Category Archives: Healthcare

Healthcare related posts

Have You Planned For Cloud Outages

Allscripts, the $1.5 billion medical technology and services firm, hosts a number of cloud based applications that doctors and hospitals use to run their operations.  Hancock Health, that I wrote about on Monday, is one of their clients according to HealthcareITNews.  About a week ago Allscripts was hit with a ransomware attack caused by the malware called SamSam.

After the attack Allscripts did what too many companies do and tried to pretend that it wasn’t a big problem, that is wasn’t affecting many people and that is wasn’t a big deal.

A week later Allscripts applications are still not working right.

Doctors can get to the login screen, but they can’t actually log in.

This means that they can’t get to patient records and can’t bill insurance carriers.

Allscripts, in a continuing denial of reality, said that the system was back up but doctors still couldn’t log in.

Doctors are freaking out a bit because they are losing revenue and cannot take care of patients.  Other than that, it isn’t a problem.

It appears that today, Allscripts is finally admitting that they have a big problem.

If you run a doctor’s office or hospital and are an Allscripts client, this is a big problem for you.

Whether you are an Allscripts client or not, here are a couple of things to consider:

  • What is your business continuity plan if your cloud provider has an outage?  For an hour?  For a day?  For a week?
  • Do you have a Service Level Agreement with your cloud provider in case of an outage?  Are the penalties sufficient compensate you for your losses or are they basically meaningless?
  • Do you have cyber risk insurance?  If you do, does it cover business interruptions (BI)?  Often BI has a waiting period before coverage kicks in.  Sometimes it is as long as 12 or 24 hours.  Is your BI coverage appropriate for your business needs?

Hopefully this attack is not affecting you, but whether it is or it is not affecting you, now is a great time to make sure that you are as prepared as you can be.

And, even if your cloud service provider is yourself (AKA Amazon, Google, Microsoft, Rackspace or the like), the problem is the same.

Information for this post came from FierceHealthcare, Healthcare IT NewsHealthcare IT News, again and FierceHealthcare, again.

Facebooktwitterredditlinkedinmailby feather

Faxes are Secure, Right?

It is hard to believe that, in this day and age, people are still using faxes, but they are surprisingly popular, still, in businesses.

And extremely error prone.  There is no error checking mechanism in a fax machine.

You type in a number, stick the pages in and they are transmitted to the other end.  Where ever or whoever that might be.

Sometimes, if the other end is not where you were expecting, it is not a problem.  Maybe they throw the faxes in the trash.  Maybe they shred them.  Maybe, if you lucky, they call the sender and tell them that the faxes did not reach the intended recipient.

But what if you are a health authority and the information is confidential patient information.  And the actual recipient is a computer shop – not one where the patient is.

This was reported in Canada this week.  The Saskatchewan Health Authority sent confidential patient information to local computer shop.  The store owner said that his fax machine received a 21 page fax from a  local hospital destined for a local doctor.

The hospital has a solution to the problem – the computer shop should change its fax number (and somehow notify its customers of this).  Wonderful solution.  The shop owner was actually pretty accommodating about that.  Pay for the costs of the change and he would do that.

The computer shop says that it has received numerous faxes from the Health Authority over the last year.

We hear about this often.  Sometimes in the case of lawyers, they and even the courts, accidentally fax information to the opposing counsel or even unrelated third parties.  In situations like that, a simple mistake can result in a waiver of attorney client privilege.  That can get very messy.

In the cases where the party sending the fax is typing in the number directly, mistyping a digit will send the fax to the wrong place.

In some cases, the fax number is stored in the fax machine’s address book, but was entered incorrectly.

In a few cases, we have even heard of situations where the recipient phone number has been forwarded to another number, accidentally.

Given all these opportunities for error, why do companies continue to use fax machines, especially for sensitive information?

The simplest answer is that fax machines are universal.  Doctors and others have been using them for 50 years and don’t like to change.  Fax machines – at least simple ones – are pretty cheap and the training process is pretty simple.

But another reason is the perception that faxes are secure.  They are not.  There are a few, really high end fax machines that encrypt the faxes, but they are probably like one in 100,000 that can do that and that the users know how to use that.

Mostly it is because people don’t like change.

We use encrypted email all the time.  But it is a bit of a hassle. We use different encrypted email products with different clients.    You have to look at multiple email apps to make sure that you haven’t missed any emails.

So people, always looking for the easiest, least hassle solution, resort to faxes.

In the case of faxing medical records to the wrong person, even accidentally, it is likely a violation of privacy laws.

