7. Andrew Hicks "My mission is in life is simplification."

In this episode we talk about malware gone crazy with malware posing as Coronavirus information, Maze ransomware hackers taking things public, and more. We also talk with Andrew Hicks, Vice President of Risk Management at Frazier & Deeter about the how's and why's HITRUST certification doesn't have to be a daunting process.

Rather read?

Rick Kuwahara: Hey Olena.

Rick: Well, I think what everybody is paying attention to right now is the Coronavirus and what's happening in China.

And there's a lot of news around that and unfortunately when there's a crisis, there's bad actors, bad people trying to capitalize on it and that's what we're finding right now.

There's actually news that there are hackers who are using malware posing as health information about the Coronavirus outbreak to infect devices. This was first found in China, but it's going out to different countries.

And what they've found was on their social networking platform WeChat, that there was someone who was sending out suspicious files. And so if someone clicks on it, it downloads malware to the device and then, it lets the hacker control the device and get information out of it.

Unfortunately, it's not contained just to WeChat. There's been multiple phishing campaigns sent to emails where the email is posing that there's information about the Coronavirus or click on this link to find out how you can prevent from being infected and when people click on those attachments or links, then it downloads malware to the computer.

And it lets hackers access the computers and take control of it, where they can download sensitive information that's on there or even use the computer itself as sort of a botnet to take control of other computers. And it's just a really, really unfortunate thing that's happening.

When people are getting these emails from people, it's just like any other email that you're getting, always be suspicious of any link that you see, before you actually click on it.

Rick: Yeah true, but when there's fear there, there's people trying to take advantage of that.

Rick: Well, something else that we talked about a couple episodes ago, was the Maze ransomware attacks that have been happening. The FBI issued a report an alert about Maze and we talked about that a couple of episodes ago.

Well, it happens that now, the hackers using the Maze ransomware are actually posting the stolen health data online.

In November, the Maze hacking group threatened to publicly release stolen data to extort money from the organizations that they had hacked. And so, typically, when ransomware hackers aren't trying to access data or anything, they're just trying to lock down your system and hold that for ransom for you to pay up.

However, the Maze hackers actually infect the system, lock it down, and then take the data, and then they are threatening to post it online if you don't pay them the ransom.

And so what we're seeing now is that data actually being published. One of the largest medical data postings appears to be from New Jersey's Medical Diagnostic Laboratories or MD Lab.

The Maze hacker's website claims that it encrypted 231 workstations during the attack, and when MD Lab refused to pay the demand, the hackers published a bunch of it to force negotiations with MD Lab to try and say, "Okay here's a little bit of it that's online. Now, we'll post the rest if you don't pay us."

Rick: Right, exactly. It's just another layer that's being added on to the ransomware attacks that have been happening.

There's about 29 companies that's listed on the Maze website as organizations that have not paid them. Those are companies where potentially the data that these hackers have stolen could get posted online.

Rick: Well, in the case of MD Lab, there's a estimate of about 100 gigabytes of data was stolen. And they have published just like 10% of that.

Rick: I mean, as always, I've said... Similar things, what we've said before is you wanna be sure that your systems are updated and patched, especially for a lot of these organizations, older and healthcare organizations where they have legacy systems that they're using.

A lot of times there's... It's easy for gaps to be in there so making sure that that's properly patched up and to just look for signs of compromise. You have to assume that someone will get past your firewall.

Have the right policies, programs, procedures in place that you can identify if something has happened so that you can stop it right away.

And then, of course, training their staff is always a big thing, because a lot of those times ransomware gets in through phishing attacks and that has a human element to it where it's going to someone's inbox and someone needs to be able to recognize, "Hey, this is fishy. I'm not gonna click on it at all."

Training your staff and having a good backup and recovery process is gonna be key as well.

Rick: Yeah, for sure. And it's something that I think every organization, not just healthcare, but everybody's going to have to make sure that their staff is trained on.

Rick: Yeah, and some good news out at New Jersey, not all bad news with MD Lab, but the Governor Phil Murphy signed a regional health hub program into law a couple of weeks ago.

The legislation, basically names a few health centers as regional health hubs in New Jersey. These health hubs are gonna take the place of the accountable care organizations or ACOs, but they are going to have the same goal of helping improve health outcomes of those on Medicaid, so often, the most vulnerable populations.

The goal is under the new model, each hub is gonna serve as a local expert and conduit for state health priorities. It's going to be able to decentralize a little bit and hopefully move faster and be more useful out on the regions that they're helping.

Rick: It's important because it's hard to mobilize and work across wide areas with big populations. For New Jersey, this regional health hub model can help involve the community better, and it could definitely serve as a model for other states to emulate.

Rick: Okay, and in other news, something else that's exciting that's going on out on the West Coast is the University of California San Francisco's accelerator launched a program to help improve digital health access.

They call it SOLVE Health Tech, and it's from UCSF's health equity accelerator.

And they began a research project to identify and eliminate barriers preventing the underserved populations from accessing healthcare because it doesn't matter if you have all these awesome digital health access apps, whatever it is, if the people you're trying to serve can't actually get to it.

They have partnered with AppliedVR, which is a company that's developing virtual reality-based therapeutics, and they are gonna interview healthcare providers about the best ways to integrate VR and other digital health tools into systems with large Medicaid populations, which as you just talked about are a lot of times those underserved populations.

