2. Paul Arguinchona "The biggest threat, which I think is often overlooked, is staff."

This week on HIPAA Critical we tackle the latest headlines, chat with Frontier Behavioral Health CIO, Paul Arguinchona and discuss a much-needed strategy to create Secure Email Marketing in 2020.

Rather read?

Rick Kuwahara: Hey Olena, my pleasure. Always fun.

Rick: Yeah, so evidently, you know, the fallout was kind of big as you talked about with Hoala but it looks like now, you know, the legislation is, been introduced and proposed, that's going to help close some of those privacy gaps that were of big concern from project Nightingale.

So the big thing is that, the legislation is looking to ban companies that collect data through smart devices or personal health trackers, uh, to stop them from actually selling, sharing, transferring or allowing access to data without explicit consent from the consumer.

Rick: Yeah. And they might not have, but there is definitely a gap between how technology and innovation has, evolved within healthcare and HIPAA regulations, you know, as it currently is, is just missing a little bit of that, addressing some of those needs and concerns.

Because we do want the innovation, you know, that helps everybody but not at the cost of security and privacy. So the current legislation that's been introduced is going to help address some of those gaps. Especially as people are more aware of, you know, privacy concerns as there's more hacks and breaches in the news.

You know, people need to be more concerned and have more control over their own data.

Rick: Yeah, the concern really is, what is happening to the data after it's collected? You know, not necessarily is it secure up in the cloud or not, but you know, what is Google doing with it? Who is seeing the data? How are they sharing it? Are they using it for their own purposes, not just only within the confines of the agreement with Ascension.

So that is the question that is coming up. People don't want where, okay, maybe I've agreed for Ascension to collect my data and, but because Ascension is partnered with Google, I don't want Google to then take that data and use it for its own purposes.

So this ban just really explicitly calls out that you have to be really clear on what is happening with people's personal health data when they are allowing it to be tracked or collected for valid reasons and research.

Rick: Well, it definitely can be a concern because it is health data that's getting collected. You know, your heart rate, how you're moving, where you're going, those types of information. If it's used in unison with any of your treatment, for example, that is definitely protected health information.

We want to make sure that that is secure. So when you're using a Fitbit that you have control over who is seeing that information, if you want only yourself to see it, um, or maybe a friend or family member or even your doctor, you should have control over it and you shouldn't be concerned with what Fitbit's doing with it.

Rick: Yeah, those things are great. Yeah. My dad took a trip to Korea and he was telling us how many steps they took every day. Like it was, those things can be helpful.

Rick: Well, I think it's good in that it's raising a lot of these questions and bringing it to the forefront. So that people, you know, whether their concerns are valid or not, I think that clarity and how data is being used, protected and shared is good for everybody and I think it can only help give confidence to consumers too.

And even the healthcare industry to really adopt innovation and move forward knowing that, hey, we have these things in place that's going to make sure that everybody's safe and secure.

Rick: We learned once again how big a threat, email is as far as phishing and spam emails coming in.

So Solara, which is the largest, US independent supplier of continuous glucose monitors and other products to help people manage their diabetes. So big company. They found that some of their employees fell for a phishing scam that gave the hackers access to their Office 365 accounts.

And so once that happened, those hackers could collect information that include name, address, date of birth, social security numbers, just a lot of sensitive information. And over 114,000 people were affected and it was just a big data breach and it was caused because of a human error with employees clicking on a link, a malicious link from, you know, the phishing attack.

Rick: Yeah, it's a really big problem. And it's why training is so essential because something's going to get through.

I mean, Office 365 does have... it's notorious for not catching everything, but at the same time, if something does come through, you need to make sure that your staff is properly trained to know what to look for and how to spot a malicious email.

Rick: Well, for, you know, Solera is a big company, but it's not 114,000 big. So I'm pretty sure that those are all patient data or customer data and they have reached out to those people already.

So hopefully they're working to monitor their identities because once those hackers get that information, you know, the money is in selling that data on the dark web.

So that's something that a lot of people gotta look at. All those people who are affected need to be able to monitor, you know, their identity and credit reports and everything to make sure that nothing's going to happen.

