Application Security , Breach Notification , Cybersecurity

• February 1, 2019    

The digital revolution has given healthcare organizations new tools to increase team efficiency and improve their customer experience. But it's also opened up new vectors that cybercriminals can use to attack. As your attack surface expands to web infrastructure that you don't own or control, it becomes increasingly difficult to protect your digital assets and your data. You must shift security priorities from prevention to detection and remediation.

Watch this video to learn more about:

Tactics to protect your digital footprint; A framework for effective digital risk protection; What tools you need to mitigate external threats; Case study on a leading how a leading hospital protects themselves from external cyber threats.

Governance , HIPAA/HITECH , Legislation & Litigation

After California Takes Bold Action, Other States Ponder Privacy Protection Measures(HealthInfoSec) • January 31, 2019    

Several U.S. states, including Oregon, North Carolina, Virginia and Washington, are considering new legislation to shore up consumer data privacy laws in the wake of California passing strict privacy requirements last year.

See Also: Sunset of Windows Server 2008: Migrate with Docker

The European Union's General Data Protection Regulation, which has been enforced since last May, is inspiring renewed efforts worldwide, including at the federal and state levels in the United States, to boost privacy protections.

Democrats in Congress have once again introduced national breach notification and privacy legislation, but many previous efforts to pass similar measures have failed (see: Democratic Senators Introduce Security Legislation).

Meanwhile, federal regulators are considering changes in HIPAA aimed at reducing "regulatory burdens," including ways to improve secure data sharing for patient care coordination, by, for example, easing certain privacy requirements (see: HHS Seeks Feedback on Potential HIPAA Changes).

State Proposals

Rather than wait for Congress or federal regulators to take action, more states are considering a variety of measures designed to strengthen consumer data protections.

For example, Oregon is considering a bill that would prohibit the sale of de-identified protected health information without first obtaining a signed authorization from an individual. The measure also would provide patients the right to be paid for authorizing the de-identification of their PHI for sale to third parties, such as for research and other uses.

In North Carolina, pending legislation would strengthen ID theft/fraud protections. Under the proposal, ransomware attacks would be considered a security breach, and a breached entity would need to notify the state attorney general's office within 30 days.

In Virginia, a bill proposes new requirements for businesses related to disposal of certain consumer records. It also features new requirements for manufacturers pertaining to the design and maintenance of devices that connect to the internet. A business would be required to "take all reasonable steps to dispose of, or arrange for the disposal of, consumer records." But that provision would not apply to HIPAA covered entities and business associates, because HIPAA has its own disposal requirements.

And Washington is considering a bill that would require companies that collect personal data to be transparent about the type of data being collected, whether consumer data is sold to data brokers, and upon request from a consumer, delete the consumer's personal data without undue delay. These provisions are very similar to requirements in the EU's GDPR.

GDPR as Inspiration

"The European Union recently updated its privacy law through the passage and implementation of the General Data Protection Regulation, affording its residents the strongest privacy protections in the world," the Washington bill notes. "Washington residents deserve to enjoy the same level of robust privacy safeguards."

California's new law enacted last year also requires businesses to disclose the purpose for collecting or selling the information, as well as the identity of the third-party organizations receiving the data. Consumers can also request data be deleted and initiate civil action if they believe that an organization has failed to protect their personal data (see California's New Privacy Law: It's Almost GDPR in the U.S.).

"The California Consumer Privacy Act was passed last year and compliance is required next year, but 2019 is when California's attorney general compliance guidance is expected, and legislative fixes may be needed," says privacy attorney Adam Greene of the law firm David Wright Tremaine.

"Each of the 50 states now has its own breach notification laws, with nearly one-half adopting data security and/or data disposal requirements to protect consumers' personally identifiable information from unauthorized disclosure," says privacy attorney David Holtzman, vice president of compliance at security consultancy CynergisTek.

"While most states are not taking a sectorial approach to the type of PII that must be protected, New York, Ohio and South Carolina have adopted cybersecurity requirements that target industries that include health plans and insurers," he adds.

