To keep our pulse on the HIPAA industry, we subscribe to the U.S. Department of Health and Human Services' HIPAA Security Rule Distribution List. This past week we've seen a lot of activity on the list, so I'm sharing some of it via this post. The reasons behind its surge in activity of course, are the WannaCry ransomware attacks.
SEE RELATED: 3 Key Lessons Learned From WannaCry Ransomware Cyberattacks
If you are the victim of ransomware
If your HIPAA organization is the victim of a ransomware attack, HHS recommends the following:
- Contact your FBI Field Office Cyber Task Force immediately to report a ransomware event and request assistance. These professionals work with state and local law enforcement and other federal and international partners to pursue cyber criminals globally and to assist victims of cyber-crime.
- Report cyber incidents to the US-CERT and FBI's Internet Crime Complaint Center.
- For further analysis and healthcare-specific indicator sharing, please also share these indicators with HHS' Healthcare Cybersecurity and Communications Integration Center (HCCIC) at HCCIC_RM@hhs.gov
HHS Office of Civil Rights guidance on HIPAA specific to WannaCry
As outlined in its online ransomware fact sheet, HHS presumes a breach in the case of a ransomware attack. The entity must determine whether such a breach is a reportable breach no later than 60 days after the entity knew or should have known of the breach.
SEE RELATED: FACT SHEET: Ransomware and HIPAA [HHS]
Ransomware guidance also includes important information about ransomware and how compliance with the HIPAA Security Rule helps entities prepare for ransomware attacks. This includes regard to contingency planning. OCR has shared its FAQ on sharing of cyber threat indicators here.
Important Note: If the data is not encrypted by the entity to at least NIST specifications when the ransomware attack is deployed, then OCR presumes a breach occurred, due to the ransomware attack. As such, the Covered Entity or Business Associate would need to prove that the ePHI was encrypted when the attack occurred and the ransomware containerized (or encrypted again) already-encrypted ePHI.
SEE ALSO: HIPAA Breach Notification Rule
Where can I find the most updated information from the U.S. Government?
For overall Cyber Situational Awareness, visit the US-CERT National Cyber Awareness System. The NCCIC portal is here (Restricted access). Indicators Associated With WannaCry Ransomware:
Healthcare and Public Health-directed Resources:
Try Paubox Email Suite for FREE today.
Hoala Greevy
