Blue Lance InfoSec Blog

Charges Brought Against Would-be Information Thieves at Jackson Memorial Hospital

Ruben Rodriguez of South Florida allegedly conspired to steal personally identifiable information of patients of Jackson Memorial Hospital (JMH) and sell that information to at least one practicing lawyer in South Florida.  Rodriguez appeared in federal court July 30^th, and was released on $200,000 bond.

The six count indictment states that Rodriguez solicited Rebecca Garcia, and ultrasound technician for the hospital, to access, obtain, and transfer the information for him in exchange for monthly payments of an undisclosed amount.  Rodriguez would then pass the information on to the lawyer, whose name was not mentioned in the press release, to be used to illegally solicit JMH patients, hoping to represent them in legal proceedings.  The lawyer would pay Rodriguez to provide this information in amounts dictated in part by lawsuits and settlements won from clients found through the patient records.

Rodriguez faces up to 5 years in prison for conspiracy and fraud in connection to computers, 10 years for wrongful disclosure of individually identifiable health information, and a mandatory 2 year consecutive imprisonment for aggravated identity theft offenses.  Garcia, who has already plead guilty, faces a maximum of 10 years imprisonment.

Update: Carrell Clinic Ex-Security Guard Indicted

Jesse William McGraw was indicted by a Dallas federal grand jury yesterday on 2 counts of transmitting malicious code.  These felony charges were pressed back in June, when McGraw allegedly transferred malicious code into the hospital’s computer network, including an HVAC server that controlled heating and cooling for the entire hospital.  McGraw, also known by his hacker alias “GhostExodus”, has been held in custody since his arrest late last month on related charges.

McGraw’s actions compromised the hospital’s system in such a way as patient records, diagnoses, medical treatment, and care could have been compromised for any individuals being treated by the Carrell Clinic.  His actions on the clinic’s HVAC server could have compromised the integrity of temperature-sensitive medicines in the onsite pharmacy as well.

Plans had been made by McGraw to quit his job as the night security guard at the clinic the day before an intended Distributed Denial of Service, or DDoS, attack caused by the malicious code he uploaded onto the network.  He planned to call the day of the attack, July 4^th, “Devil’s Day”.  McGraw had been an employee of Dallas security company United Protections Services, and worked the 11:00 p.m. to 7:00 a.m. shift at the clinic.

Should McGraw be found guilty, for each count of transmitting malicious code he faces a maximum penalty of 10 years in prison, a $250,000 fine and restitution.

NIST SP 800-53 Solution Brief Now Available

Blue Lance released its LT Auditor+ Solution Brief today for IT controls outlined within SP 800-53 - Recommended Security Controls for Federal Information Systems produced by the National Institute of standards and Technology (NIST).  The document illustrates how LT Auditor+ maps to the NIST IT controls as documented in the framework.  The document is one of several solution briefs being developed on IT security regulations and frameworks including GLBA, FISMA, and Sarbanes-Oxley.

LT Auditor+ is an important step on the path to IT security and compliance.  The tools provide detailed audit trails for Novell NetWare and eDirectory as well as Microsoft Windows file systems, Active Directory and Group Policy.  It allows security and compliance teams to monitor, report and alert on access and changes to sensitive files and configuration settings.

The SP 800-53 Solution Brief is available now through the LT Auditor+ User Center.

Kaiser Hospital Hit with $250,000 Fine After Breach

The LA Times is reporting that Kaiser Permanente's Bellflower hospital has been fined $250,000 by the California Department of Public Health over a breach that occurred in January of this year.

The California Department of Public Health charged that the hospital "failed to prevent unlawful or unauthorized access to, or use or disclosure of a patient's medical information".  It is the first monetary penalty from an amendment to the California Health and Safety Code enacted January 1.

In all, the investigation found that 21 employees and 2 physicians viewed Nadya Suleman's medical record without need or authorization.  Many of the accesses had apparently taken place after the initial breach notification to the state.

I think California is sending a clear message here about their commitment to enforcement here.  I will also be interested to see if HHS will follow California's lead with its own penalties for HIPAA violations.

LA Times Article

California Penalty Notice

HHS Issues HITECH Act Notification Guidance

The Department of Health and Human Services on Friday issued guidance for breach notifications as required by Subtitle D of the Health Information Technology for Economic and Clinical Health (HITECH) Act.

The guidance specifies the technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals.  According to the announcement,

This guidance relates to two forthcoming breach notification regulations – one to be issued by HHS for covered entities and their business associates under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Sec. 13402 of HITECH) and one to be issued by the Federal Trade Commission (FTC) for vendors of personal health records and other non-HIPAA covered entities (Sec. 13407 of HITECH).  HITECH requires these regulations to be published within 180 days of enactment.  If the entities subject to the regulations apply the technologies and methodologies specified in the guidance to secure information, they will not be required to provide the notifications required by the regulations in the event the information is breached.

The HHS also issued a request for information (RFI), asking for public comment of the breach notification provisions.  Once published, comments may be submitted through www.regulations.gov.

Kaiser hospital fires 15 for snooping through medical records

A Kaiser Permanente hospital in Bellflower, CA has recently fired 15 employees and reprimanded 8 others for accessing the medical records of Nadya Suleman.  Suleman is the California woman who gave birth to octuplets back in January of this year.  The access of information by the employees in question was unnecessary and evidently done out of personal curiosity, and violated California laws designed to protect the privacy of health care data.

This breach and others like it are attributed by professionals in the industry to have been caused by “primitive” security controls that haven’t been updated in decades.  Large hospitals do not rely on role-based access controls, allowing large numbers of employees to have access to thousands of patients’ personal data.  Most of these employees have no need to access much of the data available to them.  The lack of role-based access prevents the application of least privilege assignment, or separation of duties (SoD).

The data breach was discovered by a monitoring tool employed around the time Suleman entered the hospital’s care in order to protect her privacy.  At the time of this publication, Suleman has no plans to sue Kaiser.

For more information about LT Auditor’s solutions for auditing access to your important data, visit www.bluelance.com.

HIPAA Solution Brief Now Available

Blue Lance released its LT Auditor+ Solution Brief today for HIPAA Compliance.  The document illustrates how LT Auditor+ maps to HIPPA’s compliance requirements.  The document is one of several solution briefs being released including PCI-DSS and Sarbanes-Oxley.

Summary
LT Auditor+ is an important step on the path to compliance with HIPAA.  The tools provide detailed audit trails for Novell NetWare and eDirectory as well as Microsoft Windows file systems, Active Directory and Group Policy.  It allows security and compliance teams to monitor, report and alert on access and changes to sensitive files and configuration settings.

The HIPAA Solution Brief is available now through the LT Auditor+ User Center.

Stimulus Bill Includes Big Changes to HIPAA Requirements

The recent passage of the American Recovery and Reinvestment Act also added several important additions to HIPAA.  The Health Information Technology for Economic and Clinical Health (HITECH) Act significantly strengthens HIPAA by adding the following:

• Business associates are now required to comply, just as Covered Entities have in the past.

• Breach notification requirements have been added.

• The fines and penalties have been increased.

• Civil penalties have been increased.

• State attorneys now have enforcement capabilities.

These new changes also indicate that enforcement will be significantly stepped up in the near future, at both the state and federal levels.  The full text of the American Recovery and Reinvestment Act may be downloaded here.

Blue Lance Solutions
Blue Lance has LT Auditor+ Solution Brief for HIPAA Compliance for immediate download.  The document illustrates how LT Auditor+ maps to HIPAA’s requirements.

LT Auditor+ is an important step on the path to compliance with HIPAA.  The tools provide detailed audit trails for Novell NetWare and eDirectory as well as Microsoft Windows file systems, Active Directory and Group Policy.  It allows security and compliance teams to monitor, report and alert on access and changes to sensitive files and configuration settings.

The HIPAA Solution Brief is available now through the LT Auditor+ User Center.