At the Health IT Summit in Dallas, a Probing Discussion of Incident Response Strategy | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

At the Health IT Summit in Dallas, a Probing Discussion of Incident Response Strategy

December 19, 2017
by Mark Hagland
| Reprints
At the Health IT Summit in Dallas, data security experts discussed incident response complexities

The classic adage that “the devil is in the details” could have been coined just to be used in discussions of the complexities of cybersecurity in healthcare, so challenging those complexities are. Still, the subject makes for a great discussion panel topic, as was evidenced on Friday morning, when a panel of data security experts discussed “Best Practices for Improving Incident Response Strategies and Developing Security Protocols to Prevent Data Loss,” during day two of the Health IT Summit in Dallas. The day two program, under the rubric of Cybersecurity Forum, was devoted entirely to data security issues, as participants pondered major issues facing healthcare, at the Summit, sponsored by Healthcare Informatics, and held at the Dallas Hilton Anatole hotel.

Sriram Bharadwaj, chief information security office and director, information services, at UC Irvine Health in Irvine, California, led the discussion Friday morning. He was joined by a distinguished panel of discussants: Heather Roszkowski, Chief Information Security Officer, University of Vermont Health Network; Alex Veletsos, Vice President and Chief Information Officer, Together Health Network; Heath Renfrow, who until a few weeks ago was Cyber Security Program Manager, Army Medical Command HQ, Department of the Army, and who is now consulting full-time on cybersecurity; and Ray Hillen, Managing Director, Cybersecurity, Agio.

Bharadwaj, who had just presented on the topic of board engagement in cybersecurity strategy, opened the discussion on that topic, asking Roszkowski about her perspectives on board engagement.

“Heather, how do you see board engagement at the top level? Bharadwaj asked. “I’m the CISO for six hospitals, and what I’m doing right now is really building the team that supports all the cybersecurity across two states—Vermont and upstate New York—and to build a program for entities as large as the U of Vermont Medical Center, as well as the small community hospitals, including a 25-bed hospital. A wide range of entities,” Roszkowski said. “Board engagement is absolutely essential in what we’re doing.”

“Heath, you come from a completely different environment,” Bharadwaj said. In response, Renfrow revealed that he had just transitioned from Army Medicine to a consulting role, one that involves consulting on security to all industries. “Healthcare has been the most complex environment, as well as the most rewarding one, that I’ve ever been in,” he said.

Webinar

Components of Strong Cybersecurity Program - A Closer Look at Endpoint Security Best Practices

Endpoint protection remains a core security challenge for many healthcare organizations and it is more important than ever for healthcare organizations to actively manage their full range of...

“I run cybersecurity services for Agio, and we work in a number of verticals—we’ve been in healthcare since 2010, doing things like risk assessments, doing advanced threat simulation, and the like,” Hillen said. “We work with small practices to large healthcare systems. There’s no one-size-fits-all, but there are elements every organization should have, regardless of size.”

Veletsos, of Together Health network, noted that “We’re a statewide clinically integrated network representing about 30 hospitals and 7,000 physicians, and about one-third of the healthcare resources in Michigan. We’re working on incorporating all the best practices of the three parent organizations, while also working in our new broad environment.”

The challenge of managing external communications

Meanwhile, Bharadwaj said, “One area that has been a topic of conversation for some time now has been that of how to manage the public relations and external communications aspects” of breaches, “when you have an incident; as well as the engagement of the board at the same time. What has been your experience of that?”

“Yes, as part of incident response strategy, we automatically involve marketing folks,” Roszkowski noted. “And we have done preparatory work to have some template language available. Even if you think you’re only communicating internally, it’s highly likely that things will be communicated externally,” she added. “So we’re very careful in how we communicate internally. We give them the information we can; at the same time, we’re communicating with organizational leaders, so that staff members can go to their organizational leader, and that leader has the information they need to make some decisions.”

