Health IT Security and HIPAA News

Patient Data Privacy Lawsuit Against Google, UChicago Dismissed

by

The patient data privacy lawsuit brought against Google and the University of Chicago Medical Center was dismissed by a federal judge in Illinois on September 4, ruling that patient who filed the...

Assured Imaging Ransomware Causes Data Theft Affecting 245K Patients

by

Arizona-based Assured Imaging is notifying 244,813 patients that some of their data was potentially exfiltrated after a ransomware attack in May.  On May 19, Assured...

5 Top Critical Vulnerabilities In Need of Patch, Software Update

by

The healthcare sector has remained a crucial target for hackers over the course of the last five years. But despite a heavy reliance upon legacy technologies, industry stakeholders have...

Patients Vastly Unaware of Insurers’ Access to Online Health Data

by

Just one in 10 American patients believe health insurance companies have access to their personal spending and streaming habits, although reports have shown insurers routinely search private and public...

OCR Updates HIPAA Resource for mHealth Apps, Cloud Computing

by

The Department of Health and Human Services Office for Civil Rights updated and renamed its former Health App Developer Portal as a HIPAA resource page for mobile health apps, APIs, and...

Healthcare’s Password Problem and The Need for Management, Vaults

by

Digital Shadows recently reported that at least 15 billion compromised credentials and passwords are for sale on the dark web. The data should serve as a warning to...

CISA Shares Incident Detection, Response Playbook for Cyber Activity

by

The Department of Homeland Security Cybersecurity and Infrastructure Security Agency released guidance to help enterprise organizations detect and remediate malicious cyber activity, which...

Report: Phishing Campaign Uses Hidden Text to Bypass Email Security

by

A new phishing campaign has been spotted in the wild using hidden text, or what’s known as zero font, to bypass email security controls and deliver malicious emails to the user,...

Healthcare Key Target of Hacker Selling Access to Compromised RDP

by

The hacker known as TrueFighter has reemerged with a campaign actively targeting the remote desktop protocol (RDP) across all sectors, with those in the healthcare industry as...

112K Patients Impacted by Utah Pathology Services Email Hack

by

Utah Pathology Services is notifying 112,000 patients that their data was potentially affected after the hack of an employee email account in June.  Discovered on June 30, a hacker...

COVID-19 PPE Phishing Campaign Delivers Agent Tesla RAT Malware

by

A report from Area 1 Security warns all sectors that a prominent phishing campaign is preying on COVID-19 fears, sending targeted emails offering personal protective equipment (PPE)...

CDT, eHI Unveil Draft Consumer Health Data Privacy Framework

by

The Center for Democracy and Technology (CDT) and eHealth Initiative and Foundation (eHI) released its draft consumer health data privacy framework designed to define data in need...

Key Needs for a Resilient Healthcare Information Security Program

by

The Office of Civil Rights recently shared ways an IT asset inventory can create a more effective risk analysis to close information security gaps and support HIPAA compliance. Given the...

OCR: IT Asset Inventory Can Improve HIPAA-Required Risk Analysis

by

The Office for Civil Rights recently shared a detailed list of IT asset inventory steps, which can help covered entities and their business associates better fulfill the HIPAA Security Rule...

Credential Theft Via Spoofed Login Pages Increase, Healthcare Top Target

by

A new IRONSCALES report found a drastic increase in successful credential theft attempts sent through spoofed login pages and social engineering attacks during the first half of...

FBI, CISA Alert of Surge in Vishing Cyberattacks on Remote Workers

by

Hackers are targeting employees working remotely amid the COVID-19 pandemic with a voice phishing, or “vishing,” campaign to obtain enterprise login credentials for mining...

Search Engines May Expose Patient Health Information, ACR warns

by

New search engine capabilities may inadvertently expose patient identifiers and other protected health information, according to a warning from the American College of Radiology...

Ransomware Attack Impacts Medical Debt Collections Firm R1 RCM

by

Medical debt collections firm R1 RCM recently confirmed its systems were taken down in response to a ransomware attack that lasted for at least a week, according to KrebsOnSecurity.  R1...

Brute-Force P2P Botnet Targeting SSH Servers of Medical Centers, Banks

by

Guardicore researchers are warning organizations of a sophisticated peer-to-peer botnet, which has been actively breaching SSH servers since January 2020. Known as FritzFrog,...

IBM: Remote Exploit Flaw Found in Millions of Connected IoT Devices

by

IBM X-Force Red security researchers uncovered a bug in components made by the manufacturer Thales, which are included in millions of connected devices. The IoT...