May 2018 Healthcare Data Breach Report
Jun19

May 2018 Healthcare Data Breach Report

April was a particularly bad month for healthcare data breaches with 41 reported incidents. While it is certainly good news that there has been a month-over-month reduction in healthcare data breaches, the severity of some of the breaches reported last month puts May on a par with April. There were 29 healthcare data breaches reported by healthcare providers, health plans, and business associates of covered entities in May – a 29.27% month-over month reduction in reported breaches. However, 838,587 healthcare records were exposed or stolen in those incidents – only 56,287 records fewer than the 41 incidents in April. In May, the mean breach size was 28,917 records and the median was 2,793 records. In April the mean breach size was 21,826 records and the median was 2,553 records. Causes of May 2018 Healthcare Data Breaches Unauthorized access/disclosure incidents were the most numerous type of breach in May 2018 with 15 reported incidents (51.72%). There were 12 hacking/IT incidents reported (41.38%) and two theft incidents (6.9%). There were no lost unencrypted electronic devices...

Read More
OCR Announces $4.3 Million Civil Monetary Penalty for University of Texas MD Anderson Cancer Center
Jun19

OCR Announces $4.3 Million Civil Monetary Penalty for University of Texas MD Anderson Cancer Center

The Department of Health and Human Services’ Office for Civil Rights has announced its fourth largest HIPAA violation penalty has been issued to The University of Texas MD Anderson Cancer Center (MD Anderson). MD Anderson has been ordered to pay $4,348,000 in civil monetary penalties to resolve the HIPAA violations related to three data breaches experienced in 2012 and 2013. MD Anderson is an academic institution and a cancer treatment and research center based at the Texas Medical Center in Houston, TX. Following the submission of three breach reports in 2012 and 2013, OCR launched an investigation to determine whether the breaches were caused as a result of MD Anderson having failed to comply with HIPAA Rules. The breaches in question were the theft of an unencrypted laptop computer from the home of an MD Anderson employee and the loss of two unencrypted USB thumb drives, each of which contained the electronic protected health information (ePHI) of its patients. In total, the PHI of 34,883 patients was exposed and could potentially have been viewed by unauthorized individuals....

Read More
3-Year Jail Term for VA Employee Who Stole Patient Data
Jun18

3-Year Jail Term for VA Employee Who Stole Patient Data

A former employee of the Veteran Affairs Medical Center in Long Beach, CA who stole the protected health information (PHI) of more than 1,000 patients has been sentenced to three years in jail. Albert Torres, 51, was employed as a clerk in the Long Beach Health System-run medical center – a position he held for less than a year. Torres was pulled over by police officers on April 12 after a check of his license plates revealed an anomaly – plates had been used on a private vehicle, which were typically reserved for commercial vehicles. The police officers found prescription medications which Torres’ did not have a prescription for and the Social Security numbers and other PHI of 14 patients in his vehicle. A subsequent search of Torres’ apartment revealed he had hard drives and zip drives containing the PHI of 1,030 patients and more than $1,000 in cleaning supplies that had been stolen from the hospital. After pleading guilty to several crimes, including identity theft and grand theft, Torres was sentenced to three years in state penitentiary on June 4. Sutter Health Fires...

Read More
OCR Issues Guidance on Individual Authorization of Uses and Disclosures of PHI for Research
Jun15

OCR Issues Guidance on Individual Authorization of Uses and Disclosures of PHI for Research

The Department of Health and Human Services’ Office for Civil Rights has issued new guidance for HIPAA-covered entities to streamline HIPAA authorizations for uses of protected health information for research purposes, as required by the 21st Century Cures Act of 2016. Uses and Disclosure of PHI for Research The HIPAA Privacy Rule does permit covered entities to use patients’ PHI for research without obtaining individual authorizations under certain circumstances, such as if documented Institutional Review Board (IRB) or Privacy Board Approval has been obtained – see 45 CFR § 164.512(i)(1)(i) and (ii). However, in most cases, prior to using patients’ PHI for research, individual authorizations must be obtained from patients in writing. Without a valid authorization from a patient, their PHI can only be used or disclosed for purposes permitted by the Privacy Rule. The new guidance explains the content that must be included in individual authorizations to meet HIPAA requirements. OCR explains that individual authorizations must: Be written in plain language to ensure they can be...

Read More
Advisory Issued About Vulnerabilities in Siemens RAPIDLab and RAPIDPoint Blood Gas Analyzers
Jun15

Advisory Issued About Vulnerabilities in Siemens RAPIDLab and RAPIDPoint Blood Gas Analyzers

Siemens has proactively issued an advisory over two recently discovered vulnerabilities in its RAPIDLab and RAPIDPoint Blood Gas Analyzers. No reports have been received to data to suggest either vulnerability has been exploited in the wild, although users of the devices are being encouraged to take steps to mitigate risk. The vulnerabilities affect Siemens RAPIDLab 1200 Series and RAPIDPoint 400/405/500 cartridge-based blood-gas, electrolyte, and metabolite analyzers. CVE-2018-4845 would allow local or remote credentialed access to the Remote View feature. Successful exploitation of the vulnerability could result in privilege escalation that could potentially compromise the confidentiality, integrity, and availability of the system. No user interaction would be required to exploit the vulnerability. The vulnerability has been assigned a CVSS v3.0 score of 8.8. CVE-2018-4846 relates to a factory account with a hardcoded password which could potentially be exploited to gain remote access to the device over port 8900/tcp, thus compromising the confidentiality, integrity, and...

Read More