In late January, the U.S. Department of Health and Human Services’ Healthcare & Public Health Sector Coordinating Council issued a new cybersecurity guidance document for healthcare businesses of all sizes. The guidance document, entitled “Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients,” available at https://www.phe.gov/Preparedness/planning/405d/Pages/hic-practices.aspx, provides concrete and practical guidance for addressing what the Council has identified as the “most impactful threats . . . within the industry” and serves as a renewed call to action for implementation of appropriate cybersecurity practices. This document is critical reading for healthcare business managers faced with ever-increasing cybersecurity risks and the attending risks to patient safety and operational continuity, business reputation, financial stability, and regulatory compliance.
Continue Reading HHS Issues Practical New Cybersecurity Guidance for Healthcare Businesses of all Sizes
Data Breach
Yahoo! Breach Class Action Poised to Settle
By Jon Washburn on
The Yahoo! class action over the 2013-2014 hacks, affecting 1 billion (later updated to 3 billion) accounts, is poised to settle for $85 million – and the provision of free credit monitoring services for 200 million account holders for 2 years.
While $85 million may seem like a relative bargain compared to the $350 million…
Anthem Pays OCR $16 Million in Record-Breaking HIPAA Data Breach Settlement
By Sarah Bimber on
The Office of Civil Rights (OCR) announced in a press release this week that Anthem, Inc. (Anthem), one of the nation’s largest health benefit companies, has agreed to pay $16 million and take substantial corrective action to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules. This settlement…
When was the last time you looked at RDP access?
By Jon Washburn on
A presentation at Black Hat recently revealed that the creators of the “SamSam” ransomware have netted over $6M to date, attacking mostly medium-to-large public and private sector organizations. And they’re showing no signs of slowing down.
In the most recent SamSam attacks, the attackers concentrated their efforts on brute-force hacking of weak passwords on devices…
List of Pending 2018 Breach Legislation
By Jon Washburn on
Posted in Data Breach, Laws / Regulations
While we have yet to see much in the way of major changes (or punishment) following the massive Equifax data breach last year, there are many changes being introduced at the state level with regard to breach notification, penalties, whether or not credit reporting agencies can charge you for freezing your credit, and consumer rights…
CNIL’s GUIDANCE FOR PROCESSORS – ANSWERS TO YOUR MOST PRESSING QUESTIONS
By Amy Carlson on
See European Regulation on the Protection of Personal Data Guide Sub-Contractor Edition, September 2017.
- Are you a contractor within the meaning of European Regulation on data protection?
- Are you subject to EU regulation on data protection?
- What is the main change introduced by the European regulation for contractors?
- What are your obligations as of
…
Big Data is amazingly useful … and risky
By Jon Washburn on
Per the Freedom of Information Act, US citizens have the right to access information from the federal government. We can visit Data.gov to search the more than 197,000 current datasets currently indexed on the site. While the intent is to leverage that data for the public good, there’s also an enormous amount of information …
Proposed Oregon Legislation: Credit Card Data Breach Bill
By Robert Teel on
Posted in Data Breach, Laws / Regulations
We received a proposed data breach bill (available here) recently circulated in Salem. This draft is a variant of Oregon House Bill 2581 that died in committee. That bill would have required, among other things, merchants impacted by security breaches to notify issuing banks of all the credit cards subject to the breach.…
Should I Place A Fraud Alert vs. Security Freeze?
By Amy Carlson on
Posted in Data Breach
Should I Place A Fraud Alert vs. Security Freeze? As a privacy professional, almost all your fellow employees were affected by the Equifax data breach. You may be asked about whether to place a fraud alert or a security freeze. You can send this guidance from the FTC on the difference between fraud alerts and …
Yawn – Another Company Failed to Patch. Wait! 144 Million Affected?
By Amy Carlson on
Posted in Data Breach
Yawn – Another Company Failed to Patch. Wait! 144 Million Affected? A PR Disaster? Failure to promptly patch is an incredibly common cause of data breaches. Learn from Equifax’s situation about patching and communication. Boards, Senior Management and privacy personal should confirm that patches are applied promptly. Also, when breaches occur, hire and listen to…