Archive for March, 2014

Unique case where concerned entity didn’t violate HIPAA regulations

March 30th, 2014

 

Major task of HIPAA is to keep track on data breaches and government penalties for compliance failure. It covers entities that handle patient data in some form. Incident involved Monroeville, Pa. when its 911 dispatch centre from five fire stations gave easy access for patient medical records to unauthorized users. Information which was accessible included names, driver’s license numbers, birth dates and medical histories.

Monroeville is a community of about 28,000 with a vibrant business corridor, a convention center and two busy hospitals. The Pittsburgh Post-Gazette was covering this incident for last two years and found that Monroeville, Pa didn’t breached HIPAA regulations. Investigation was carried out by Department of Health and Human Services (HHS).

HHS learned that municipality failed to maintain the database properly and soon after the discovery of the breach unauthorized access was terminated. According to Office for Civil Rights, ‘Monroeville, its dispatch center, police department or fire department are all not covered under the provisions of the privacy law, which mainly related to health care providers and insurers.’

Two Monroeville council members said they were pleased by the government’s findings. Tom Wilson said, “I was happy that they didn’t find any violations, and the folks that were falsely accused, that took the brunt of the accusations, were completely exonerated.”

Linda Gaydos said,” “I am absolutely overjoyed for the employees of our police department, our dispatch center, our EMS and our fire departments and their families, to have this put behind them,” She added, “We had a group of people in Monroeville that worked against Monroeville, and they smoke-screened and they tried to keep stirring the pot and they tried to scare people and make it worse. They’ve made it a very, very bad, uncomfortable situation for a lot of people, and I’m hoping this will put an end to it.”

Municipal Manager Timothy Little said, “I think it lifts a cloud off of Monroeville, and specifically the public safety aspect of the municipality, that there wasn’t any wrongdoing with respect to [health privacy law] violations,”

Organizations, especially corporate giants, have to have an information security policy in place that proves they have taken necessary steps and measures to safeguard the information they gathered. If these policies are not adhered to, the regulators may prosecute.

Alertsec Xpress is used by organizations that have recognized the need to protect their information. Customers range from single-user sole traders and consultants to multinational companies with a large number of offices around the globe. Over 4 million users worldwide use Alertsec Xpress’s Check Point Full Disk Encryption

.

Enhanced by Zemanta

University of Kentucky (UK) Healthcare reports 1,079-patient data breach

March 27th, 2014

UK healthcare has informed 1,079 patients about the data breach after the incident of stolen laptop. Data breach involved one of its vendor HIPAA business associates (BAs).  Laptop was password protected.

Laptop contained Personal healthcare Information (PHI) which included name, date of birth, medical records number, diagnosis, medications, laboratory results, progress notes, allergies, height and weight, date of service, physician name and clinic. According to UK information related to Social Security numbers, credit cards, debit cards or bank account numbers were not present on the laptop.

Status of the encryption of laptop is unknown. A statement linked from the UK website mentioned –

UK HealthCare and Talyst deeply regret any inconvenience this causes. UK HealthCare and Talyst have policies and procedures in place and are committed to safeguard the privacy of all patients.

We have no evidence your information was misused.

Stay alert for the signs of identity theft, such as:
• Accounts you did not open and debts on your accounts that you cannot explain.
• Fraudulent or inaccurate information on your credit reports, including accounts and personal information, such as your social security number, address(es), name or initials, and employers.
• Failing to receive bills or other mail. Follow up with creditors if your bills don’t arrive on time.
• Receiving credit cards that you didn’t apply for.
• Being denied credit or being offered less favorable credit terms, such as a high interest rate, for no apparent reason.
• Getting calls or letters from debt collectors or businesses about merchandise or services you didn’t buy.

We also recommend that you regularly review the explanation of benefits statement that you receive from your health insurer. Please immediately contact your health insurer if you identify services listed on your explanation of benefits that you did not receive.

Alertsec strengthens security

Alertsec has created a web based encryption service that radically simplifies deployment and management of PC encryption by using industry leading Check Point Full Disk Encryption (former Pointsec) software.

Organizations, especially corporate giants, have to have an information security policy in place that proves they have taken necessary steps and measures to safeguard the information they gathered. If these policies are not adhered to, the regulators may prosecute.