You know, as these attacks keep happening more and more, a lot of it is because not just the money, and people are attracted to money for the hackers, but also for the ease that people can execute some of these attacks now.

It's not...you don't have to be super technical as a hacker anymore. A lot of times this is all like, people can buy these phishing attacks on the dark web and execute it without needing to be overly technical. So that just increases the amount of attacks that are coming out and which further emphasizes that, you know, organizations have to be very proactive in how they are training their staff to help prevent, you know, these type of breaches from occurring.

Rick: Yeah.

Rick: Yeah. It's...I mean the technology is there and it can be used, you know, for good or bad. And so we just have to make sure that we're doing our job on the good side to fight all these bad actors.

And you know, we were very fortunate to have a chat with Frontier Behavioral Health CIO Paul Arguinchona to discuss more in depth about how social engineering is such a major threat to healthcare organizations and also how to prevent those attacks from, being successful. So here's a quick excerpt from that interview.

Paul Arguinchona: Well, from a frequency standpoint, email threats with a heavy leaning towards a social engineering theme, several staff were being tricked into following nefarious various links, asking for login credentials. That's our biggest, threat vector at this point.

Paul: Well, the biggest threat, which I think is often overlooked, it's not new, and its staff.

And as an employer, the staff are trying to get things done and they end up either working too quickly or trying to be helpful or they're inattentive and they'll not, going back to email being our biggest threat vector.

They won't completely read an email, they won't evaluate whether it's valid and from an appropriate sender and uh, they will take shortcuts and click on things or execute something that they shouldn't.

Paul: Training the staff. Making them aware of possible threats, teaching them how to read an email. Training them that if they receive an unexpected email that's asking for something from them to be cautious with it and partly suspicious and validate that it's really business-related and not problematic.

And if they have any questions to contact the RIS support.

Paul: Absolutely. And I'm not trying to promote what the bad actors are out there doing, trying to get in and take advantage of our data and things like that.

But they're getting very sophisticated and it's fascinating to watch it happen. And it will remain fascinating as long as we can keep blocking it, keep mitigating the risk of the agency.

Paul: Well, hopefully, and hope's not a strategy, I hope security regulations will catch up with the need to efficiently share sensitive data.

As in healthcare in particular, there's an approach towards more comprehensive care and taking the silos with behavioral health and physical healthcare and tying those together and the privacy regulations right now hinder that significantly.

Rick: And you can find the full transcript of that interview on our blog.

Rick: And obviously, you know, Frontier Behavioral Health, like we heard, they're obviously a winner in how they're proactively trying to keep staff updated on spotting email threats. It's such an important part of any security strategy.

But another winner is actually anybody who's looking for a job in cybersecurity.

Rick: So a recent study, by ISC2 which is a nonprofit association for information security leaders, a study that they did shows that there's a big gap in the current workforce and the demand for skilled cybersecurity employees.

So there's a big opportunity for people, especially if you're looking to switch careers because only 42% of the respondents in the study said that their first job was in cybersecurity.

So it's good news if, you know, you're somewhat technical and you're looking for somewhere to, you know, put your energy. Cybersecurity is a good industry for you to be in. And it looks like there, you know, there's a big need for more people to be in that, uh, to fill the all the job opportunities that are out there.

Rick: Yeah. And the need is only going to grow. So, if you're looking for a job or you know, anybody who, who is technical and you know, you might want to nudge them over into cybersecurity as a path. Good news.

Rick: So Solara is obviously in here, but another recent attack within the healthcare industry occurred for Ferguson Medical Group, which is part of St. Francis Health. And they reported a data loss that occurred from a ransomware attack.

So again, it's phishing that led to this attack and it actually locked down the network for them.

And you know, thankfully it wasn't that...I mean it's a big deal, but it wasn't, it could have been way worse. So this actually... Ferguson Medical Group, this is in the failure section because that phishing email was successful, but it's still partly a win for them because they had the appropriate measures in place to mitigate the damage.