“Has anybody here heard about Equifax?” Renfrow asked rhetorically. “Yes, that was a PR nightmare.” In the immediate wake of any data breach that affects patients and community members, Renfrow said, “I would make two calls. First, I would call the legal department. And then I would immediately reach out to public relations, once we know we have an incident. Be transparent,” he advised. “Don’t be like Uber; don’t try to cover it up.” Meanwhile, he noted, “When the Equifax incident broke, I logged into their website and saw the message saying that if you registered with the company, you would lose any legal rights to redress. That was a bad move. And so you have to be honest with your customers; admit that it will happen. Look, there are kids now at MIT that are figuring out how to listen into your room based on vibrations from plants. So don’t try to hide; prepare. And what are your public relations plans? NotPetya is a great example of that,” with regard to organizations that needed to concede publicly that they had experienced breaches.

“We were struggling with what happened to Nuance with Petya/NotPetya, and we at first didn’t realize we were affected, but we were, and it was a challenge,” Bharadwaj said. “So you need to be communicating closely with your vendor. And so that’s an important area.”

Meanwhile, Bharadwaj asked Hillen, “What do you advise your clients?” “There aren’t too many organizations that haven’t experienced some sort of privacy breach; if you haven’t, it’s going to happen,” Hillen advised. “And I would add that it may look different from day 1, on day 16, day 180. If you look at some discoveries in 2016 and 2017, there were situations in which breaches from the past had occurred in 2014 or 2015, but ended up being larger than had initially been thought. So you may think it’s over, but it may not be. And you should develop internal templates for communications so you’re not figuring this out while you’re in the fight. Develop some templates based on ransomware or lost device scenarios, or the unknown.”

“Over the years,” Veletsos said, “CHIME [the Ann Arbor, Mich.-based College of Healthcare Information Management Executives] and other healthcare associations and educational groups, have been focused on helping CIOs, CTOs, CISOs, CMIOs, to develop relationships with other c-suite members, putting projects together, so they’re not seen as ‘techie outsiders.’ What we’ve found over the years is that it’s best if the funding for incident response preparation is handled by someone who’s not new to the team. Those of us who went through that in the early days, we’re finding now that the news media, they help make the case. The executives, the leaders, know what’s going on. We’re mainly a physician organization, so when we explain to physicians why they shouldn’t use the embodied SMS capability to share PHI, they get that. We don’t need to make the case. It’s a matter of how we develop workaround solutions to develop collaboration with our leaders.”

“So the theme is, develop relationships, communicate, get leadership involved,” Bharadwaj summarized. “It’s a theme we’ve seen work well.”

Preparing to respond in real time

“But what happens when the real incident happens? How do you make sure you’re prepared for that?” Bharadwaj asked his fellow panelists. “There’s a document in a file somewhere. But we discover we wrote something and didn’t follow it. Have you learned from that?”

“I think we’ve all been there,” Roszkowski said. “And one of the things we try to do is to learn from others’ mistakes. When there’s an incident that’s widely reported in the media, we look at documents we’ve prepared in the past, and update them. So we do that to engage in a rehearsal. When ransomware emerged, everyone started to focus on that, and then all of a sudden, there was Petya, and everyone all of a sudden said, ‘Whoa, wiper virus, what’s that?’ And we know that when you go to prioritize your projects and your ongoing work, this preparation planning is one of the things that always slides to the bottom. So what we’ve done is we’ve created a full-time position for someone to do incident response. And when they’re not responding, they’re planning for incidents. And that’s improved our process tremendously.”

“In our case, we don’t have a large team, so we have a response plan from every analyst on the team,” Bharadwaj offered. “One person is focusing on email, one on another issue, for example. So we split the work, since we lack resources. So we’ve assigned individuals to focus on specific potential incident response areas. The other thing we need to look at is, how do we audit ourselves? In Army Medicine, did you perform regular audits, Heath?”