Alertsec Xpress is used by organizations that have recognized the need to protect their information. Customers range from single-user sole traders and consultants to multinational companies with a large number of offices around the globe. Over 4 million users worldwide use Alertsec Xpress’s Check Point Full Disk Encryption.

Enhanced by Zemanta

Facts You Should Know about Cyber Insurance

March 24th, 2014

 

Cyber insurance is to protect losses against cyber threat and losses. Cyber Insurance is not a new concept but many companies don’t have cyber insurance policies still today. The growth for cyber insurance is slow because market is very complex and inconsistent.  Cyber insurance can be costly too which can go around $35,000 for a $1 million in coverage which is still less compared to costs of major breach.

It is important to know about cyber insurance and how can it benefit the organizations.

Cyber insurance is specific

Your general liability and professional indemnity insurance is not cyber insurance. General liabilities frequently cover basics like physical damage and not data breach. A simple virus can cost millions in terms of losses. Most of general liability insurer deliberately neglect the data breach clause.

All are not equal

Cyber insurance is still considered to be relatively nascent stage. It is a decade old concept to save the companies from data breach. A standard cyber insurance policy may not cover exact need of your organization. It is important to access your needs and go your proposed policy to negotiate best suitable terms.

Data loss cover

Cyber insurance policy should go beyond hacking and cover data loss. A minor data loss can cause significance damage to the company.

Example: Massachusetts General Hospital had to pay a $1 million fine to the US Department of Health and Human Services after an employee of Partners HealthCare left the records of 192 patients on a train.

Cyber insurance vs. good security

Cyber insurance is not the license to neglect security constraint of data. You have to perform assessment and audits to check the policies to secure the data.

“Being able to prove that they weren’t negligent could save organizations millions in the long-run,” explains Jamie Bouloux, a cyber insurance liability executive at AIG. “If something happens when a client loses data, they can tell the regulator that they did everything within reason to try to ensure that there was an environment of security where its employees knew how to handle client information.”

Alertsec strengthens security

Alertsec has created a web based encryption service that radically simplifies deployment and management of PC encryption by using industry leading Check Point Full Disk Encryption (former Pointsec) software.

Organizations, especially corporate giants, have to have an information security policy in place that proves they have taken necessary steps and measures to safeguard the information they gathered. If these policies are not adhered to, the regulators may prosecute.

Alertsec Xpress is used by organizations that have recognized the need to protect their information. Customers range from single-user sole traders and consultants to multinational companies with a large number of offices around the globe. Over 4 million users worldwide use Alertsec Xpress’s Check Point Full Disk Encryption.

Enhanced by Zemanta

Data breach settlement costs $4 million to Stanford Hospital

March 22nd, 2014

 

A class action lawsuit was filed for data breach that occurred back in 2009 for which Stanford hospital agreed to pay $4 for its settlement. California’s well-known Confidentiality of Medical Information Act (CMIA) was violated after 20,000 emergency room patients’ data became viewable in 2010 on a third-party student homework website.

CMIA prevents health care service providers from making patient records public without written consent. Los Angeles County Superior Court Judge Elihu Berle tentatively approved the settlement but final decision is yet to be finalized.

Shana Springer filed the class suit in 2011 for $20 million which comes around 100$ per patient. It was observed by the Stanford that data was breached when Multi-Specialty Collection Services sent the data to a third party for a graph which eventually landed on the dormant ‘Student of Fortune’ website.  Stanford maintained their stand that it had properly encrypted the patient data. Los Angeles-based Multi-Specialty Collection Services LLC is the contractor hired by the Stanford hospital.

Information like credit card information or Social Security numbers were not disclosed in the breach but medical record numbers, hospital account numbers, billing charges, as well as emergency room admission and discharge dates were available on the website.

After the incident, Stanford has proposed many remediations to protect crucial information from breach.  It will create a program dedicated to improving its security posture by training staff members. Training will be focused on policies to protect patient privacy.

Unencrypted laptops present a major risk of data loss. 80% of information theft is due to lost or stolen laptops and other equipment. About 50% of network intrusions are performed with credentials gathered from lost or stolen devices.

