Robert Napoli

15ys in the making ;-) "The rule requires vendors of personal health records, or PHRs, and related entities not covered under HIPAA to notify the FTC and affected individuals of breaches involving unsecured personal identifiable information." #Healthcare #FTC #NewRegulation #Security #InfoSec #CyberSecurity #Security #Privacy #CSO #CISO https://lnkd.in/dkDaWjaA

13

HIPAA Compliance Tip 8: Properly Secure and Store Patient Photos  HIPAA regulations will get ya if you don't know how to properly secure and store patient photos.  Any photos used to document patient procedures are considered protected health information or PHI and require careful handling and storage.  Healthcare businesses should make sure they are storing patient photos in secure, HIPAA-compliant servers or systems and obtain patient consent before using or sharing them. Read more HIPAA Compliance Tips ➡️ https://hubs.la/Q02B8qGM0 #HIPAACompliance #ITSupport #Cybersecurity #SmallBusiness

1

Personal Health data in your mobile app? Read this... Secure the mobile app and protect the data to avoid the breach disclosure process - it is better for everyone involved. #mobileappsecurity #mobileappprivacy https://lnkd.in/ezMeDGfP

4

Last year a milestone was reached: $1 billion was paid to cyber attackers. Congress must act to make it illegal to pay ransom for cyberattacks. The United States should lobby other democratic nations to follow suit. If people don't like that option, then how about this one: companies that pay ransom to cyber attackers must pay 3x that amount into a fund which is used for security global infrastructure. That fund could be used to do things like re-implement critical open source infrastructure in memory-safe languages like Swift and Rust. Information security *is* national security. #InfoSec #NatSec

2

2 Comments

How secure is your healthcare data? Brace yourself for the eye-opening statistics: In March 2024 alone, the number of reported HIPAA breaches soared. The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) received reports of 92 breaches involving 500 or more records. 92 reported data breaches compromised the protected health information of 2,961,399 individuals. Among these breaches, 76 were classified as hacking or IT incidents. The location with the highest number of breaches was reported as network servers representing 69 breaches and email compromising the next highest number at 11 breaches. Let these staggering numbers serve as a wake-up call. Protecting healthcare data is paramount in an age of increasing cyber threats. Stay vigilant, stay informed, and take proactive measures to safeguard sensitive information. If you want to discuss your HIPAA compliance roadmap, I can help. 

2

The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) Catalog surpassing 1,100 entries is a significant milestone! HEAL Security | Actionable intelligence on cyber threats, risks, and remedies for Healthcare; we're committed to providing actionable intelligence on cyber threats, risks, and remedies for the healthcare sector. Our team has published the latest analysis and dives deep into these KEVs, offering insightful visualizations and uncovering powerful trends. Check out our racing bar graph to see the dynamic changes in KEVs among vendors! Key insights from our recent analysis: Top Vendors in KEV Catalog: Microsoft, Apple, and Cisco are leading in overall KEVs, spanning from 2021 to the present. However, 2024 trends show a decrease in their KEV footprint. Year-over-Year Comparison: 2023 vs. 2024: The top vendors are seeing a decrease in KEVs in 2024 compared to 2023: Microsoft: 27 (2023) -> 11 (2024), a decrease of 59.26% Apple: 21 (2023) -> 5 (2024), a decrease of 76.19% Cisco: 7 (2023) -> 3 (2024), a decrease of 57.14% Adobe: 6 (2023) -> 2 (2024), a decrease of 66.67% Apache: 5 (2023) -> 2 (2024), a decrease of 60.00% Roundcube: 4 (2023) -> 1 (2024), a decrease of 75.00% Citrix: 3 (2023) -> 2 (2024), a decrease of 33.33% Ivanti's Notable Entry: On 3/25, Ivanti added its 5th KEV of the year, bringing its total to 17 KEVs and knocking Citrix out of the Top 10. Top Vendors by Total KEVs: Microsoft: 286 KEVs Apple: 75 KEVs Cisco: 71 KEVs Google: 67 KEVs Adobe: 67 KEVs Oracle: 33 KEVs Apache: 32 KEVs VMware: 22 KEVs D-Link: 20 KEVs Ivanti: 17 KEVs #CyberSecurity #DataVisualization #KEV #HEALSecurity #ThreatIntelligence #VulnerabilityManagement Found by leading healthcare organizations to create Healthcare Cyber Specific Situational Intelligence Data. Sign up for HEALTHCARE Specific - Situational Threat Intelligence HEAL Security Desktop for FREE, also get - HEAL Security Vulnerability Intelligence Threat Awareness Live Single Screen (Vitals) on your computer or big screen. 1.5M+ Products identified and monitored 225k+ Vulnerabilities 200k+ Hours potentially saved evaluating Vulnerabilities by our Early Adopters 645k+ Organizations, companies and Vendors continually updated and tracked 6.9k+Highly Enriched Vulnerabilities with timelines and more 32+ Public and private Data Sources monitored in real time Want to become a Partner we are now working with partners as we develop our direct connect API contact us if interested. https://healsecurity.com/