"A theme seen in state legislation to update breach notification laws in recent years is to set shorter notification periods. Some argue that this would give consumers more time to take action to protect themselves against the threat of financial fraud or identity theft by notifying major credit reporting agencies."

Under Pressure

Privacy attorney Kirk Nahra of the law firm Wiley Rein notes: "The states continue to examine the possibilities for increasing privacy and data security protections, both in currently regulated areas and in situations where federal law is not directly applicable through a specific law or regulation."

Could all the various state activity put more pressure on Congress to adopt national privacy legislation?

"We may find that there is a sufficient number of these new proposals that there will be an additional push to implement a federal law that applies a common standard - although that is still a long way away," Nahra says. "And one of the critical elements of the debate will be how to handle these state laws."

Nahra expects other states, "including some traditional red states," will introduce privacy legislation.

A Downside?

New state privacy laws can potentially have adverse effects, Nahra contends.

For example, the Oregon proposal tightening up permitted uses of de-identified PHI "might seem appealing at first blush but actually would primarily have negative impacts," he claims.

The Oregon proposal, he argues, "would reduce any of the useful research, public health and other benefits that are provided by de-identified information today, and would at the same time create privacy and security risks for individuals by forcing companies to retain a link between the de-identified data and an identifiable individual.

"So, we see potential risks from some of these proposals, particularly where they move through a more chaotic and sometimes less thoughtful state legislative debate."

Greene says the Oregon legislation would be difficult to implement.

"For example, de-identified data may be created for multiple purposes, some of which might require authorization under the law," he notes. "Identifying what is the true purpose may be challenging. Also, it is not clear whether aggregate data, which is no longer at a person-by-person level, qualifies as de-identified data that may be subject to the law."

Data Breach , Governance , HIPAA/HITECH

California Attorney General Smacks Health Insurer With Hefty Penalty(HealthInfoSec) • February 1, 2019    

California's attorney general has hit Aetna with a nearly $1 million penalty in the latest enforcement action against the health insurer following a 2017 breach involving HIV information.

See Also: Sunset of Windows Server 2008: Migrate with Docker

The $935,000 settlement - which awaits state court approval - resolves allegations that Aetna violated California health privacy laws in connection with its 2017 breach of patient confidentiality impacting 12,000 individuals, including 1,991 Californians, according to a statement from California Attorney General Xavier Becerra.

The incident involved a July 2017 mailing mishap in which a vendor for Aetna sent letters to health plan members that revealed through the envelope's oversized clear windows that the recipient was taking HIV-related medication, the statement notes.

A String of Settlements

Earlier, several other states announced settlements with Aetna as a result of the same incident.

In October 2018, after a multistate investigation, Aetna signed a financial settlement agreement with Washington, D.C., for $175,000, Connecticut for $100,000 and New Jersey for $365,000, as well as a settlement with the state of Washington, for which the amount was undisclosed.

In January 2018, Aetna agreed to a $1.15 million settlement with the New York state attorney general's office plus a $17.2 million settlement of a class action lawsuit filed against the company.

The case has also spurred other legal action, including Aetna suing Kurtzman Carson Consultants, a class action settlement administrator company that Aetna says directed the mailing to the health plan members in which the HIV medication information was visible through windowed envelopes (see: Yet Another Twist in Messy Aetna Privacy Breach Case).

Sensitive Data

The breach appears to have drawn so much legal and regulatory attention due to the particularly confidential nature of the data impacted.

"A person's HIV status is incredibly sensitive information and protecting that information must be a top priority for the entire healthcare industry," Becerra said. "Aetna violated the public's trust by revealing patients' private and personal medical information. We will continue to hold these companies accountable to prevent such a gross privacy violation from reoccurring."

The California attorney general alleges that Aetna's mailing breach violated state law, including the Confidentiality of Medical Information Act, Health and Safety Code section 120980, the State Constitution and the Unfair Competition Law.

In a statement provided to Information Security Media Group, Aetna says: "Through our outreach efforts, immediate relief program and settlements over the past year, we have worked to address the potential impact to members following this unfortunate incident. In addition, we have implemented measures designed to ensure something like this does not happen again as part of our commitment to best practices in protecting sensitive health information."