“For Army Medicine,” Renfrow said, “The reality is that it’s about nationwide attacks. And everybody knows about what’s going on with North Korea. I had to worry about, what’s our incident response if we are hit? Do we have an egress plan? We have a hospital in Seoul, South Korea. And the North Koreans are very sophisticated about this. Another thing I really, really focused on is, internal auditing is fine, but I was more worried about my third-party vendors, my HVAC vendors. We would put things into contracts to hold them accountable, and to make sure we were on the same page. So I think it’s very important to make sure your partners are involved in the same incident response plan, and to partner together. That’s where our auditing mostly took place.”

“Ray, what have you seen among your customers?” Bharadwaj asked. “When we do assessments of organizations, we are looking to understand whether they’re doing any formal testing or auditing, whether they have any artefacts,” Hillen said. “We’re also looking to see whether they’ve done training. Does the help desk understand what the likeliest threats are today, and what the indicators of those threats are, if they’re receiving calls from end-users? And is the senior level of the organization involved? And is incident response discussed at all levels? At the end of the day, with a shared security model, you have 2,000 users, you have 2,000 sensors, to help you monitor at the earliest opportunity.

“We’ve incorporated resources form business and clinical areas, to help with incident response, to be part of the solution,” Veletsos noted. “Also, we used to have one disaster recovery test a year; now, we do two tests. They’re almost comprehensive business continuity tests, and include several components. The last one that we did two weeks ago included a simulated ransomware attack; so incident response planning is embedded in our testing as well.”

“People forget that there’s the technical side and the user side,” Roszkowski testified. “And lately, I’ve seen the newer clinicians coming out of med school and nursing school being very technically oriented. They don’t know how to work outside technology. But the older clinicians—when I was in the Army, I used to have to carry around a ten-pound file—the older nurses know how to work with paper. And it’s interesting to talk to the staff and say, it’s not a matter of if, but when. And as much as we put in high-availability systems, systems go down. And at the end of the day, we’re a 24/7 organization. And so you have to do your own sort of incident response planning, at the floor level, so end-users know what to do.”

What happens when an organization needs to resort to paper?

Bharadwaj told the audience a story about what happened during the time that his hospital organization was transitioning from one core electronic health record (EHR) product to another. “During the transition,” he said, “we had talked to nurses about how they could calibrate dosage for IV, based on age. The youngest nurses have no clue, without the EHR, how to compute the ML you need to give the baby, because they use a calculator within the system that automatically computes dosages based on age and weight of the baby. So we struggled with the nurses on this, because we had younger nurses saying they really didn’t know how to compute. So there’s this sea of disparity between how medicine was practiced 10, 20 years ago, and how they practice today. So imagine if there’s an incident and you’re down, the folks can’t do this, even with a calculator—in the NICU—to calculate age, weight, and other factors. Some of the docs don’t know, either. The docs who came out of med school with Macs in their hands actually have no idea, seriously; many of the physicians now could not write a prescription on paper, because they’re so used to inputting information and having the system calculate the volume by days. And we found this out during our EHR transition. And let’s be honest: when an incident occurs, no one’s an expert. So we have to prepare.”

“Yes, and there is a lot of variation” in hospital organizations’ strategies and tactics for managing break situations, Veletsos said. “We get that planning, and having the appropriate preparation, are important—but there has to be a little bit more than just internal audit,” he said. “here has to be a second set of eyes to validate that certain things are happening, as agreed upon, in incident response planning. We seem to be spending a lot of time planning. We get the resources to invest in planning, but a lot of times, we don’t get the resources to do the diagnosis and the remediation. So it’s important to have the right people at the table, per resources, when making decisions.”

“I would suggest to the audience that while you may have an incident response professional on staff, the type of incident may dictate who should be the manager for a particular event,” Hillen said. “And that incident response professional is sort of the backstop, right? I would also suggest that you have a third party on call, at least, to make sure you’re not leaving anything out.”