9

3 Comments

Pay attention if you handle Personal Health Records (PHR) - this means you mobile health apps. 121 pages of FTC fun goes into effect on June 26. These are "new provisions in place to protect users of health apps and devices." An ounce of mobile app risk management is worth a pound of Health Breach Notification. #mobileappsecurity #dataprivacy https://lnkd.in/ezMeDGfP

10

You don’t want to sit in a little white room and explain that a flood swept compliance-governed data away. 😥 Build a compliant and reliable #BusinessContinuity plan with our blog series @ https://hubs.ly/Q02lntVj0 #DisasterRecovery #CloudComputing #BDR

4

I am just AMAZED that in this age of ransomware and the industrialization of hacking that people still use standard passwords thanks to Becker's Healthcare for sharing. My favorite three are: - Admin (#7): I mean who has admin privileges and then uses Admin as a password and how do they remain employed?! - trustno1 (#20): Really? You don't trust anyone? And you have the 20th most popular password in the country? Maybe take that mantra to heart a little better. - Whatever (#39): clearly an indication of the huge number of burned out healthcare workers At Cognome our security committee meets monthly and ensures that our entire suite of privacy and security policies are strictly enforced. Stay safe out there everyone and do yourself a favor: don't use the same password for ANYTHING and make sure they all look more like this: 4fwerSWG!%345^fS - or longer!

3

Major Data Breach at United Healthcare A serious hack has hit United Healthcare. Hackers got into their system through Citrix, a tool that lets employees access their work online, and stole private data belonging to a third of the U.S. population. This situation shows why it's so important for companies to take tech security seriously. When using technology like Citrix, it’s not just about having the tools—how you set them up matters a lot. Security can’t just be an optional extra; it needs to be a core part of how things are done. Some best practices like using - the least privilege approach (giving users only the access they need), - multi-factor authentication (MFA), and - encryption should never be optional. They are essential for keeping systems secure. Companies need to keep their systems up to date and make sure only the right people can get into sensitive areas. It's a big reminder to make sure everything is locked down tight. Let's learn from this and make sure our personal information is safer in the future.

9

Looking to reach more patients through telehealth? We can’t blame you! Over the past few years, #telehealth has emerged as a game-changer in convenience and accessibility.   However, since ePHI is involved, HIPAA does still apply, and it can be much more difficult to control cybersecurity factors from remote locations. Addressing the privacy challenges associated with telehealth requires a multi-faceted approach that encompasses both technical and organizational measures. Here are some key strategies to consider: 🔎 Robust Encryption Implement end-to-end encryption for all data transmissions, ensuring that sensitive patient information remains secure and inaccessible to unauthorized parties. 🧑‍💻 Access Controls Establish strict access controls and authentication protocols to limit access to patient data only to authorized healthcare professionals and staff members. ⚠️ Regular Software Updates Keep all software and systems up-to-date with the latest security patches and updates to mitigate known vulnerabilities and protect against emerging threats. 🍎 Employee & Patient Training Invest in comprehensive cybersecurity training for all employees, emphasizing the importance of following best practices, recognizing potential threats, and reporting any suspicious activities. Providing patient training is both empowering and informative, focusing on security measures like how to make sure operating systems are updated and utilizing strong passwords. ✅ Incident Response Plan Develop and regularly review an incident response plan to ensure a swift and effective response in the event of a data breach or cyber attack. 📈 Compliance Trends Stay up-to-date with HIPAA regulations and OCR priorities to ensure your telehealth practices are effectively mitigating risks. 🤝 Third-Party Vendor Vetting Carefully vet and monitor any third-party vendors or service providers involved in your telehealth operations to ensure they maintain robust cybersecurity measures and comply with industry standards. Always have a Business Associate Agreement in place. 🔏 Notice of Privacy Practices Describe how the privacy rule allows the provider to use and disclose data, how to contact the organization for more information, and how to make a complaint. This notice should be in a clear and easy to find location on both mobile apps and website browsers with patient acknowledgement and the option to refuse the acknowledgement. 🗃️ Regular Audit Log Reviews Formally document your audit log review process. Details should include which systems are reviewed, the frequency (aim for at least monthly), and documentation of both actions taken and instances where no action was required. What do you think about telehealth as either a patient or provider? Do the benefits outweigh the privacy risks? 👇👇👇