There was, as far as they are disclosing right now, that there was no compromised patient information. You know, they had the backups in place so that they weren't...they did not have to pay the ransom, which is the worst thing people can do and they were able to recover most most things.

The bad news is that they did permanently lose records between September and December of 2018 but really it could have been much, much worse.

Rick: So it's in the failures only because the attack was successful, but, you know, as a part win too, because they had to things in place to make sure they could recover from that attack.

Rick: Right. You know, with holiday shopping around the corner, here now, it's kind of big news that may Macy's, got hacked.

Their checkout page was hacked and they found...I mean they've, they were able to notice the suspicious activity, but their checkout pages were hacked in October and customers could have had their name and credit card information stolen.

And Macy's is going to foot the bill for credit card monitoring for all effected customers. But you have to check in with them to see if you were affected. So if you bought anything from Macy's online in October, you might want to contact them.

Rick: Yeah, definitely. I think a big, big thing, especially around the holiday season is when people make a lot of, you know, big purchases, like expensive purchases.

So people will take advantage, not just on the websites of these retailers, are setting up fake websites but also spoofing emails. So people could see a rise of phishing attacks where people are pretending, where hackers are pretending to be banks or credit card institutions sending a notice saying, "your card has been frozen because of suspicious activity. Click here."

Or you know, "we noticed an unusual purchase" or something that you would get normally if you spent a lot above your normal limit. Um, and banks often do send these type of notices.

So they might try to pretend to be those banks sending these notifications. But instead of being an actual, verification of a purchase, it's a malicious link that you click on that can compromise your, your information.

Rick: So number one is mixture of course that you have your spam filters on good, if you have them. And that includes antivirus on your computers.

The other part is just to really pay attention to the details of the emails that you're getting. So typos are getting less and less as people are getting good at copying legitimate emails. But you can see who the sender is. Don't just pay attention to the sender name.

Make sure that you see what email address is being sent from and if it looks suspicious, contact your bank or credit card company and validate that, Hey, is this a real email address that you guys are sending?

Rick: Yup. Yup. People can, people, especially when you get so many emails and sales emails and things, and it's second nature to just look at, Oh, who's the from, what's the name that is being sent from without actually looking at the email itself.

Rick: They could have gotten it from someone else. If they hacked into someone else's and you were in their address book. They could have just done social engineering. They know how popular you are. We gotta get Olena Heu.

Rick: Yeah. And our prediction this week is something that we've learned from discussing with customers and potential customers. And that's outreach within healthcare.

You know, we always focus on the security of healthcare, but really the end goal is always tied to health outcomes and helping patients and everybody stay healthy or get healthy.

And that often means you need great patient engagement to reach those outcomes, which in the end means you need solid communication or a way to communicate with patients.

So we found in a recent call that a lot of contracts that some health organizations are fulfilling requires a certain number of engagements in order to meet the obligations of that contract or even use a minimum number of ways someone has to be contacted.

So for example, you know, we are talking to a pretty large provider that won a contract for diet and health. And one of the requirements, the contract was that they had to contact patients or participants a minimum of three different ways. So they, they already knew they were going to do phone calls, they were going to do snail mail and for a third option they wanted to do email.

But on the market right now, there's no real solution out there for email marketing or a way to send secure email in mass, like a HIPAA compliant version of MailChimp. So we know that...we're predicting that this need is only going to grow.

And that's why we just opened up, early access to our HIPAA compliant email marketing solution that we're developing.

Rick: So we're very, yeah, we're very excited for it. There's been a lot of good feedback early on and we're getting a lot of early adopters and the advantages is people can come on now as we're finishing up the development of our version one, is that they could participate in the roadmap and help us develop the next features for version two and onward.

So people can become an early adopter just by saying an email to feedback@paubox.com.

Rick: Yeah, we're, we're very, very happy about it. Excited everybody's...was pretty stoked and we have a lot, a few customers who've already become early adopters and we're excited to keep this early access program open up through December.

Rick: Thanks. Yeah, we're very happy too.

Rick: Yeah. And also thanks to Paul Arguinchona, the CIO of Frontier Behavioral Health for giving us the time to sit down and talk a bit.