Healthcare entities are especially being targeted by Ransomware and HHS OCR has issued new guidelinPreview Changeses on how to avoid the effects of Ransomware, and what it means to compliance if your data does become held hostage.
A recent U.S. Government interagency report indicates that, on average, there have been 4,000 daily Ransomware attacks since early 2016 (a 300% increase over the 1,000 daily Ransomware attacks reported in 2015).
Ransomware exploits human and technical weaknesses to gain access to an organization’s technical infrastructure in order to deny the organization access to its own data by encrypting that data. Being unprepared for Ransomware means having to face demands for payment from criminals, loss of control of your information, and requirements to report such incidents as breaches.
Even if you pay off the ransom, you may not get control of your data back, and you may never know if the data remains compromised or not. Victims of Ransomware face the expense of recovery, the hassle of compliance issues like breach reports, and the loss of good will with patients who may never trust your organization again.
Description of the topic
Healthcare entities have recently become the prime targets for hackers using Ransomware techniques to encrypt an organization’s files and hold them for ransom. In order to avoid being victimized by Ransomware, organizations need to use an information security management process to identify and mitigate the specific risks of Ransomware. That process includes preventing infections through good systems and network management and training of all staff who use computers, and recovering from infections through the use of good backup and data management processes.
There are measures known to be effective to prevent the introduction of Ransomware and to recover from a Ransomware attack. This session describes Ransomware attack prevention and recovery from a healthcare sector perspective, including the role the Health Insurance Portability and Accountability Act (HIPAA) has in assisting HIPAA covered entities and business associates to prevent and recover from Ransomware attacks, and how HIPAA breach notification processes should be managed in response to a Ransomware attack.
Following good practices according to HIPAA helps both prevent and recover from Ransomware incidents. Organizations that do follow good practices are able to shrug off Ransomware attaches and know exactly what has happened and whether or not reporting a breach to HHS is warranted.
Prevention of a Ransomware incident is the essential first step, that takes place largely through training of staff to not open any documents or click on any links unless they are absolutely sure of the source and content. The way Ransomware works, an individual is usually tricked into visiting an infected Web site or opening a Word document with a malicious attachment, and the only way to avoid the initial contact is to train, retrain, and train again workers to be vigilant and pick up the phone and make a call if they are not convinced of the source and content of the link or attachment.
If the contact is made and the attack is launched, having a securely segmented network with tight firewalls between the segments can prevent cross infection and attack of resources, and limit the damage caused by the attack. Using network-monitoring tools can help spot trouble based on anomalous network behavior that the attack causes, and give you the chance to lock down the infection so it can be eradicated and the damage can be evaluated.
Once evaluated, you may or may not have a breach to report. If your data is still available and access has been virtually uninterrupted, you satisfy that requirement, but unless your analysis can show that there has been no exfiltration of data and no infection remains, you may have to report the incident as a breach under HIPAA.
Handling a malware incident like Ransomware can severely test your preparedness, cost large sums of money, and result in reportable breaches that will be investigated by the HHS Office of Civil Rights. Being ready to face the threat and respond appropriately to Ransomware can mean the difference between an annoyance and a disaster. This session will help entities understand how to be ready to face the threat and avoid disaster.
Areas Covered in the Session
- What is Ransomware?
- Preventing Ransomware attacks
- The value of User Training
- Making your Networks more resistant to attacks
- Understanding the Impact of a Ransomware attack
- Responding to the attack
- Recovering from a Ransomware attack
- Evaluating Ransomware attacks as reportable Breaches
At the conclusion of the session, participants will be able to:
- Understand the issues surrounding Ransomware and HIPAA.
- Know what can be done to prevent issues with Ransomware.
- Manage Ransomware incidents properly to protect data and operations.
- Know when a Ransomware incident may qualify as a reportable breach under HIPAA.
Attendees should include Compliance Officers, Privacy and Security Officers, and leadership and staff in health information management, information security, and patient relations, as well as staff in patient intake and front-line patient relations and any others that are involved in, interested in, or responsible for, patient communications, information management, and privacy and security of Protected Health Information under HIPAA, including:
- Compliance director
- Privacy Officer
- Security Officer
- Information Systems Manager
- HIPAA Officer
- Chief Information Officer
- Health Information Manager
- Healthcare Counsel/lawyer
- Office Manager
- Contracts Manager
MEET THE PRESENTER
Jim Sheldon-Dean is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm founded in 1982, providing information privacy and security regulatory compliance services to a wide variety of health care entities. He is a frequent speaker regarding HIPAA, including speaking engagements at numerous regional and national healthcare association conferences and conventions and the annual NIST/OCR HIPAA Security Conference. Sheldon-Dean has more than 16 years of experience specializing in HIPAA compliance, more than 34 years of experience in policy analysis and implementation, business process analysis, information systems and software development, and eight years of experience doing hands-on medical work as a Vermont certified volunteer emergency medical technician. Sheldon-Dean received his B.S. degree, summa cum laude, from the University of Vermont and his master’s degree from the Massachusetts Institute of Technology.