Alertsec strengthens security

Alertsec has created a web based encryption service that radically simplifies deployment and management of PC encryption by using industry leading Check Point Full Disk Encryption (former Pointsec) software.

Organizations, especially corporate giants, have to have an information security policy in place that proves they have taken necessary steps and measures to safeguard the information they gathered. If these policies are not adhered to, the regulators may prosecute.

Alertsec Xpress is used by organizations that have recognized the need to protect their information. Customers range from single-user sole traders and consultants to multinational companies with a large number of offices around the globe. Over 4 million users worldwide use Alertsec Xpress’s Check Point Full Disk Encryption.

Enhanced by Zemanta

IT companies: Ways to tackle Cloud File Sharing Threat

March 20th, 2014

 

Many cloud file sharing companies are now slowly but steadily wiping out the traditional IT companies methods. More and more IT infrastructure and apps are moving to cloud. Trend for employees using devices like Smartphone, tab to access corporate data (BYOD) is increasing.

Current situation is also leading to increase in security threats for corporate data. Environment is such where IT departments are losing their relevance and control over data.

Adaption of the Technology

IT professionals have adapted to the phases of technological breakthroughs. It is fact that more and more IT infrastructure is moving to the cloud and best way to adapt cloud technology is to put policies and audit strategies in place to avoid data breach. Control objectives should be created for cloud usage and implementation.

Encryption

One of the efficient ways to protect data is by creating encryption. Basically with encryption one need not to worry for the data whether it is moved or stored. Relying on the encryption has its own challenges like visibility of the data for day to day usage. Also trying to encrypt and decrypt work all the time is not feasible. Policy should be in place for the strategic encryption of the data.

Access to right Cloud service provider

Organizations today understand the need and importance of moving operations to cloud but many hesitate due to security threat involved in it. When choosing a cloud vendor it is important to ensure that compliance guidelines are in line with the organizations regulations and standards.

Alertsec strengthens security

Alertsec has created a web based encryption service that radically simplifies deployment and management of PC encryption by using industry leading Check Point Full Disk Encryption (former Pointsec) software.

Organizations, especially corporate giants, have to have an information security policy in place that proves they have taken necessary steps and measures to safeguard the information they gathered. If these policies are not adhered to, the regulators may prosecute.

Alertsec Xpress is used by organizations that have recognized the need to protect their information. Customers range from single-user sole traders and consultants to multinational companies with a large number of offices around the globe. Over 4 million users worldwide use Alertsec Xpress’s Check Point Full Disk Encryption.

Enhanced by Zemanta

Data breach in North Carolina’s Cornerstone Neurology

March 17th, 2014

 

Information of 548 patients from Cornerstone Health Care in high Point was stolen which may lead to data breach. Incident came to notice when employees didn’t find the laptop. It contained protected health information (PHI) including patient names, dates of birth, physician names, and nerve conduction scan summaries, but did not have addresses, billing information, or Social Security numbers.

Thief was not able to access additional information as computer was not connected to the billing system or electronic security numbers. Compliance and patient safety officer said, “This wasn’t one of our laptops that our providers use to see all of our patients. Because this computer isn’t integrated into our systems, we didn’t have an easy way to figure out what patients might have been involved.” Officials believe that laptop was not stolen for the information.

Cornerstone after the incident revised its policy and procedures to restrain staff securing sensitive information. It was not clear whether Cornerstone has informed the Department of Health and Human Services (HHS) about the stolen equipment and data breach.

Excerpts of the notice from home page says,

Cornerstone Health Care values the trust placed in us by our patients and takes our responsibility to maintain the confidentiality of our patients’ data very seriously. Regrettably, this notice concerns an incident involving some of that information.

We sincerely regret that this incident occurred. To help prevent similar events in the future, we have installed new locks on all rooms in the facility that contain electronic devices, reviewed our information privacy and security policies, and provided education and training to Cornerstone staff regarding the importance of securing patient information. Please be assured that we take the privacy of our patients’ personal information seriously and that we will continue to implement improvements to protect our patients’ personal information.