They're going to share their findings with AppliedVR to try and solve the issues of how do you get these digital health solutions to be used and accessed by all these different populations.

Especially where there's not everybody has access to the internet, or the technology like a smartphone, we take it for granted for ourselves, but not everybody can rely on it.

How do we get these solutions into the hands of people so that they can have better care and access to everything that the health technology has to offer?

Rick: Yeah, and I think that it's great to see continuous of trend of more health systems getting involved and helping to lead innovation, trying to solve problems in a unique way. That's really great.

Rick: Yeah, the first one up is an incident where malware destroyed data of 30,000 patients.

This incident happened with the Texas-based Fondren Orthopedic Group, and they started notifying people that their data was destroyed after a malware incident back in November.

Basically, it looks like data was accessed by a hacker and some of the patient records were destroyed. Thankfully, they say there's no evidence that any of the data was actually extracted by the hacker, but it did destroy the medical records that include things like patient names, your diagnosis, treatment, health insurance data.

A lot of sensitive and important information was destroyed, but I guess if there's a silver lining, it's that at least none of it was actually taken.

Rick: Yeah, for some it looks like their data, you can almost think of it like back in the days of paper medical records, if there's a fire and something happens, there's no retrieving it.

They didn't outline whether that malware impacted backups. There could be cases where maybe they can find an old backup of the medical history or something, but it's unclear right now.

We just know that over 30,000 patients did have their patient data affected.

Rick: Well, we got one more that we're going to run over real quick. And it's from VillageCareMAX and VillageCare Rehabilitative and Nursing Center.

Their managed care plan members are being notified that their data was potentially breached after a security incident back on December 30th. This one comes through good old-fashioned email where the most of the breaches happen.

An employee received a suspicious email from someone pretending to be a member of their executive team asking for information related to plan members.

This is often called Business Email Compromise, sometimes called display name spoofing, but basically the employee saw an email in their inbox where from had the name of someone from their executive team.

So they thought, "Okay this is legitimate. This is my boss. I'll give you the information."

It was only later that the employee notified leadership that, "Wait, it wasn't actually from that executive."

They launched an investigation and they did find out that the compromised data that was sent out was in fact to a hacker and it included names and Medicaid numbers.

The VCMAX, as they're reviewing their policies and everything, but right now they're just notifying patients and have... All these people have to start monitoring their identity. See if there's gonna be any fraud that occurs.

Rick: It goes back to don't just check the name, check the actual email address because a lot of emails that come into your inbox now, especially like the iPhone, if you're on your mobile device it's even worse, you'll just see who it's from, and that someone's name, and that's the display name.

And that name can be anything, but when you look at the actual email address, you take that one extra step to look at the email address, you can often see that it'll be from some malicious or fake email.

Rick: Yeah. It can even be like if I'm sending something as... If a hacker is trying to spoof me and then instead of coming from @paubox.com, even though it'll have my name on the email, it'll just say it could be from fake email @gmail.com or something like that.

One is always look for the email address, not just the name of the person, make sure the email address is correct.

And two, you can use software such as Paubox Email Suite Plus, where we have ExecProtect which actually stops those spoofs from actually getting to the inbox by verifying legitimate emails in the first place.

Those are two ways that you can kinda go about it, but definitely training is always gonna be one 'cause something's gonna slip through. Hackers are moving fast, as fast as we are.

Rick: You've got to always be alert.

Rick: Building off your experience, your deep experience you've had with assessments and healthcare, HITRUST has really become a big signal in healthcare that an organization takes its security posture seriously. Why do you think that is?

Rick: Great. I know that when we were telling people that Paubox was going through HITRUST, we got a lot of sympathy because it seems such a daunting process, and it really was for us when we were first approaching it, but I like that you don't think that it really has to be daunting.

Can you share a little bit more about why you think that is?

Rick: Okay, great, and how do you really... You mentioned bringing tools to the table, maybe you can talk a little bit more about how exactly you simplify assessments, but still being comprehensive.

Rick: Right well that's great. I know that sounds all fantastic from the organization's side, the side being assessed. And it sounds like too, that's a great scalable way, not just for the initial assessment, but as you go through your annual or biannual reviews.

Rick: Yeah, that's fantastic, and I look forward to hearing how you guys are coming along with that and really pushing that assessor industry forward.

Rick: Sure. One prediction that we think is going to happen is there's going to be more internet of things devices that are gonna be used this year for healthcare.

And we saw that at all the big conferences that happened the beginning of the year, CES, the JP Morgan Week that just happened in San Francisco, and the HIMSS which is coming up in March.

There's a lot of emphasis on a rise in consumer-focused technologies to engage patients and help health outcomes. Those are those apps. It could be devices that are used during treatment.

That's all great. And anything we can do to help out health outcomes is awesome, but what that also does is it increases the attack surface that hackers can go after.

There's going to definitely be a spike in breaches later this year, as a lot of these things get pushed out and hackers start poking and trying to find the holes in it. We'll see a few more of those type of breaches later on in the year.

And again, it just goes back to any time you introduce a new piece of technology, you're introducing a new risk, so making sure that we're always looking at security, at design when we're trying to be innovative, but definitely something to keep an eye out for, especially for consumers.

Rick: Thank you.