California's attorney general's office did not immediately respond to an ISMG request for comment on the settlement.

Corrective Actions

As part of the California settlement, Aetna has agreed to take a variety of steps to avoid security mishaps, including:

Modify its procedures for print mailings to health plan members; Evaluate whether it's necessary to include medical information in print mailings; Ensure that business associates or subcontractors sign BA agreements and that Aetna-retained mailing vendors agree to safeguard medical information; Complete three annual privacy risk assessments that address mailings to members.

Quality Control

Whether an organization is preparing a single letter for mailing or hiring a contractor to produce and send materials to a large group of recipients, it must have a quality control process for the design, production and delivery of the finished product to avoid mishaps like the Aetna privacy incident, says privacy attorney David Holtzman, vice president of compliance at security consultancy CynergisTek.

"It is a best practice to develop a quality control checklist to help ensure that the document can be produced in way that fits into the finished mailing package ... that any data processing in the production of the document is checked to ensure the output allows for any PHI to be kept confidential, and that a final quality assurance check [is completed] to physically inspect that the document is stuffed into its envelope to make sure that only the recipient's name and address is showing," he says.

As for the financial settlement in California, Holtzman notes: "Californians enjoy a right to privacy enshrined in their constitution. The legislature has enacted statutory provisions protecting medical information from unauthorized use and disclosure, as well as separate provisions aimed at protecting consumers' personally identifiable information. Violations of these state law protections allow the attorney general to seek penalties of up to $2,500 per violation."

Other HIV Data Breaches

Other data breaches involving HIV-related information have also resulted in sanctions.

An incident involving records containing HIV information for 192 patients that were left on a train in 2011 by a Massachusetts General Hospital worker resulted in a $1 million HIPAA settlement with the U.S. Department of Health and Human Services' Office for Civil Rights.

In 2017, OCR signed a $387,000 settlement agreement with St. Luke's-Roosevelt Hospital Center Inc. in a case involving careless handling of HIV information. That incident involved the impermissible disclosure of sensitive medical information, including HIV status, through the faxing of data about only two patients.

OCR also is investigating the Aetna breach.

The OCR HIPAA Breach Reporting Portal - also known as the "wall of shame" - lists ongoing breach investigations involving Aetna, including the 2017 HIV data incident.

"It is possible that OCR's investigation may resolve the compliance reviews with a formal enforcement action or through voluntary corrective action," Holtzman says. "The agency's compliance and enforcement process can be opaque, so we will have to wait and watch."

OCR did not immediately respond to an ISMG request for comment.

Global Risk

Also grabbing headlines in recent days was a breach of HIV information in Singapore.

The Singapore Ministry of Health on Jan. 28 issued a statement revealing that confidential information of about 14,200 individuals diagnosed with HIV and 2,400 of their contacts was in the possession of an "unauthorized person" and had been illegally disclosed online (see: HIV Data Exposed Online).

General Data Protection Regulation (GDPR) , Governance , Privacy

Privacy Watchdog Orders Businesses to Prepare as UK Teeters on Edge of 'No Deal'(euroinfosec) • February 1, 2019    Photo: Duncan Hall, via Flickr/CC

As the U.K. teeters on the edge of a "no deal" Brexit, U.K. Information Commissioner Elizabeth Denham has warned businesses to prepare. In particular, any organization that handles Europeans' personal data must ensure they have a legal transfer arrangement in place.

See Also: Live Webinar: Building Secure Delivery Pipelines with Docker, Kubernetes, and Trend Micro

That's because the U.K. is set to "Brexit" the European Union on March 29, following 52 percent of U.K. voters in 2016 opting for the country to leave the EU.

Parliament, however, rejected the withdrawal agreement presented to it last month, which was negotiated by Prime Minister Theresa May. The Conservative Party leader still clings to power - seemingly because no one else wants the job - and has been ordered to return to Brussels and renegotiate some parts of the agreement, despite EU negotiators saying that it cannot be renegotiated piecemeal.