In this case, the computer shop owner notified the sender multiple times (remember the sender suggested that the shop owner change his phone number) and the sender refused to do anything.

Well now the computer shop owner has notified the  Saskatchewan information and privacy commissioner.   I don’t know what the penalties are going to be, but perhaps, now, given a combination of bad PR and fines, the hospital will come up with a better solution.  That are not very hard to find.

Are you still using fax machines to send sensitive information?

Information for this post came from CBC.

Facebooktwitterredditlinkedinmailby feather

Patching IoT Gets Out of Hand

In what may be the first of its kind event, the FDA recalled a pacemaker from St Jude, now owned by Abbott Labs.

Researchers discovered the flaws prior to Abbott’s acquisition of St. Jude and reported them to both the FDA and St. Jude.  Both decided to do nothing about it until the researchers went public.

In April of this year, the FDA put out a “warning” – also likely a first of it’s kind – that the devices which can be controlled remotely, were likely hackable and also had a battery problem that could cause it to go dead – possibly along with the patient  – before it was supposed to.  At that time Abbott said that they took security seriously and had fixed all the problems (see Fox Business).

Fast forward to this week and the FDA has now issued a recall of close to a half million of the supposedly fixed devices.

Since the devices are implanted inside people, the plan is NOT to perform a half million surgeries to remove them, but rather to go to their doctor to have the firmware in the device updated.

As I recall, one of the problems WAS this update capability.  The researchers were able, I think, to buy pacemaker programmers on eBay and reprogram any pacemaker from that manufacturer without authentication.    All they had to do is be in radio range of it.

Obviously, being able to reprogram the pacemaker (which has to be done in a facility that can control a patient’s heart rhythm while the pacemaker is being hacked.  Err, patched.  Err, upgraded) is a LOT safer than a half million surgeries, but still it is not without risk.

No clue what the cost of this little adventure will be, but it won’t be cheap.  Even if each doctor visit costs a hundred bucks – which is highly unlikely – that would still be a cost of $50 million.  If the cost is $500, then the total would likely be in the $250 to $500 million range when you add legal fees, fines and support costs.

One other interesting feature.  The researchers approached St. Jude about paying them a bug bounty, which is common in the tech world, and they decided not to.  Instead, the researchers approached Muddy Waters Capital, who sold the stock short, then announced the vulnerabilities.  When the stock price went down, which it did, Muddy Waters covered their short sell and made out very nicely.  Muddy Waters and the researchers had a deal to do some sort of split of the profits.  There were some people who that was a bit too capitalistic, but, it is not illegal.  Maybe next time, they will work with the researchers when they approach them.

Information for this post came from The Guardian.

Facebooktwitterredditlinkedinmailby feather

Homeland Security Issues Security Alert for Siemens Imaging Systems

We usually think of Internet of Things (IoT) devices as smart light bulbs or door locks or cameras, but there are some IoT devices that are a little bigger and a lot more expensive.

In this case, it is a multi-million dollar Cat Scanner that hospitals and imaging centers use to create diagnostic images.

Siemens says that even an attacker with a low skill level would be able to exploit the vulnerabilities.  That’s not very comforting.

The root of the problem is that there is a Windows 7 PC running the scanner and it is difficult to get approval to install patches – assuming they are even available – because it is considered a medical device.

To make matters worse – if that is possible – Siemens said that the flaw is executable remotely (from the Internet) and sample ways to exploit the bug are available on the Internet.

DHS suggests that hospitals unplug their cat scanners from the network so attackers cannot reach the scanners to attack them.

Of course, that probably is not possible, practically, to do.

Siemens says that they are working on a patch.  That’s comforting.  It is not clear how long it will take Siemens to develop a patch (Or get Microsoft to do so), how long it will take to get the patch approved or how long it will take to get hospitals to install the patch.

Since the vulnerability allows hackers to remotely execute arbitrary code, they could potentially steal any data on the scanners or use the scanners as a launching point for attacks elsewhere in the hospital.

We always tell clients that ALL IoT devices need to be isolated from any trusted internal networks and likely from other IoT devices as well.

Whether the IoT device is a $5 smart light bulb or a multi-million dollar cat scanner, that advice is still true.  To do so may require hospitals to redesign their business practices as well as to make changes to their information systems, so that won’t happen overnight either.

This represents a bit of a mess for hospitals and clinics that have cat scanners and there does not seem to be an easy fix.

The point here is that IoT devices are everywhere and often in places that you do not think about.  Some are small and relatively cheap; other are pretty large and very expensive, but they all share one commonality – they can be exploited.

