News and Toolkit Updates
Recent breach shows importance of BA agreements
Carefully managing your Business Associates (BA) agreements is important. At PrivaPlan we can’t emphasize that enough. The following story illustrates why. As if going to the dentist doesn’t cause enough anxiety, last week 4300 dental patients learned that their personal records may have been compromised. Massachusetts General Hospital (MGH) in Boston contacted the patients about…
From the PrivaPlan Blog
Alert: Imminent and increased threat of cybercrime attacks against healthcare industry
The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Health and Human Services (HHS) issued a Joint Cybersecurity Advisory October 28 siting “credible information” they have on an “imminent and increased” threat of cybercrime attacks against the US healthcare industry with the goal of locking down systems, stealing data, and extorting money.
Sign up now for Oct. 27th Webinar: Managing Cybersecurity During a Pandemic
BlueNovo and PrivaPlan will provide tips and tricks to safeguard your systems and people.
Alert: Postcard Disguised as Official OCR Communication is in the Mail
Though the postage is marked first class, the mailer’s intent is not. In fact, it is another low-class act by scammers. The United States Office for Civil Rights (OCR) released a statement on August 6 about postcards that are being sent to health care organizations disguised as official OCR communications, claiming to be notices of a mandatory HIPAA compliance risk assessment.
OCR warns there is an individual posing as OCR Investigator
On April 3, the Office for Civil Rights (OCR) issued an alert that an individual posing as an OCR Investigator has contacted HIPAA covered entities in an attempt to obtain protected health information (PHI).
Cyberthreats are lurking in COVID-19 pandemic
“As more of our employees work from home and are under the collective stress of the COVID-19 pandemic we become easy victims,” said David Ginsberg, PrivaPlan president. “Security reminders and awareness at this time are essential.”
Best HIPAA Practices Working From Home During the COVID-19 Emergency
During the Coronavirus emergency, physicians and healthcare providers may want to adopt telemedicine as a way to provide patient care. This is an acceptable practice under HIPAA and California data and privacy laws but some precautions should be followed.
Windows 7 support ends January 14, 2020
On January 14, 2020, Microsoft stopped free support for Windows 7 just as promised.
Are your Business Associates protecting your patient data?
This week, American Medical Collection Agency (AMCA), the billing collections vendor for both Quest Diagnostics and LabCorp, reported to both companies that the data of nearly 20 million customers may have been compromised.
HHS reduces maximum civil penalties for HIPAA violations
The HHS published a Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties that changes the interpretation of fines for violations defined under the HITECH Act, effectively reducing some of the annual limits.
Email breaches in three states expose protected health information
Three email system breaches in three states exposed protected health information and each healthcare entity is stepping up efforts so it won't happen again.
Payroll phishing scam targets university employees
Three university personnel began the new year without paychecks after falling victim to a payroll phishing scam.
Health Sector Cybersecurity Coordination Center opens
The Health Sector Cybersecurity Coordination Center underscores HHS’ commitment to support and improve the health sector’s cybersecurity defenses.
PrivaPlan advises rural health care staff to train, train and retrain
Train, train and retrain is at the top of PrivaPlan’s list of practical solutions for being HIPAA compliant.
PrivaPlan HIPAA Certification Program promotes culture of compliance
PrivaPlan’s HIPAA Certification Program is giving healthcare professionals access to what had once been next to impossible to find: a one-stop shop to become a certified HIPAA expert.
Verizon’s 2018 Data Breach Investigations Report Shows Healthcare Suffers Most Breaches
Can you hear me now? Verizon reports that the healthcare industry had more breaches than any other industry in 2017. In the recently released 2018 Data Breach Investigations Report (DBIR) by Verizon, Personally Identifiable Information and Protected Health Information were shown to be the most common types of data compromised overall, even more than payment…
Judge rules in favor of OCR, orders cancer center to pay $4.3 for HIPAA violations
A HHS Administrative Law Judge has ruled that MD Anderson violated HIPAA and is requiring the Texas cancer center to pay $4.3 million in penalties to the OCR.
World’s worst criminal phishing botnet gets trickier
The notorious Necurs botnet has upped its crime game by adopting a retro trick to make itself more evasive and less likely to having its phishing intercepted by your filters.
Hacking group targets healthcare industry worldwide
Cybersecurity firm Symantec announced this week that a hacking group called Orangeworm appears to have been targeting the healthcare industry in the United States, Europe, and Asia.
Vendor email attachments could be phishing bait
One of the latest reported email phishing schemes is very hard to beat and it always includes an attachment. What can you do about it?
HIMSS survey shows significant security incidents
The annual HIMSS cybersecurity survey released March 8 revealed that nearly 76 percent of health information security professionals believe their organizations experienced a significant security incident in the past 12 months.
Latest phishing scams target payroll direct deposits
Scammers are cashing in on company paydays much to the chagrin of employees who had a lapse in judgment and shared their log-in credentials. Warn your employees NOW about this latest phishing scam involving payroll portals.
W-2 phishing season is here…again
As the tax season gets underway, you can bet that cyber criminals are doing their tax preparations for W-2 phishing; they’re preparing to dupe hundreds of payroll and HR departments into providing W-2 data on their employees.
Phishing scam exposes PHI of patients at Colorado Mental Health Institute
As the year comes to an end, there appears to be no end in sight for healthcare data hacks. An employee at the Colorado Mental Health Institute at Pueblo recently fell for a phishing scam that potentially exposed the PHI of 650 patients.
Will a Federal Data Security and Breach Notification Act finally get passed?
Three Democratic Senators re-introduced a Data Security and Breach Notification Act on Thursday that has failed to get legislative approval since 2015.
Protect your data: 10 tips for online shopping
The National Retail Foundation says that 78 million people plan to do online shopping on Cyber Monday. No doubt a good number of those will do that at work.