While that drama continues, the clock winds down. So it's possible that the U.K. will exit the EU without having secured a withdrawal agreement.

As a result, all U.K. businesses that transfer data to or from the European Economic Area - all EU countries as well as Iceland, Liechtenstein and Norway - must, per EU law, put in place additional measures. So says Denham, who heads the Information Commissioner's Office, which enforces U.K. privacy laws, including compliance with the EU's General Data Protection Regulation (see: Irony Alert, Brexit Britain: Comply With EU Privacy Law).

"Like everyone in the U.K. right now, we are following the twists and turns of the Brexit negotiations. The sharing of customers', citizens' and employees' personal data between EU member states and the U.K. is vital for business supply chains to function and public authorities to deliver effective public services," Denham says in a blog post.

"At the moment personal data flow is unrestricted because the U.K. is an EU member state," she says. "If the proposed EU withdrawal agreement is approved, businesses can be assured that personal data will continue to flow until 2020 while a longer-term solution can be put in place."

Map Data Flows

But if the withdrawal agreement is not approved, the U.K. will crash out of the EU without a deal, at which point, any U.K. business that handles EU personal data will need to have transfer arrangements in place that proves they're handling the data in a legal manner.

Step one for making that happen: Map data flows.

"The key question around the flow of personal data is whether your data is going from the U.K. to the EEA or exchanged both ways," Denham says.

Personal data can include names, addresses, emails and financial details, among other types of information.

Achieving clarity will be essential for ensuring that your organization complies with GDPR. "If you are unsure, start by mapping your data flows and establish where the personal data you are responsible for is going," Denham says.

Lack of 'Adequacy'

In the event of "no deal," there also won't be an "adequacy" agreement in place. Such an agreement would mean that the U.K.'s laws are seen by the EU as being good enough to comply with European law.

"Companies and organizations operating within countries with adequacy agreements enjoy uninterrupted flow of personal data with the EU," Denham says.

Unfortunately, no withdrawal agreement also means no adequacy agreement, at least not right away.

"An assessment of adequacy can only take place once the U.K. has left the EU," she says. "These assessments and negotiations have usually taken many months," she says. "Until an adequacy decision is in place, businesses will need a specific legal transfer arrangement in place for transfers of personal data from the EEA to the U.K., such as standard contractual clauses."

Keep Complying With GDPR

Any organization that handles Europeans' personal data can be audited by EU privacy regulators to ensure that they are adequately protecting the data as well as handling it in an approved manner (see: France Hits Google With $57 Million GDPR Fine).

EU data protection authorities can impose fines of up to €20 million ($23 million) or 4 percent of an organization's annual global revenue - whichever is greater - on any organization found to have violated GDPR. Regulators can also revoke an organization's ability to process individuals' personal data.

To help organizations comply, the ICO has published Brexit guidance, including sample standard contractual agreements.

'No Deal': International Security Risk

The implications of a "no deal" Brexit apply to much more than organizations' handling of personal data. May's government appears to have done little or no planning for a "no deal" scenario. Experts say the government has failed to stockpile food and essential medicine, which will be needed to avoid shortfalls due to the likely supply chain interruptions that will occur if the U.K. crashes out of the EU.

On Tuesday, Dan Coats, the U.S. Director of National Intelligence, testified before the Senate Intelligence Committee that a "no deal" Brexit poses a national security risk for the U.S. and its allies: (see Intelligence Chiefs Expect More Cyberattacks Against US).

"The possibility of a 'no-deal' Brexit, in which the U.K. exits the EU without an agreement, remains. This would cause economic disruptions that could substantially weaken the U.K. and Europe," Coats said.

"No deal" would also make it more difficult for the U.S. and its Western European allies to defend themselves against foreign actors, according to the U.S. intelligence community's new Worldwide Threat Assessment.

"The United Kingdom's scheduled exit from the EU on 29 March 2019, European Parliament elections in late May, and the subsequent turnover in EU institutional leadership will limit the ability of EU and national leaders to contend with increased Russian and Chinese efforts to divide them from one another and from the United States," the report says.