It is likely to get much worse before it gets any better.

Information for this post came from Health Data Management and the DHS Security Alert.

Facebooktwitterredditlinkedinmailby feather

Hacking Pacemakers For Fun

When Dick Cheney was Veep, stories kept popping up that the Secret Service had made sure that his pacemaker was not remotely controllable.  Some people weren’t sure that it was a problem – not because they didn’t like Cheney, but because they didn’t think they were hackable.

Well now we have a different story.

Researchers bought used pacemaker programmers on eBay, some costing as little as $15.  Apparently, if you have a programmer for manufacturer X’s pacemaker, you can program any pacemaker from that manufacturer.  Apparently, there is no authentication.

The manufacturers have said that they control the distribution of the pacemakers, but if you can buy them on eBay for $15, that obviously is not working.

Whitescope researchers analyzed 4 programmers from 4 manufacturers and discovered more than 8,000 vulnerabilities.  Now doesn’t that make you feel good.

In two cases the used pacemakers came patient data that had not been wiped.  The data was not encrypted.

As medical devices become more sophisticated, they become more dangerous too.  If someone knows that you have a pacemaker from vendor X and can figure out how to hack it, that person could kill you – literally.

This is, in some sense, similar to the drug infusion pump scandal from a few years ago.  The FDA attempted to sweep the issue under the rug for a year or more until the researcher went public with the hack.  Then, all of a sudden, the FDA decided it was a problem.

Some people might say that if researchers just didn’t discover these bugs then all would be well.  Not really.  The bad guys will discover the bugs also, but they won’t be so kind and disclose them.

Obviously these manufacturers need to rethink their security programs.  Security by obscurity (such as by trying to control the distribution of pacemaker programmers) just isn’t going to work in the long run.

As the author of the article said, it is a bit disconcerting that your iPhone is more secure than your pacemaker.

Information for this post came from Ars Technica.

Facebooktwitterredditlinkedinmailby feather

More Healthcare Breaches, Record Fines and Other Issues

Another day, another healthcare ransomware attack.  Erie County Medical Center and Terrace View long term care in Buffalo, New York have been dealing with a ransomware attack for about 10 days now.  On April 9th, a Sunday, the computers got hit by what they are only calling a virus, but according to someone I talked to today, it is, in fact, a ransomware attack.  They have not paid the ransom and do not intend to, but from April 9th to the 15th, all systems were down.  They hoped to have the patient data part of their systems operational by the 15th at which point they would need to start entering the backlog of patient data and any data that was lost.

According to local media, the email system is also supposed to be up by that time.

After that is complete, they planned on working to restore systems such as payroll.

According to the person I talked to this morning, as of today, they are still working on recovering.

I am sure that they will complete a lessons learned exercise once people get some sleep, but from the outside, a couple of questions are obvious.  Their disaster recovery plan seems to be lacking if they are still recovering 10 days later.  We don’t know if their business continuity plan is sufficient.  They didn’t have to close the hospital, which is good, but what is the impact on patient care and staff workload.  Finally, how did this ransomware spread so widely in the organization that it is taking them more that 10 days to recover.

As a side note, the Beazley cyber insurance company says that ransomware attacks that were reported to them quadrupled in 2016 and they expect that to double again in 2017.  Half of the attacks were in healthcare.

The FDA is now shifting its focus to medical devices, like the ones from St. Judes, that the FDA slammed the firm over last month.

 

As if that wasn’t enough to worry about, Health and Human Services Office of Civil Rights levied more fines in 2016 than any other year to organizations that were breached.  They announced 12 settlements averaging $2 million in 2016 and three more in the first two months of 2017 PLUS a fourth case that had a fine of $3.2 million.

Some of these cases required the appointment of an external monitor or baby sitter, indicating that OCR didn’t trust those organizations to fix the problems without oversight.

These handful of cases, while significant, represent a fractional percentage of the roughly 17,000 cases a year that are filed with OCR.

In addition, OCR is finishing up a series of desk audits of covered entities and is about to start on auditing business associates.

While it is unclear what will happen under the Trump administration, OCR is funded mainly by the fines they levy, so it may well be the case that things run as they have for the last few years.  Stay tuned.

Putting all of this together should be a red flag to anyone in healthcare that they need to get very serious about cyber security.  It is not likely to get any better or easier any time soon.

 

Information for this post came from Disruptive Views and hrdailyadvisor.

Facebooktwitterredditlinkedinmailby feather