Gazelle Consulting

HIPAA Compliance in a Post-Wannacry World

On Friday, May 12th, 2017 one of the largest cyberattacks in recent history was launched by a still unknown hacker group.

The virus, named Wannacry, uses ransomware to encrypt user data which holds their whole computer hostage and demands a payment before the data is unencrypted. As of the time of this blog’s publication, Wannacry has affected 430,000 computers in 150 countries.

Millions of people have been affected by secondary ripple effects, mostly notably when Britain’s entire National Health Service was forced to suspend all non-emergency health care services because their national IT network had been affected by the virus. As for now, it appears that the tide has been stemmed and few new incidents are being reported.

Background: The Wannacry Cyberattack

The basis for the existence of Wannacry is a Window’s vulnerability named EternalBlue. It was originally discovered by the NSA, but they held back knowledge of it from Microsoft in hopes of developing the vulnerability as an offensive weapon. Microsoft learned about it at the same time as the general public, when a hacker group called ShadowBrokers released it as part of an NSA dump on the dark-web.

Microsoft hurried to repair the vulnerability with a patch, but many users failed to run Windows Update by the time the virus was released. The virus only affected systems that did not have the critical patch, which includes all Microsoft operating systems that are no longer supported (Windows XP and Vista) and machines that had not run windows updates.

What We Can Learn from the Wannycry Cyberattack

This attack was not an isolated incident. According to the anti-virus megacorp Symantec, ransomware attacks jumped by more than 33% in 2016 to over 483,800 incidents total incidents. Fortunately, protecting yourself from a ransomware attack is not difficult.

We’ve compiled a list of the three most important steps to ensure your data stays secure given the current threat of further ransomware attacks.

1) Backup Your Data ASAP

A ransomware attack could come unexpectedly, best practices are to be proactive and to backup all of your data frequently. At the bare minimum, data should be backed up once annually.

World Backup Day, March 31st, is a good time to do so. One easy and quick way to achieve this is through the use of cloud storage services. This is a particularly robust option due to the fact that your data will be backed up in an alternate and often decentralized location. Also, you can set many cloud storage services to backup your data automatically (check out our article on choosing HIPAA compliant software before doing so!)

It’s also strongly recommended to periodically backup your data on physical devices such as external hard drives in case of cloud service disruption. Just remember, both cloud and physical storage of PHI come with their own risks so you should have policies and procedures in place to to address those risks and mitigate them.

2) Migrate Older Operating Systems and Patch Current Operating Systems

The WannaCry virus preyed on one of the most low level vulnerabilities, out of date operating systems. It is imperative that the OS on your computers containing sensitive data are up to date.

Here are 3 ways to achieve this:

  • If your organization has an IT department:
    • Ensure that your IT department has the staffing, financial, or technological resources that it needs to roll out critical patches when they are issued. Check-in with the IT team to understand what their patch policy is and whether there are any roadblocks that are preventing them from patching regularly.
    • The critical patch can be downloaded here and pushed out to your organization by your IT department.
  • If you manage your own IT:
    • Always ensure that your Windows operating system is updated as quickly as possible.
    • Instructions for manually updating your computer can be found on the Microsoft website.
    • You can also turn on Automatic Updates to receive the newest updates right away.
  • If you’re running Windows XP or Vista

3) Create a Ransomware Incident Response Plan

Sometimes, despite our best efforts, malware attacks occur. That is why it is vital to create an incident response plan and mitigate the potential for harm.

According to a recently released HHS guidance, a ransomware incident response plan should accomplish the following:

  • Detect and conduct an initial analysis of the ransomware.
  • Contain the impact and propagation of the ransomware.
  • Eradicate the instances of ransomware and mitigate or remediate vulnerabilities that permitted the ransomware attack and propagation.
  • Recover from the ransomware attack by restoring data lost during the attack and returning to “business as usual” operations.
  • Conduct post-incident activities, which could include a deeper analysis of the evidence to determine if the entity has any regulatory, contractual or other obligations as a result of the incident (such as providing notification of a breach of protected health information), and incorporating any lessons learned into the overall security management process of the entity to improve incident response effectiveness for future security incidents.

Don’t worry if the specifics of how to achieve the steps in the guidance seem vague. A qualified HIPAA professional can guide you through the creation of a robust incident response plan that satisfies the HHS requirement.

What to Expect In the Future

According to malware guru Lawrence Abrams: the Wannacry attack has enjoyed such an impressive level of success that copycats will invariably arise and the frequency of ransomware attacks will begin to increase at an even faster rate.

This is a cause for concern for everyone in the healthcare industry. But with the implementation of these three steps, you’ll be ahead of the game and ready to respond as effectively as possible.

Do you want guidance on securing your organization’s data? Gazelle Consulting is here to help!

We make HIPAA compliance feel like a walk through a breezy savanna. Give us a call at (503) 389-5666 or shoot us an email at info@gazelleconsulting.com.

Share on facebook
Facebook
Share on google
Google+
Share on twitter
Twitter
Share on linkedin
LinkedIn
Share on pinterest
Pinterest

Popular Posts

  • How to Handle the Loss or Destruction of Medical Records

    Whether it be an delete happy IT admin, a theft, or a glitch in your system, lost health records can have an impact on your patients...

  • 2018’s Most Interesting HIPAA Violation Cases

    2018’s Most Interesting HIPAA Violation Cases

    Since the 2003, the Enforcement Act, an addendum to HIPAA that gave the OCR the right to enforce HIPAA on behalf of the HHS, we’ve seen an ever increasing number of fines and breaches.

  • The Specter of HIPAA Enforcement

    Who Enforces HIPAA?

    HIPAA, which stands for the Health Insurance Portability and Accountability Act, is enforced by the Office for Civil Rights (OCR), which is an arm of the Department of Health and Human Services (HHS).

  • Stronger HIPAA enforcement

    HIPAA Consent Form – How to Obtain HIPAA Authorization

    Earlier this month, the Office for Civil Rights (OCR) announced a new plan to strengthen HIPAA enforcement in response to criticism from the Office of Inspector General (OIG). The OCR will be beefing up their compliance investigations and expanding their audit program in 2016.

  • What is the Purpose of HIPAA?

    What is the Purpose of HIPAA?

    HIPAA compliance can be confusing. Is it HIPAA or HIPPA? Do I need to be HIPAA compliant? Who enforces HIPAA? Gazelle Consulting is here to answer your questions and help you to achieve compliance quickly and painlessly!