Alertsec strengthens security

Alertsec Xpress is used by organizations that have recognized the need to protect their information. Customers range from single-user sole traders and consultants to multinational companies with a large number of offices around the globe. Over 4 million users worldwide use Alertsec Xpress’s Check Point Full Disk Encryption.

Alertsec has created a web based encryption service that radically simplifies deployment and management of PC encryption by using industry leading Check Point Full Disk Encryption (former Pointsec) software.

Organizations, especially corporate giants, have to have an information security policy in place that proves they have taken necessary steps and measures to safeguard the information they gathered. If these policies are not adhered to, the regulators may prosecute.

Enhanced by Zemanta

Recent Update for United Healthcare fax breach

March 14th, 2014

Patient info was sent to the wrong recipient, Stephen Butler’s. A Portland, Oregon man received erroneous faxes containing protected health information (PHI) from Community Memorial Hospital patients. Fax was intended to be sent to United Healthcare, as Insurance Company but went to Butler instead.

Fax contained four patients birth dates, insurance identification numbers, and admission dates. Roper, the hospital believes that this was the only fax sent to wrong recipient. But hospital was unaware about the incident until it was contacted by the news agency. It is believed that error was mostly likely due to dialing of wrong number. United Healthcare has carried out his own investigations.

Roper St. Francis, the healthcare network released the statement,

Roper St. Francis is committed to protecting the privacy of patients. This week, Roper St. Francis leaders learned that on August 1, 2013, one fax intended for an insurance company was inadvertently sent to a wrong number. The information in the fax contained the names of four patients, their dates of birth, dates of admission, and insurance member ID numbers. Roper St. Francis leaders have personally apologized to the patients involved. The mission at Roper St. Francis is to heal all patients with compassion, faith and excellence, and this includes protecting their private information as well.

Organizations, especially corporate giants, have to have an information security policy in place that proves they have taken necessary steps and measures to safeguard the information they gathered. If these policies are not adhered to, the regulators may prosecute.

Get your personal as well as office laptops encrypted by Alertsec

Unencrypted laptops present a major risk of data loss. 80% of information theft is due to lost or stolen laptops and other equipment. About 50% of network intrusions are performed with credentials gathered from lost or stolen devices. The penalties for a data breach are severe not only in terms of the monetary fines imposed on the organization, but also the potential loss of trust from customers and suppliers. Encryption software greatly enhances the security of your organization’s data as the information is not compromised if a laptop is lost or stolen.

Alertsec Xpress is the full disk encryption service that delivers a mobile data protection system for all information stored on laptops used throughout your organization.

Enhanced by Zemanta

Health Source of Ohio file breach affects 8,800 patients due to Internet lapses

March 12th, 2014

Health Source of Ohio (HSO) reported a data breach of 8800 patients when the PHI information was available on Internet. PHI information contained names, addresses, phone numbers, and account numbers for each patient. Some patients also had their dates of birth, healthcare information, credit card numbers, and Social Security numbers in the file.

The Information was gathered through a web based program used by Health care accounting staff. The information was supposed to be accessible only to authorized staff – but file was available through internet searches. The file was viewed 47 times and soon after discovery of breach, HSO secured the data and disable the site access. It was not clear what actions were taken by the health centre to avoid such incidents in future.

HSO stated, “The privacy and security of patients’ personal and healthcare information is very important to HSO. Individuals who called HSO’s patient accounting staff during the time period above with questions about their account should examine their personal and financial information, such as credit card accounts and accounts with financial institutions for unusual or unauthorized activity.”

HSO listed Pair Networks as the business associate in the statement to HHS. File was hosted on the servers of Pair Networks. Pair Networks’ terms of service in their contract makes account security the sole responsibility of the customer. It does not mean that breach happened due to Pair Networks.

Alertsec strengthens security

Alertsec Xpress is used by organizations that have recognized the need to protect their information. Customers range from single-user sole traders and consultants to multinational companies with a large number of offices around the globe. Over 4 million users worldwide use Alertsec Xpress’s Check Point Full Disk Encryption.

Alertsec has created a web based encryption service that radically simplifies deployment and management of PC encryption by using industry leading Check Point Full Disk Encryption (former Pointsec) software.

Organizations, especially corporate giants, have to have an information security policy in place that proves they have taken necessary steps and measures to safeguard the information they gathered. If these policies are not adhered to, the regulators may prosecute.