“That’s a great point, Ray,” Roszkowski said. “And the person on our team is an incident response strategist. But depending on the incident—a network attack incident versus malware, versus full disaster recovery—there will be a different person managing, but that incident response strategist will be standing next to them. Because you’ll have so many people moving around you—but that person can whisper to you, did we pull the logs from this particular system? We need to pull certain tickets. And within that first hour, we’re contacting our vendors, to make sure we have resources available on the phone, so you have those communications open. And it has to be a constantly moving, growing, incident response process. If anyone says, we’re done with our planning, no, you’re not.”


The Health IT Summits gather 250+ healthcare leaders in cities across the U.S. to present important new insights, collaborate on ideas, and to have a little fun - Find a Summit Near You!


/article/cybersecurity/health-it-summit-dallas-probing-discussion-incident-response-strategy
/blogs/mark-hagland/cybersecurity/assessing-new-cybersecurity-practices-publication-why-small-and

Assessing the New Cybersecurity Practices Publication: Why Small and Medium-Sized Care Organizations Have Reason to Rejoice

| Reprints
A new set of voluntary cybersecurity practices just released by HHS offers practical advice and conceptual supports that fill information gaps
Click To View Gallery

How helpful will the new set of voluntary cybersecurity practices that the Department of Health and Human Services (HHS) released in late December, be, to the leaders of patient care organizations? Only time will tell, as part of the value of the release will only be made manifest as the leaders of patient care organizations move forward to implement some of those practices, and the potential success of such implementations is in some way measured and benchmarked.

But the release is a first start, at least. As Healthcare Informatics Associate Editor Heather Landi reported on January 2, HHS released the set of practices in the form of a publication “that marks the culmination of a two-year effort that brought together over 150 cybersecurity and healthcare experts from industry and the government under the Healthcare and Public Health (HPH) Sector Critical Infrastructure Security and Resilience Public-Private Partnership.”

“Cybersecurity is everyone’s responsibility. It is the responsibility of every organization working in healthcare and public health.  In all of our efforts, we must recognize and leverage the value of partnerships among government and industry stakeholders to tackle the shared problems collaboratively,” Janet Vogel, HHS Acting Chief Information Security Officer (CISO), said in a statement published with the release of the new publication.

Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP), the primary publication of the Cybersecurity Act of 2015, Section 405(d) Task Group, aims to raise awareness, provide vetted cybersecurity practices, and move organizations towards consistency in mitigating the current most pertinent cybersecurity threats to the sector,” HHS officials stated. “It seeks to aid healthcare and public health organizations to develop meaningful cybersecurity objectives and outcomes. The publication includes a main document, two technical volumes, and resources and templates.”

The overall publication consists of several sections, the first being the HICP, which “examines cybersecurity threats and vulnerabilities that affect the healthcare industry. It explores five current threats and presents 10 practices to mitigate those threats; “Technical Volume 1: Cybersecurity Practices for Small Health Care Organizations,” which offers cybersecurity practices for small healthcare organizations; “Technical Volume 2: Cybersecurity Practices for Medium and Large Health Care Organizations”; the “Resources and Templates” portion, which “includes a variety of cybersecurity resources and templates for end users to reference”; and a Cybersecurity Practices Assessments Toolkit, which “helps organizations prioritize their cyber threats and develop their own action plans using the assessment methodology outlined in the Resources and Templates volume”—that last section being still under development as of Jan. 2.

As Landi reported, “The HICP publication aims to provide cybersecurity practices for this vast, diverse, and open sector to ultimately improve the security and safety of patients. The main document of the publication explores the five most relevant and current threats to the industry. It also recommends 10 cybersecurity practices to help mitigate these threats.”

What’s more, she wrote, “The main document presents real-life events and statistics that demonstrate the financial and patient care impacts of cyber incidents.  It also lays out a call to action for all industry stakeholders, from C-suite executives and healthcare practitioners to IT security professionals, that protective and preventive measures must be taken now. The publication also includes two technical volumes geared for IT and IT security professionals, one focusing on cybersecurity practices for small healthcare organizations, and one focused on practices for medium and large healthcare organizations.”

