Cyber Security

You’ve been hit with Ransomware  –  Now what? And is it a reportable breach?

Well, that depends.  Given the dramatic rise in ransomware attacks recently, many regulators have issued formal guidance that it’s presumed a reportable breach.  That is, unless you can prove otherwise – prove being the operative word here. If you haven’t taken a look at our blog post, below, on the “Alarming Increase of Ransomware” and what you can do to avoid it, please take a moment to review our important recommendations.

To determine if a ransomware attack is a reportable breach under privacy and security laws such as HIPAA/HITECH Privacy and Security Rules and other consumer protection laws, we have to start with how a breach is defined.  Under HIPAA laws, a breach is defined: as the unauthorized or impermissible “acquisition, use or disclosure” of protected health information (“PHI”), which compromises the privacy or security of the protected information.  Many other privacy and security laws governing protected information have similar definitions that boil down to whether or not personal, health or other confidential information (“PII”, “PHI”, ePHI or “CI”) was compromised or compromise would be likely.

There are now at least 200 different “families” (variants) of ransomware, some more sophisticated than others. The most commonly used ransomware “wraps” encryption over data locking users out of infected devises or networks (through a locking devise the attacker controls).  An attack doesn’t necessarily mean that confidential data has been accessed, used or viewed, but an analysis is required by many federal and state privacy and security laws and you don’t want to get it wrong.  And there’s newer ransomware out there that’s doing more than just encrypting, it’s pulling information such as the amount of records encrypted or other information so they can charge a higher ransom.

THIS IS NOT A SCREEN YOU WANT TO SEE!

 If you visit the websites of many federal and state regulators, including HHS, OCR and the FBI, you’ll see just how serious and prevalent this problem is. Attackers especially like targeting hospitals, government agencies and others with critical or sensitive information, and many are using newer versions of ransomware, hybrid ransomware, which infects a system, but stays quiet behind the scenes loading other malware that allows data to be viewed or accessed by other third parties.  Cyber thieves are known to advertise on the Dark Web auctioning off information and access to the highest bidder (in the same way pools of stolen credit card information are illegally auctioned off to the highest bidder).  By providing access to confidential data to other unauthorized users,  the definition of breach is met.  In guidance released late last year, HHS announced that “the presence of any ransomware (or any malware for that matter) on a covered entity’s or business associate’s computer is a Security Incident under the HIPAA rules, and therefore, requires prompt investigation, remediation and possible notification.  Once the ransomware is detected, the affected entity must promptly initiate the required security analysis and reporting procedures. See 45 C.F.R. 164.308(a) (6). Whether or not the presence of ransom ware would be a reportable breach under HIPAA or other security laws is a fact specific question.  Know what’s required!

Which begs the question – how does an organization prove protected confidential data wasn’t improperly used or compromised?  (Or whether it was and must be reported!) It may not be fast or easy, but it’s in organization’s interests to quickly take steps to determine (and document) its findings.  In its recent Guidance, HHS has taken the position that unless the affected entity can demonstrate that there is “… low probability that PHI has been compromised”, based on the HIPAA Breach Notification Rule factors, a breach is presumed.   If other types of regulated personal data are potentially at risk and it can be established (and documented in a justifiable, reasonable way) that ransomware only wrapped or encrypted data and the data was never viewed, used, accessed or moved off servers or devises, it may not be a reportable breach, but you have to get it right. (The exact type and variant of malware and exfiltration attempts and other information is critical to verify.)

The affected entity should immediately put its Incident Response Plan into action.  (Let’s hope there is an Incident Response Plan, as this isn’t the ideal time to try to figure it out.  And I’d like to point out that everyone regulated under HIPAA and many other similar laws is required by law to have an incident response plan and have other security steps in place such as training all workforce members annually.  Big fines will be coming to those who don’t take this seriously and don’t have legally compliant plans in place.)   Besides the many smart business reasons to establish an incident response plan, many federal and state laws require it.

