Yet another large hacker attack has been revealed in the healthcare sector. But unlike three recent cyber-attacks, which targeted health insurers, this latest breach, which affected nearly a quarter-million individuals, involved a healthcare provider organization.
South Bend, Ind.-based Beacon Health System recently began notifying 220,000 patients that their protected health information was exposed as a result of phishing attacks on some employees that started in November 2013, leading to hackers accessing “email boxes” that contained patient data.
The Beacon Health incident is a reminder that healthcare organizations should step up staff training about phishing threats as well as consider adopting multi-factor authentication, shifting to encrypted email and avoiding the use of email to share PHI.
“Email – or at least any confidential email – going outside the organization’s local network should be encrypted. And increasingly, healthcare organizations are doing just that,” says security and privacy expert Kate Borten.
Unfortunately, in cases where phishing attacks fool employees into giving up their email logon credentials, encryption is moot, she says. “Although encryption is an essential protection when PHI is sent over public networks, and stored somewhere other than within IT control, it is only one of many, many security controls. There’s no silver bullet.”
At the University of Vermont Medical Center, which has seen an uptick in phishing scams in recent months, the organization has taken a number of steps to bolster security, including implementing two-factor authentication “for anything facing the Web, because that can pretty much render phishing attacks that are designed to steal credentials useless,” says CISO Heather Roszkowski.
The Latest Hacker Attack
On March 26, Beacon Health’s forensic team discovered the unauthorized access to the employees’ email accounts while investigating a cyber-attack. On May 1, the team determined that the affected email accounts contained PHI. The last unauthorized access to any employee email account was on Jan. 26, the health system says.
“While there is no evidence that any sensitive information was actually viewed or removed from the email boxes, Beacon confirmed that patient information was located within certain email boxes,” Beacon Health says in a statement posted on its website. “The majority of accessible information related only to patient name, doctor’s name, internal patient ID number, and patient status (either active or inactive). The accessible information, which was different for different individuals, included: Social Security number, date of birth, driver’s license number, diagnosis, date of service, and treatment and other medical record information.”
The provider organization says it has reported the incident to the U.S. Department of Health and Human Services, various state regulators, and the FBI.
Hospital Patients Affected
A Beacon Health spokeswoman tells Information Security Media Group that the majority of those affected by the breach were patients of Memorial Hospital of South Bend or Elkhart General Hospital, which combined have more than 1,000 beds. The two facilities merged in 2012 to form the health system. Individuals who became patients of Beacon Health after Jan. 26 were not affected by the breach, she says.
The breach investigation is being conducted by the organization’s own forensics team, the spokeswoman says.
Affected individuals are being offered one year of identity and credit monitoring.
The news about similar hacker attacks earlier this year that targeted health insurers Anthem Inc. and Premera Blue Cross prompted Beacon’s forensics investigation team to “closely review” the organization’s systems after discovering it was the target of a cyber-attack, the Beacon spokeswoman says.
In the wake of the incident, the organization has been bolstering its security, including making employees better aware of “the sophisticated tactics that are used by attackers,” she says. That includes instructing employees to change passwords and warning staff to be careful about the websites and email attachments they click on.
The Phishing Threat
Security experts say other healthcare entities are also vulnerable to phishing.
“The important takeaway is that criminals are using fake email messages – phishing – to trick recipients into clicking links taking them to fake websites where they are prompted to provide their computer account information,” says Keith Fricke, principle consultant at consulting firm tw-Security. “Consequently, the fake website captures those credentials for intended unauthorized use. Or they are tricked into opening attachments of these fake emails and the attachment infects their computer with a virus that steals their login credentials.”
As for having PHI in email, that’s something that, while common, is not recommended, Fricke notes. “Generally speaking, most employees of healthcare organizations do not have PHI in email. In fact, many healthcare organizations do not provide an email account to all of their clinical staff; usually managers and directors of clinical departments have email,” he says. “However, for those workers that have a company-issued email account, some may choose to send and receive PHI depending on business process and business need.”