Enhanced by Zemanta

Data Breach in MaryLand DDA affects 9,700 clients

March 10th, 2014

Case management provider Service Coordination Inc.’s (SCI) computer systems of The Maryland Developmental Disabilities Administration (DDA) was hacked which compromised 9,700 patients’ protected health information (PHI). It contained client names, demographic information, DDA service provider, medical assistance number, Medicaid and Medicaid Waiver status and reason, Social Security numbers, and other SCI service information.

“We regret the occurrence of this unfortunate criminal incident and we apologize for any inconvenience this may have caused individuals who we work with. We continue our vigilant actions to safeguard the information of those who count on us for resource coordination services and we remain committed to supporting their needs,” said John Dumas, Executive Director of Service Coordination

SCI contacted a cybersecurity forensics team which confirmed unauthorized use. SCI also notified the FBI and U.S. Department of Justice (DOJ). It requested a delay in clients’ notification to avoid hindrances in their criminal investigations. Only after law enforcement seized the hackers account and equipment, SCI began notifying the clients.

SCI is offering one year free identity theft protection to those affected by the breach. In a website statement, SCI further added,

There is no current evidence of any misuse or further release of information by the hacker or others. To help protect affected Maryland residents from the possibility of identity theft and/or fraud as a result of this incident, SCI has engaged an identity theft protection firm, to provide affected individuals with a full year of identity theft protection services at SCI’s expense.

Alertsec strengthens security

Alertsec Xpress is used by organizations that have recognized the need to protect their information. Customers range from single-user sole traders and consultants to multinational companies with a large number of offices around the globe. Over 4 million users worldwide use Alertsec Xpress’s Check Point Full Disk Encryption.

Alertsec has created a web based encryption service that radically simplifies deployment and management of PC encryption by using industry leading Check Point Full Disk Encryption (former Pointsec) software.

Organizations, especially corporate giants, have to have an information security policy in place that proves they have taken necessary steps and measures to safeguard the information they gathered. If these policies are not adhered to, the regulators may prosecute.

Enhanced by Zemanta

Mental Health Treatment Organization health data exposed

March 8th, 2014

Community Based Services On-Call Binder of Yellowstone Boys and Girls Ranch (YBGR) in Montana was lost or destroyed. Organization printed legal notice in the news paper informing clients of the breach.

Binder contained Protected Health Information (PHI) from clients, including names, addresses, dates of birth, parents’ names, and program and treatment professionals’ information. Financial information and Social Security number was not present in the binder.

YBGR has stopped using binders after the incident. It has notified the clients for same. New process is followed were staff members must use a new on-call system or visit a ranch office to receive information. YBGR is in the process of implementing new electronic record system to ensure security of the sensitive information. It has notified the customers to monitor credit reports. They are also advised to inform Federal Trade Commission (FTC) for any suspicious activity.

“We want to make sure that if there’s any trust lost with any of our families, with any of the people we work with, we want to regain that,” said Shawn Byrne, YBGR’s chief operating officer for community-based services.

In its public notice YBGR mentioned,

We conducted an extensive investigation and determined that the Binder was either destroyed or misplaced sometime during the summer of 2013.

YBGR has no reason to believe that any personal information was accessed or used inappropriately and we believe that the likelihood of such misuse is low. Nonetheless, out of abundance of caution, and in accordance with federal law, we are providing the media with notice of this incident, in addition to individualized notice to every client who might have been affected so that our clients might take steps to protect themselves from potential harm resulting from this incident.

Alertsec strengthens security

Alertsec Xpress is used by organizations that have recognized the need to protect their information. Customers range from single-user sole traders and consultants to multinational companies with a large number of offices around the globe. Over 4 million users worldwide use Alertsec Xpress’s Check Point Full Disk Encryption.

Alertsec has created a web based encryption service that radically simplifies deployment and management of PC encryption by using industry leading Check Point Full Disk Encryption (former Pointsec) software.

Organizations, especially corporate giants, have to have an information security policy in place that proves they have taken necessary steps and measures to safeguard the information they gathered. If these policies are not adhered to, the regulators may prosecute.

Enhanced by Zemanta