Ransomware attacks in the healthcare sector in particular and other organizations holding confidential data are becoming much more common and sophisticated.  The consequences of a ransomware attack on the delivery of healthcare and other critical systems is staggering – computer networks and devises are immediately locked down, preventing access to data and systems with potentially catastrophic results.  It’s critical to respond quickly when a suspected or known security incident occurs.  And if it’s a ransomware attack, the consequences will be immediate!

Training employees on what to look out for is critical – and required!

Defending against security risks must be a top priority for every organization.  HIPAA and other similar laws require ALL workforce personnel with access to systems and data to be trained at least once annually.  This is the first thing regulators will look at and the best way to avoid attacks.  If training is deficient, or all workforce members aren’t being trained annually, then big fines and other sanctions will be imposed.  Proper training is the single, most important part of protecting your organization from ransomware and similar cyber threats – make sure every person with access to a computer system or devise is trained on what to look out for!  Most security incidents are avoidable and result from the “human factor”: someone opening something, clicking without thinking and now it’s too late – systems and data are compromised or worse. Preventing attacks is a far better way to go and far less costly proposition than reacting after an attack occurs.  I’d also like to point out that if you elect to pay the ransom, there’s no guarantee the data will be there or won’t be compromised.  The FBI and many other regulators recommend not paying ransom to hackers as a disincentive to the huge number of attacks occurring and provide the same caution we do that the data may not be there even after you pay up.   There’s no guarantee.  Following the advice we’ve outlined for avoiding the problem in the first place and having a back-up plan ready, just in case (See our July, 2016 Client Alert) is a far safer, better way to go.  ______________________________________________________________________________

In addition to acting as general counsel and compliance officer to diverse business organizations, we’re frequently called on to advise clients regulated under HIPAA/HITECH laws on the best ways to assess risks and ensure compliance; and if the worst should happen, how to respond.  We welcome your inquiries on our general business and corporate legal services; and would be glad to speak with you specifically about how we can help your organization with avoiding these costly, disruptive problems.

Tegan Blackburn LLC       www.teganblackburn.com             All Rights Reserved.

Ransomware Increasing in Alarming Numbers

The growing sophistication and volume of cyber security threats is a serious, ever-present risk.  Here’s the latest one – ransomware.  Today’s blog will help you understand what this latest threat is, how to avoid it and if the worst thing happens, how to respond to it.

Just how serious is it? If you visit the websites of any federal regulators or enforcement agencies such as the FBI, HHS, OCR or the Secret Service, you’ll see what a big threat this has become – some estimating a 3,500% increase of ransomware just this year.  Readily available, free open source code makes for easy exploits by cyber thieves. With the return on investment for cyber criminals very high, everyone from mom and dad to the local grocer, as well as big business is at risk.

There are a lot of different types of ransomware out there, but all of them have the same purpose. And it’s pretty much what it sounds like – they kidnap your data, leaving you at the mercy of criminals, who’ve taken over and locked down your computer (using an encrypted locking device) until you pay up.  This is just the latest in highly profitable criminal enterprises out there lurking on the internet, hitting businesses and individuals alike with software capable of locking down a computer or entire computer network with just one wrong key stroke.

The typical way ransomware takes over is by:

• Drive-by downloads – all it takes is a visit to malicious website, clicking a pop-up ad or opening an infected email attachment. This often called the “human factor” – people clicking before thinking, not taking a moment to consider if what they’re about to open is legit.  Click, and it’s too late, they’ve taken over and locked you out until you pay up.

• Exploiting program vulnerabilities – if you don’t run and update anti-virus and malware detection (settings to automatic updates is best); you’ve left the door wide open to cyber criminals gaining easy entry to your computer system.   The hackers and crackers, or whatever you want to call them, aren’t targeting you, they have malware spiders and bots running behind the scenes 24/7 looking for any open doorway.

 To up the ante, criminals often use scare tactics displaying logos and images of known law enforcement agencies threatening punishment or imprisonment if payment isn’t made.  All of this works at lightning speed and without warning.  As soon as the pop-up ad, email attachment or link containing ransomware is opened, everything is immediately encrypted preventing access to the computer or network.  The attacker then demands payment (usually requiring purchase and delivery of unregulated bit coins) before giving you the decryption key that, presumably, allows access to the computer.

