Menu
While technological advances have contributed to the increased quality of patient care and reduced costs in providing care, it has also greatly increased the threat of cyber-attacks. The Department of Health and Human Services (“HHS”) found that “health care has the highest cost for data breaches.” Thus, pursuant to the congressional mandate contained in the Cyber-security Act of 2015, HHS along with partner groups and cyber-security experts have released guidance on what the best practices to address cyber-security threats facing the healthcare industry.[1]
The official position taken is that the practices described are meant for “informational purposes only” and are not “required by nor guarantees compliance with federal, state, or local laws.”[2] While this may be the intention of HHS, under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and Health Information Technology for Economic and Clinical Health (“HITECH”) Act and the implementing regulations, part of the basis for determining the amount a civil penalty assessed against an entity may be after a breach occurred is whether it exercised “reasonable diligence”[3] or whether the cause of the breach “was due to reasonable cause and not to willful neglect.”[4] Thus, compliance with the practices in the HHS Guidance will likely be highly relevant when determining whether an entity’s practices were reasonable when assessing a penalty against an entity for a breach of protected health information (“PHI”).
Recent Examples of Cyber AttacksIn recent years there have been numerous stories of health care entities facing cyber-attacks. In one attack in 2016, a private hospital suffered a ransomware attack, freezing all the computers at the hospital.[5]
Patient records, schedules, and documents could not be accessed, and many practitioners were required to revert to pen and paper documentation while the system was down, and many patients had to be transferred.[6] The Hospital was only able to regain access when it paid the ransom demanded, though there is never a guarantee that acquiescing to a malicious actor’s demands will result in regaining control of a system.[7]
In another attack on an orthopedic practice, more than 500 patient profiles were stolen and put up for sale on the dark web. [8] The data included names, addresses, social security numbers, and other valuable information that can assist in identity theft.[9]
Another case involving a ransomware attack froze a rural hospital’s electronic health record system (“EHR”).[10] While the hospital did not pay the demanded ransom, it did have to replace its entire EHR system.[11] Recently, it has been disclosed that an authorized party had access to a system at a Missouri rehabilitation center that lasted approximately three months and potentially exposed the data of more than 4,000 patients.[12] The breach was not identified for more than a month after it occurred.
HHS identified the five biggest threats facing the healthcare industry, which are: (1) e-mail phishing attacks; (2) ransomware attacks; (3) loss or theft of equipment or data; (4) insider, accidental or intentional data loss; and (5) attacks against connected medical devices that may affect patient safety.[13] HHS defined “threat” as “internal or external activities or events that have the potential to negatively impact the quality, efficiency, and profitability of” an entity.[14] Threats often exploit vulnerabilities in an entity’s system or policies, which “are weaknesses that, if exposed to a threat, may result in harm and, ultimately, some form of loss.”[15]
An e-mail phishing attack is an attempt to trick an entity by sending an email which appears to come from a legitimate source, but which often has a link or attachment that when clicked may attempt to obtain information from the recipient or infect the system with malicious software (“malware”). When an email is received, the recipient should determine whether it came from a legitimate sender, even if the email appears to come from within the entity. The recipient should check to determine if there are any indicators that something is wrong with the email, such as spelling or grammatical errors. By hovering on the email address (but not clicking) the recipient may be able to determine where the email was sent from.
Ransomware is a specific type of malware which denies a user access to data, often through encryption in which only the malicious actor has the key until a ransom is paid. Ransomware may also be used to remove data or install some other form of malware and is often contained in a phishing email.[1]
This can often occur when data is kept on mobile devices, such as laptop, smartphones, tablets, or USB/thumb drives. [1] Loss or theft of such a device can occur easily but can result in a breach of an entity’s system and breach of patients’ PHI. This has recently occurred in a Michigan when a laptop belonging to a Blue Cross Blue Shield of Michigan employee was stolen and potentially 15,000 customers may have had their data breached[2]
This is a threat that can happen due to an honest mistake, a gap in an entity’s procedures, or negligence. It can also happen when an actor inside the entity is seeking to steal information for malicious reasons, such as identity theft.[1]
Medical devices, such as a heart monitor, may be connected to a computer network for monitoring purposes. However, a malicious actor that gains access to an entity’s network may also be able to cause harm through access to medical devices, such as by turning them off or causing them to reboot.