6

As ransomware attacks continue to increase in healthcare, so is patient awareness!  #Healthcare #cybersecurity #hospitals #healthcareleadership #medicine #ceo #healthtech #infosec https://lnkd.in/dM8JRKEd

1

FTC Finalizes Health Breach Notification Rule Update Regs Now Cover Wearables and Health Apps, Extend to More Types of Breaches. "The rule requires vendors of personal health records, or PHRs, and related entities not covered under HIPAA to notify the FTC and affected individuals of breaches involving unsecured personal identifiable information. Under the changes, the FTC's definition of PHRs is revised in two ways that pertain to the rule's scope. "The revised definition makes clear that the final rule covers entities that offer products and services through the online services, including mobile applications, of vendors of personal health records," the FTC said. That includes technologies such as wearable fitness devices, mobile health apps and similar products." https://lnkd.in/e8zTHFGG

2

Breaking News: Cyberattack on UnitedHealth firm forces doctors to dig into personal savings to stay afloat. Doctors tap personal savings to pay costs from Change Healthcare cyberattack https://lnkd.in/gctUsSP5 ### What Happened? Change Healthcare, a company that handles important health-related tasks like billing and payments for doctors, was hit by a cyberattack. This means hackers disrupted their computer systems, causing a lot of problems for doctors who rely on these services to get paid. ### Impact on Doctors Because of the cyberattack, many doctors are not receiving the money they usually get from insurance companies for the services they provide. This has forced some doctors, like Dr. Angeli Maun Akey from Florida, to use their own savings to keep their clinics running and continue treating patients. ### Impact on Patients The attack could also affect patients, especially those needing regular treatments like chemotherapy, because their doctors are struggling financially to keep operations running smoothly. ### Company's Response UnitedHealth Group, which owns Change Healthcare, is aware of the problems and is trying to help by offering some temporary financial support to the affected doctors. However, some doctors feel that this help isn't enough. ### Bigger Picture This incident shows how important it is for healthcare companies to protect their computer systems from hackers because a lot of people depend on these systems for their health and livelihood. ### Simple Summary A cyberattack on Change Healthcare has caused major payment delays for doctors, forcing some to use personal savings to cover costs. This situation highlights the need for better security in healthcare technology to prevent such disruptions in the future.

1

Last year a Health Care Mid-Tier Client told me they did not need a Cyber Risk Program to include Risk/Threat Monitoring, Prioritized Risk Mitigation, Response Plan & Cyber Liability Insurance - that they already had Cybersecurity covered by their Cloud & Business Apps Vendors. Nothing replaces a continuous "Hacker View" of Risk & Threat. And with Health Care it is ALL of our Personal Data... "UnitedHealth said the cyberattack will have a total impact of $0.74 per share in Q1, with full-year 2024 impacts estimated at $1.15 to $1.35 per share. "Out of prudence, due to the potential for the cyberattack to affect claims receipt timing, the company reflected an additional $800 million of claims reserves," the company added. "Cash flows from operations from the first quarter 2024 were $1.1 billion and were affected by approximately $3 billion due to the company's cyberattack response actions, including funding acceleration to care providers, and were additionally impacted due to the timing of public sector cash receipts." Change Healthcare is the biggest payment exchange platform used by doctors, healthcare providers, and over 70,000 pharmacies within the United States healthcare system. #healthcareresilience #cyberiskmanagement #pharmacies https://lnkd.in/e8zE3bBR

12

2 Comments

This article from Wired discusses a new cybersecurity threat facing Change Healthcare, a major healthcare IT company, following a previous ransomware attack. The notorious cybercriminal gang RansomHub has announced the sale of highly confidential patient data allegedly stolen from Change Healthcare during the ransomware attack in February 2024. The stolen data includes medical and dental records, payment claims, insurance details, and personal information like Social Security numbers and email addresses. RansomHub has given individual insurance companies the option to pay ransoms to prevent the sale of their records, underscoring the vast amount of sensitive healthcare data the group claims to have accessed from Change Healthcare. This latest development comes as Change Healthcare is still grappling with the aftermath of the initial ransomware attack, which crippled its claims-payment operations and sent shockwaves through the US healthcare system. Change Healthcare has reportedly paid a $22 million ransom to another group, AlphV, to halt the leak of stolen data, and has incurred significant losses of $872 million as of March 31 to respond to the incident. The company is now under increasing scrutiny from lawmakers and regulators over its cybersecurity practices and the measures it is taking to prevent future attacks. https://lnkd.in/ev4AFBdB #healthcare #healthcaredata #cyberattack #cybersecurity #databreaches #ransomeware

1