Among the salient statistics reported in the HICP:

  • Fifty-eight percent of malware attack victims are small businesses.
  • In 2017, cyber-attacks cost small and medium-sized businesses an average of $2.2 million.
  • Sixty of small businesses go out of business within six months of an attack.
  • And, 90 percent of small businesses do not use any data protection at all for company and customer information.

How does that translate into impacts on smaller healthcare organizations? Among other incidents, the HICP notes that:

  • A popular orthopedic practice announced that its computer system was hacked via breach of a software vendor’s log-in credentials. This breach put just under a half-million people at risk of identity theft. Of those, 500 patient profiles appeared for sale on the dark web. The information for sale included names, addresses, social security numbers, and other personally identifiable information (PII). Although not posted for sale, pertinent PHI such as X-ray results and medical diagnoses were also stolen.

 

  • A rural hospital had to replace its entire computer network after a ransomware cyber-attack froze the hospital’s electronic health record (EHR) system. Doctors were unable to review their patients’ medical histories or transmit laboratory and pharmacy orders. Officials were unable to restore essential services and could not pay the ransom for the return of their system. After consultations with the Federal Bureau of Investigation and cybersecurity experts, hospital officials made the difficult decision to replace the entire system.
  •  

Of particular practicality is some of the very basic advice given to the leaders of smaller healthcare organizations. To wit: “Doctors and nurses know that hand sanitizing is critical to prevent the spread of germs. That does not mean health care workers wash up as often as they should. Similarly, we know that cybersecurity practices reduce the risk of cyber-attacks and data breaches. Just as we are able to protect our patients from infection, we should all work towards protecting patient data to allow physicians and caregivers to trust the data and systems that enable quality health care. Just as health care professionals must wash their hands before caring for patients, health care organizations must practice good ‘cyber hygiene’ in today’s digital world, including it as a part of daily universal precautions,” the HICP notes. “Like the simple act of hand-washing, a culture of cyber-awareness does not have to be complicated or expensive for a small organization. It must simply be effective at enabling organization members to protect information that is critical to the organization’s patients and operations. Your organization’s vigilance against cyber-attacks will increase concurrently with your and your workforce’s knowledge of cybersecurity. This knowledge will enable you to advance to the next series of cybersecurity Practices, expanding your organization’s awareness of and ability to thwart cyber threats.”

Meanwhile, both smaller and larger patient care organizations will benefit from the technical supports, including a Security Risk Assessment Tool, a set of recommendations on medical devices and cybersecurity, and an incident response risk management handbook.

What this set of resources does is to fill a gap between theory and technical practice in a key area. Will it shift the entire landscape of cybersecurity for patient care organizations? No, that would be a far-too-ambitious goal. But the healthcare IT leaders of smaller and medium-sized patient care organizations in particular, will welcome practice advice and supports, as they move forward in their journeys around cybersecurity. Any such journey is inherently challenging, and federal publications and resources like these will be of real value in moving patient care organization HIT leaders forward.

 

 

More From Healthcare Informatics

/news-item/cybersecurity/hhs-releases-voluntary-healthcare-cybersecurity-practices

HHS Releases Voluntary Healthcare Cybersecurity Practices

January 2, 2019
by Heather Landi, Associate Editor
| Reprints

In late December, the Department of Health and Human Services (HHS) released voluntary cybersecurity practices to the healthcare industry with the aim of providing practice guidelines to cost-effectively reduce cybersecurity risks.

The “Health Industry Cybersecurity Practices (HICP): Managing Threats and Protecting Patients” publication aims to provide guidance to healthcare organizations of all types and sizes, ranging from local clinics to large hospital systems.

The industry-led effort was in response to a mandate set forth by the Cybersecurity Act of 2015 Section 405(d), to develop practical cybersecurity guidelines to cost-effectively reduce cybersecurity risks for the healthcare industry.

