On October 17, 2017 First Health of the Carolina’s shut down their systems to ensure that all devices were tested and cleared of the threat of a new strain of the Wannacry virus.
While the organization indicated that no patient information was compromised, the incident shows the persistence of these hackers and their viruses. An anti-virus patch was developed specifically for the new strain, so be sure that your organization has it implemented. Here is why keeping your security up to date is important.
Wannacry is ransomware. Ransomware is a type of malware (malicious software). Ransomware’s defining characteristic is that it attempts to deny access to a user’s data, usually by encrypting the data with a key known only to the hacker who deployed the malware, until a ransom is paid. After the user’s data is encrypted, the ransomware directs the user to pay the ransom to the hacker (usually in a cryptocurrency, such as Bitcoin) in order to receive a decryption key. However, hackers may deploy ransomware that also destroys data, or ransomware in conjunction with other malware.
HIPAA compliance requires all covered entities and business associates to have security measures that can help prevent the introduction of malware, including ransomware. Some of these required security measures include:
• implementing a security management process, which includes conducting a risk analysis to identify threats and vulnerabilities to electronic protected health information (ePHI) and implementing security measures to mitigate or remediate those identified risks;
• implementing procedures to guard against and detect malicious software;
• training users on malicious software protection so they can assist in detecting malicious software and know how to report such detections; and
• implementing access controls to limit access to ePHI to only those persons or software programs requiring access.
A recent U.S. Government interagency report indicates that, on average, there have been 4,000 daily ransomware attacks since early 2016 (a 300% increase over the 1,000 daily ransomware attacks reported in 2015). (United States Government Interagency Guidance Document, How to Protect Your Networks from Ransomware available today.)
Complying with the Health Insurance Portability and Accountability Act (HIPAA) assists HIPAA covered entities and business associates to prevent and recover from ransomware attacks.
Are your Security Procedures sufficient to prevent a HIPAA Breach?
