More organizations that collect protected health information are facing cyber-extortion plots, the U.S. Department of Health and Human Services (HHS) warns.
About 3.6 million records were involved in 146 hack-type breaches of medical organizations made public in 2017 alone, according to the Privacy Rights Clearinghouse, a nonprofit group based in San Diego.
Health care organizations store tens of millions of patients’ personal health information, which is highly regulated by the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA). In spite of HIPAA safeguards, cyber-extortion attempts are not uncommon, according to HHS’s Office for Civil Rights, which is responsible for enforcing HIPAA.
(Related: Maybe HIPAA Protected You From WannaCry)
Breaches involving protected health information must be reported to HHS.
“Incidents of cyber extortion have risen steadily over the past couple of years and, by many estimates, will continue to be a major source of disruption for many organizations,” according to the Office for Civil Rights’ January newsletter. “Organizations that provide necessary services or maintain sensitive data, such as Healthcare and Public Health … sector organizations are often the targets of cyber-extortion attacks.”
OCR offers these six tips:
Train employees to identify unusual emails and other messages that hackers could use to break into your system.
Document suspicious activity and review suspicious activity logs regularly.
Perform a risk analysis that looks at the entire organization and fix known risks.
Use anti-malware programs to prevent access by malicious software proactively.
Implement and test cyberattack recovery plans.
Encrypt and back up sensitive data.
Agents can stay on top of new and emerging cyberthreats, perhaps by signing up for governmental alerts known as US-CERT alerts, which are generated by the government’s National Cyber Awareness System.
Information about signing up for the alerts is available here.
— Read 3 New Substance Use Confidentiality Rule Facts on ThinkAdvisor.