What can you do to avoid this?                                          

1. Always back up your data: Frequent (sometimes redundant) backups of data is the best policy – if the worst happens, your data can be promptly restored.
2. Think before clicking: Don’t click pop-up ads, open attachments or unrequested links unless you know and trust the source.  A lot of these infected emails and links contain red-flags and everyone should be trained on what to look out for.
3. Secure your PC: Make sure you run and update adequate anti-virus and malware detection software on all systems. Check all system settings so they automatically update and apply appropriate patches.
4. Don’t Pay: If you think you’ve been the victim of ransomware attack, don’t panic and rush to pay. There’s no guaranty after making payment that your computer’s functionality and files will be restored. In some instances, more recent less “robust” versions of this malware delete all your data so even after you pay up, there’s no guarantee your data will be here. In some instances the Secret Service, FBI or other law enforcement officials should also be contacted.  These agencies typically recommend not paying up as a disincentive to the bad guys, who are often here and gone, beyond the reach of U.S. officials.  (Our next blog will discuss the intricacies posed by a number of federal and state privacy, security and breach notification laws such as HIPAA, which may require notifications and additional steps to be taken.)

If you’ve done what we recommend, frequently backing up files and programs, then using your own resources to quickly restore functionality is a far better way to go than negotiating with criminals and hoping for the best.  Of course, avoiding the problem all together is the goal and we’d be glad to assist.

_____________________________________________________________________

Our firm frequently advises clients and provides training on how to avoid these all too present security threats, and if the worst should happen, how to respond.  We welcome your inquiries on our business and corporate legal services; and would be glad to speak with you specifically about our extensive background and expertise helping clients develop and implement the best practices, policies and procedures to avoid these unnecessary, costly problems.

Tegan Blackburn LLC                      www.teganblackburn.com            All Rights Reserved.

If HHS or another regulator knocked on your door today – would you “pass” the audit?

On April 29, 2015, HHS (Dept. of Health and Human Services), OIG (Office of the Inspector General), HCS (Healthcare Compliance Association) and AHLA (American Health Lawyers Association) along with other industry leaders released a first of its kind joint collaboration education resource entitled “Practical Guidance for Healthcare Boards on Compliance Oversight” providing helpful tools for identifying risks, preparing for audits and responding to incidents. The document provides diverse tools and insights to governing boards, compliance officials and those reporting to them. Recognizing there is no uniform approach to compliance – no “one size fits all” approach, this multi-faceted guidance document will be a valuable resource for organizations both large and small to evaluate the scope and adequacy of their compliance programs.

In addition to asking the right questions of the right people to evaluate the risks posed to an organization, having an incident response plan before it’s needed is one of the best ways to ensure an organization can effectively respond to and recover from a security incident. Working with qualified legal and other professionals with strong compliance experience is one of the best ways to avoid problems.

This guidance emphasizes the importance of organization-wide accountability and offers decision makers a variety of tools to evaluate the effectiveness of policies and procedures within their organizations. The guidance – I believe correctly – concludes that asking the right questions is critical to staying ahead of problems.

The DOJ (Dept. of Justice) has also just released its guidance document entitled “Best Practices for Victim Response and Reporting of Cyber Incidents” providing practical advice for fending off and responding to cyber attacks. Offering guidance on what businesses should do before, during or after a cyber attack, DOJ outlines what’s expected in the event of a security incident, including the preservation of evidence and cooperation with their investigations.

As more and more healthcare and other entities are affected by illegal intrusions, these guidance documents offer practical advice for protecting against the ever present risk of cyber attack. An organization’s risk analysis (or lack of one) is a primary area of focus for regulators – knowing insufficient analysis to be the single, biggest culprit behind many known breaches. The absolute worst time to develop a breach response plan is after an attack – having the right people, processes and resources in place before it’s needed puts every organization in the best position to respond and successfully recover from a security breach.

With more than a decade of experience helping companies prepare for and respond to regulatory audits and security incidents, we welcome your inquires on how we can help.