s some general information from CMS
- read the GAO report
- check out the FAQ

Articles
, ,
LOGO-2012 Most Wired

Hospitals & Health Networks Releases 2012 “Most Wired” Survey

July 11, 2012 by Stephanie Crabb 0 Comments

2012 Survey Dives Deeper into Information Security and Data Protection Practices 

With a little nudge and some suggestions from CynergisTek, and an active and interested listener in Suzanna Hoppszallern from H&HN, the 2012 Most Wired Survey included its most robust information security question set to date.

In recent years, and particularly with the rise of the EHR and information exchange, we found ourselves asking, “Can a health system really be considered or consider itself ‘most wired’ if it does not have a high-performing security controls environment worthy of the moniker?”  So, rather than ask ourselves that question for another year, we approached Suzanna Hoppszallern who was extremely interested in our thoughts and thought process.  The result was a revised and more detailed set of information security and data protection related questions in the 2012 survey.

So, what were the findings?  As conveyed in the featured cover article in H&HN this month:

Most Wired hospitals are more prepared than their counterparts for security breaches and employ more advanced security tools to protect patient data. Ninety-three percent of Most Wired hospitals employ intrusion detection systems compared with 77 percent of the total respondents. “Half of risk mitigation is knowing what is going on in your enterprise,” says Mac McMillan, CEO, CynergisTek Inc., and former chair of a Healthcare Information and Management Systems Society’s security working group. “Most Wired hospitals are implementing more sophisticated IT security architectures and are better informed.” Many organizations still do not perform risk analyses and penetration testing on a regular basis. “What it tells us is that we still have relatively immature risk management for the most part in the industry,” McMillan says.

Here are a couple of excerpts from the survey data:

Annual testing and risk assessments

Security measures hospitals use for authorized users


Over 200 hospitals and health system earned the 2012 “Most Wired’ designation and their commitment to information security, patient privacy and data protection as reflected in the more rigorous survey process is to be commended.

For the full H&HN article visit: http://digital.hhnmostwired.com/DigitalAnywhere/viewer.aspx?id=2&pageId=1

Articles
, , , ,
Older Entries

%d bloggers like this: