Blue Lance InfoSec Blog

Connecticut AG Sues Healthcare Provider in First Case of State Enforcement Under HITECH

Connecticut Attorney General Richard Blumenthal sued Health Net of Connecticut, Inc. for HIPAA violations stemming from the loss of a portable hard drive containing the health and financial information of approximately 446,000 Connecticut enrollees in May of 2009, and the failure to notify authorities and consumers for at least 6 months.

Additionally, the AG seeks a court order preventing Health Net from continued HIPAA violations by requiring that protected health information stored on portable drives be encrypted.

A subsequent investigation found that the data, which included health records, social security numbers and bank account numbers in over 27 million scanned pages, was not encrypted or otherwise protected from unauthorized access and was viewable on commonly available software.

The case is the first action taken by a state under the HITECH Act, which enables states to enforce HIPAA violations.

Source:  Connecticut Attorney General's Office

Supreme Court Case to Determine Future of Sarbanes-Oxley

On December 7, the U.S. Supreme Court will hear arguments in a case which challenges the constitutionality of the Public Company Accounting Oversight Board (PCAOB); the organization responsible for determining policy, and enforcement of the Sarbanes-Oxley Act.

The plaintiffs in the case (Free Enterprise Fund v.Public Company Oversight Board) assert that the PCAOB, while characterized as a private corporation, exercises broad governmental powers including policy creation and compliance enforcement; in effect, making it a government agency subject to Presidential oversight and control.

While the case is not likely to be the downfall of Sarbanes-Oxley, but some form of change seem to be on the horizon for the legislation.  An amendment currently in the House Financial Services Committee would permanently exempt small publicly traded companies from the attestation requirement of Section 404 of the Sarbanes-Oxley Act.

One Step Closer to Federal Data Breach Notification Requirements

Yesterday, the U.S. Senate Judiciary Commitee passed two bills which set guidelines for data breach notifications at the federal level.

S.139, known as the Data Breach Notification Act, establishes guidelines for data breach notifications for government agencies and business entities as well as enforcement actions.

S.1490 is known as the Personal Data Privacy and Security Act of 2009 and establishes standards for developing and implementing safeguards to protect the security of sensitive personal information.  It also imposes civil penalties for violations of such standards.

The next stop for both bills is a full Senate vote.

The Rising Risk of Insider Threat, Two Ways

Rick Caccia writes for Computerworld on how to address two types of insider threats:

“‘I read about fraud all the time -- hackers, online gangs, angry employees, etc. It seems like it's on the rise. Why is this so hard to detect and how can we prevent fraud in our organization?’
It is true that fraud is increasing, and it does seem that we read about incidents on an almost daily basis. This is a factor of the rise in the amount of sensitive information that is now online, an increased number of online applications that access this information, and the growing number of users who use online services for financial services. The result is more opportunity for fraud, with less effort, so it's no surprise criminals have moved their activities online and that insider-led fraud is on the rise.”

Read the full article here.

Two Violate HIPAA Disclosure Laws During Illegal Drug Scheme

The United States Attorney for the Northern District of Alabama announced on August 28th that Isaac Earl Smith, 38, and Annetra Poole-Moore, 37, have agreed to plead guilty to federal crimes involving healthcare fraud, disclosures prohibited by the Health Insurance Portability and Accountability Act (HIPAA), and aggravated identify theft.
 
Between September 2008 and April 2009, Smith, of Pleasant Grove, and Moore, of Midfield, engaged in a criminal conspiracy to commit health care fraud, according to separate plea agreements filed today in U.S. District Court. During that time, Moore was employed by UnitedHealthcare Inc. (“UHC”) as a claims representative associate.  There, Moore had access to the personal information, including the means of identification, of certain persons enrolled in flexible spending accounts administered by UHC.  Without authorization or approval from UHC, Smith and Moore gained access to the company’s electronic database and obtained names and dates of birth of certain persons who had flexible spending accounts and were also covered by a prescription drug plan sponsored by the Federal Employees Health Benefit Plan (“FEHBP”).
 
The defendants and others used this information to create counterfeit prescriptions.  These prescriptions were then presented to pharmacies for the purpose of illegally obtaining controlled substances, which were then illegally sold to third parties.  By using the stolen identities on the prescriptions, the defendants caused FEHBP’s prescription drug plan to pay for the controlled substances, costing the FEHBP almost $73,000.
 
Smith intends to plead guilty to one count of conspiracy to commit health care fraud, one count of criminally violating the HIPAA disclosure laws, and five counts of aggravated identity theft. 
 
Moore intends to plead guilty to one count of conspiracy to commit health care fraud, one count of criminally violating the HIPAA disclosure laws, and two counts of aggravated identity theft. 
 
Smith and Moore have also agreed to pay $72,746 in restitution to FEHBP and to criminally forfeit the same amount.
 
In addition to the forfeiture, the defendants each face maximum sentences of 10 years in prison and fines of up to $250,000.  The aggravated identity theft charges carry two-year minimum prison sentences.
 

Health Organizations Must Notify Patients of Security Breaches, Even if not Bound by HIPAA

Yesterday, the FTC ruled that web based businesses will be required to notify consumers in the case of a security breach involving electronic health information.  The ruling applies to businesses that offer third-party applications for personal health records and vendors of personal health records.

The new rule is part of the American Recovery and Reinvestment Act of 2009, and was put into place by Congress.  The businesses that will be affected by this rule offer services that are not already subject to HIPAA privacy and security requirements.  A study will be conducted by the Department of Health and Human Services on potential security, privacy, and breach notification requirements for entities not governed by HIPAA regulations, with a report forthcoming by February 2010.  Meanwhile, the FTC ruled that these businesses notify consumers of any breach of the security of their health information.  In addition, any service providers of these businesses that encounter a data breach must notify their client, who will then in turn notify the consumers.

The ruling details content of the breach notification, method of notification, and time constraints.  Should a breach occur involving 500 or more records, it is required that the media be notified as well as the FTC.

Update: MasterCard Responds to Questions About New Audit Requirements

A representative from MasterCard contacted Blue Lance today with the following response to our queries.  Chris Harrall, Senior Business Leader for MC’s Payment System Integrity Group responded with this Q & A:

Q: Is it accurate that MasterCard will require Tier 2 merchants to conduct annual on-site reviews of their security controls by third party QSAs?

A: The company announced revised requirements for Level 2 merchants to use a Qualified Security Assessor (QSA) to complete a mandatory annual onsite data security assessment by December 31, 2010.

Q: If so, when was the change made and why?

A: These changes were announced in the MasterCard Global Security Bulletin No. 6 published on June 15, 2009 and distributed directly to MasterCard acquirers and processors. The current enhancement of validation requirements for PCI compliance provides for independent third party review, enabling consistency of application and implementation of DSS requirements.

Q: How much time do Tier 2 merchants have to comply with the new requirement?

A: Level 2 merchants must use a Qualified Security Assessor (QSA) to complete a mandatory annual onsite data security assessment by December 31, 2010.

To view the post regarding this requirement change, click here.

Nevada Mandates PCI Standard

The state of Nevada is going all in.  By January 1, 2010, every payment card-accepting business in the state of Nevada will be required to comply with PCI DSS regulations.  Nevada is the first state to mandate PCI compliance, trumping Massachusetts, the former data security leader in the US (as far as laws are concerned).

This legislation is more of a statement than an actual change as far as companies accepting credit cards are concerned; all businesses accepting payment card transactions are already required to comply with PCI DSS regulations, and can be fined by PCI if regulations are not adhered to.  Conversely, the state of Nevada had made no remarks about penalties that would be incurred if their new PCI law is broken.

The group to be affected by this legislation most is companies dealing with non-credit card personal data, such as Social Security numbers, drivers’ license numbers, and account numbers in combination with passwords.  Encryption requirements are included in the new law for transfers of these types of personal information outside of a company’s control, though some form of those requirements existed prior to the new legislation.

View the legislation

MasterCard to Increase PCI Compliance Requirements for Level 2 Merchants

As of December 31^st, 2010, all merchants processing between one and six million MasterCard transactions annually will have to undergo a yearly on-site audit to confirm PCI compliance, according to the company’s Site Data Protection Program.  MasterCard has yet to reply to queries regarding the reasoning behind this decision.

Lee Pierce of Security Metrics, a third-party PCI DSS auditing company, speculates that the change was made due to the increasing number of high profile security compromises that have occurred lately.  Pierce expects an increase in call volume to Security Metrics and companies like it from the many Level 2 classified merchants who will now require their services.

This change will put a dent in the budgets of Level 2 merchants, who are presently only required to perform an annual self-assessment, but should ensure more comprehensive PCI DSS compliance.  It is unclear at this time if other credit card companies will follow suit.

MasterCard’s website still states that Level 2 merchants are required to self-assess.  It remains to be seen if this double requirement is apparent simply to ensure that some type of assessment is taking place until the date set for the onsite assessment change, or whether it will remain so to back up either party's compliance conclusions.

Insider Reportedly Arrested in Sony Card Data Theft

Databreaches.net reports that Sony discovered a breach in May where credit card data obtained through the Sony Rewards web site had copied and in some cases, emailed to an outside account.  The data included credit card numbers, names and expiration dates.

After an investigation, a suspect was arrested within Sony's Park Ridge offices.  Sony has sent notices to approximately 5000 customers.

Read the full story