25. Sierra Reed "Risk assessments and analysis are very crucial to any resilient healthcare information security program"

A new report shows only half of healthcare providers are meeting NIST Standards, Premera Blue Cross pays a hefty fine to the Office of Civil Rights, and more details on October's Paubox SECURE@ Home virtual conference. It's free to join the conference.

Rather read?

Sierra Reed: Hi, Olena, I'm happy to be here. Happy Wednesday!

Sierra: Thanks, Olena. 

According to a new report that analyzed 300 healthcare providers' assessments against the NIST cybersecurity framework, data shows that despite increased healthcare data breaches, cybersecurity progress in healthcare is declining. 

Currently, only half of the healthcare providers meet cybersecurity standards. Some examples of companies examined in this report include physician practices, accountable care organizations, and business associates.

Sierra: What's troubling is that there has been no progress in this conformance. 

So far this year, there's been a record number of phishing and DDoS cyberattacks, and combined with COVID-19, these issues will only continue to worsen. 

Something to note is that there has also been an increase in phishing and business email schemes disguised as supply chain emails for personal protective equipment (PPE). That is a good thing to be on the lookout for.

Sierra: Key findings of the report point out that organization and budget do not equal better security performance. 

Actually, in some cases, larger organizations performed worse than smaller provider organizations.

Assisted living facilities best conformed with the NIST CSF at 96% in 2019, followed by insurance at 59%.

Physician groups are the least likely to conform with NIST standards at 28% this year. 

Some more key takeaways of the report include healthcare focus on information security has increased over the last 15 years, but the investment is still lagging. 

Furthermore, investing in security isn't enough these days. Security leaders must identify priorities, invest in multi-factor authentication, privilege access management, and ongoing workforce security training is very important.

Sierra: Premera Blue Cross has agreed to pay $6.85 million to the Office for Civil Rights. The company also agreed to implement a corrective action plan to settle violations of HIPAA privacy and security rules.

This is related to a breach affecting 2.4 million people's PHI. This resolution is the second-largest payment to resolve a HIPAA investigation in OCR history.

To give you some background here, Premera operates in Washington and Alaska and is the most extensive health plan in the Pacific Northwest. 

The cyber attackers gained access through the Premera IT system.

Sierra: They sure do. Hackers used a phishing email to install malware that gave them access to the IT system.

Believe it or not, this went undetected for nine months, which is crazy.

The OCR investigation found systemic non-compliance with the HIPAA rules.

Sierra: If healthcare insurance entities don't have time to invest and put forth the effort to figure out their security vulnerabilities, hackers most definitely will exploit that.

Sierra: Yes! This is a large event for us. 

It's our virtual healthcare, cybersecurity, and innovation conference. It's fast approaching and will take place on October 21 and 22. It's a two-day event.

Sierra: We have a free ticket that can be found at PauboxSECURE.com. Because we have a free ticket, there's no reason that folks should not attend. 

HITRUST and Goodwin Law are both sponsoring this year. We have eight keynote speakers and nine other speakers. 

Some of the keynote speakers include Jeremiah Grossman, the founder and CEO of BitDiscovery, and Kelvin Coleman, the National Cyber Security Alliance's Executive Director. 

To gain a full list of speakers and information, please visit our PauboxSECURE.com.

Sierra: The Office of the National Coordinator, in collaboration with the Office of Civil Rights, recently released an update to the Department of Health and Human Services security risk assessment tool, which is exciting. 

For those who don't know, this tool was specifically designed to support small and medium-sized healthcare providers to ensure HIPAA compliance.

This is a downloadable SRA tool to support healthcare entities with the risk assessment process specifically. 

It can also inform the provider organization's development of mitigation plans and to review all electronic devices that interact with PHI. 

Under HIPAA, for those of you who don't know, covered entities and their business associates are required to perform a risk assessment to assess compliance with HIPAA safeguards.

Sierra: Risk assessments and analysis are very crucial to any resilient healthcare information security program. 

What we've talked about a lack of risk assessments can prove very costly.

For example, the Texas Health and Human Services Commission paid a penalty of $1.3 million in 2019, while Touchdown Medical Imaging settled with OCR for $3 million. 

These are both great examples of failing to conduct a risk analysis.

Sierra: We've had many failures in this episode, and we spoke about them, but to add to the list, Athens Orthopedic has to pay the OCR $1.5 million over non-compliance. 

This stems from the notorious hacking group, The Dark Overlord, hacking into their data and posting patient data online. This group stole the data of more than 655,000 patients, which is a considerable amount. 

The motivation for The Dark Overlord is to hack into targeted networks to then sell access on the dark web or extort for financial gains.

Sierra: When the OCR conducted the audit after the attack, they found a list of grievances. 

Some of these include failing to conduct a risk analysis, which we spoke of before, implementing risk assessment and audit controls, and the requirement to implement security measures to reasonably reduce risks and vulnerabilities. 

If this wasn't enough, the clinic did not maintain HIPAA policies and procedures, nor did they secure a business associate agreement. The list goes on and on here. 

A key takeaway here is that all healthcare organizations need to ensure that they remain HIPAA compliant, so they don't end up on this list.

Sierra: Thanks so much, Olena.