HHS has broken its guidance down based on whether the entity is small, medium, or large.[22] While there is no strict definition, they did create a chart to assist practitioners in determining where they may fall.[23]
However, the recommendations fall into ten basic categories: (1) e-mail protection systems; (2) endpoint protection systems; (3) access management; (4) data protection and loss prevention; (5) asset management; (6) network management; (7) vulnerability management; (8) incident response; (9) medical device security; and (10) cyber-security policies. While this article will not address every recommendation, it will discuss some of the recommendations for each category. It should be noted that not every recommendation or even every category applies to every entity, and every entity must ensure that the practices it implements are appropriate and reasonable for its business.
The extraordinary, and often quickly, changing nature of the technological landscape has allowed for increased patient care, often at reduced costs to an entity. However, the constantly changing landscape has created greater risks in the health care industry to cyber threats and attacks. Having appropriate practices in place to address those threats will allow health care entities to better protect patients and their information and assist an entity in preventing a breach of data or reduce the penalty assessed against that entity should a breach occur.
[1] Dep’t of Health & Human Servs., Health Industry Cyber-security Practices: Managing Threats and Protecting Patients (Dec. 28, 2018) [hereafter “HHS Guidance.”]. [2] Id. at 2. [3] 45 C.F.R. § 160.404(b)(2)(i). [4] § 160.404(b)(2)(ii). [5] Supra note 1 at 7. [6] Id. [7] Id. [8] Id. at 8. [9] Id. [10] Id. [11] Id. [12] Jessica Davis, Hackers Breach Data of 4,300 Missouri Patients for 3 Months, Health IT Security, Jan. 3, 2019, available at https://healthitsecurity.com/news/hackers-breach-data-of-4300-missouri-patients-for-3-months (last visited Jan. 3, 2019). [13] Supra note 1 at 14.[14] Id. at 13. [15] Id. [16] Id. at 16. [17] Id. at 18. [18] Id. at 20. [19] Jessica Davis, Blue Cross Blue Shield of Michigan Breach Impacts 15,000 Customers, Health IT Security, Dec. 31, 2018, available at https://healthitsecurity.com/news/blue-cross-blue-shield-of-michigan-breach-impacts-15000-customers (last visited Jan. 3, 2019). [20] Id. at 22. [21] Id at 24. [22] Dep’t of Health & Human Servs., Technical Volume 1: Cybersecurity Practices for Small Health Care Organizations, at 7 (Dec. 28, 2018) [hereafter “Volume 1”]; Dep’t of Health & Human Servs., Technical Volume 2: Cybersecurity Practices for Medium and Large Health Care Organizations, at 7 (Dec. 28, 2018) [hereafter “Volume 2”]. [23] Supra note 22, Volume 1, at 11. [24] Id. at 7-9 [25] Id. at 10. [26] See LabMD, Inc., No. 9357 (July 28, 2016) (finding a corporation liable for a data breach that occurred as a result of an employee downloading the file-sharing program LimeWire on her computer). [27] Supra note 22 Volume 1, at 12. [28] See supra note 19. [29] Id. at 17-18. [30] Id. at 17. [31] Id. at 21. [32] Id. at 22. [33] Id. at 24; Supra note 22 Volume 2, at 87-99. [34] Supra note 22 Volume 2,at 89. [35] Supra note 22 Volume 1, at 25.
Michigan OFFICE
1441 W Long Lake Road
Suite 310
Troy, MI 48098
T. 248.644.6326
F. 248.644.6324
FLORIDA OFFICES
6841 Energy Court
Sarasota, FL 34240
T. 941.893.3449
1001 Brickell Bay Drive
Suite 1714
Miami, FL 33131
T. 305.712.7177
Practice Areas
Attorneys
© CHAPMAN LAW GROUP. ALL RIGHTS RESERVED
Send this to a friend