According to HHS, the publication marks the culmination of a two-year effort that brought together over 150 cybersecurity and healthcare experts from industry and the government under the Healthcare and Public Health (HPH) Sector Critical Infrastructure Security and Resilience Public-Private Partnership.

“Cybersecurity is everyone’s responsibility. It is the responsibility of every organization working in healthcare and public health.  In all of our efforts, we must recognize and leverage the value of partnerships among government and industry stakeholders to tackle the shared problems collaboratively,” Janet Vogel, HHS Acting Chief Information Security Officer (CISO), said in a statement.

While technologies are vital to the healthcare industry and help provide life-saving treatments and improve patient care, these same technologies are vulnerable to myriad attacks from adversaries, ranging from criminals and hacktivists to nation-states, according to HHS. These technologies can be exploited to gain access to personal patient data or render entire hospital systems inoperable. Recent cyber-attacks against the nation’s healthcare industry continue to highlight the importance of ensuring these technologies are safe and secure.

“The healthcare industry is truly a varied digital ecosystem. We heard loud and clear through this process that providers need actionable and practical advice, tailored to their needs, to manage modern cyber threats. That is exactly what this resource delivers; recommendations stratified by the size of the organization, written for both the clinician as well as the IT subject matter expert,” Erik Decker, industry co-lead and Chief Information Security and Privacy Officer for the University of Chicago Medicine, said in a statement.

The HICP publication aims to provide cybersecurity practices for this vast, diverse, and open sector to ultimately improve the security and safety of patients. The main document of the publication explores the five most relevant and current threats to the industry. It also recommends 10 cybersecurity practices to help mitigate these threats.

The main document presents real-life events and statistics that demonstrate the financial and patient care impacts of cyber incidents.  It also lays out a call to action for all industry stakeholders, from C-suite executives and healthcare practitioners to IT security professionals, that protective and preventive measures must be taken now. The publication also includes two technical volumes geared for IT and IT security professionals, one focusing on cybersecurity practices for small healthcare organizations, and one focused on practices for medium and large healthcare organizations.

 

Related Insights For: Cybersecurity

/news-item/cybersecurity/cynergistek-protenus-partner-privacy-monitoring-programs

CynergisTek, Protenus Partner on Privacy Monitoring Programs

December 26, 2018
by Heather Landi, Associate Editor
| Reprints

CynergisTek, Inc., an Austin, Texas-based healthcare cybersecurity firm, is partnering with Protenus, a healthcare compliance analytics company, to combine the companies’ technology tools and services with a focus on patient privacy monitoring programs.

The partnership will grant health systems access to Protenus’ analytics platform that leverages artificial intelligence to gather data related to potential patient privacy risks, along with CynergisTek’s patient privacy monitoring services.

According to the Protenus research, insider incidents accounted for 23 percent of all breaches that occurred at health systems in Q3 2018. This figure will only continue increasing, indicating that now more than ever, health systems need a cost-effective solution to meet the daily challenges of managing patient privacy.

To address this need, CynergisTek and Protenus formed a preferred partnership to combine CynergisTek’s healthcare consulting experience and privacy programs with Protenus’ healthcare analytics technology to offer health systems both the people, processes, and technology components of a strong patient privacy monitoring program, according to the companies.

“As health systems face mounting challenges in creating and maintaining robust patient privacy monitoring programs, we identified a need to partner with a company offering complementary services so that health systems can act on the insights uncovered by our analytics,” Nick Culbertson, CEO and co-founder of Protenus, said in a statement.

 “Data privacy is evolving as a dominate theme in conversations, both in healthcare and other industries, and health systems need to take an end-to-end approach to patient privacy to truly address this complex and mission-critical challenge,” Mac McMillan, CEO and president of CynergisTek, said in a statement.

 

See more on Cybersecurity

agario agario---betebet sohbet hattı betebet bahis siteleringsbahis