2022 Kicks Off With A Massive Data Breach Report

Just two days into the new year, the United States Department of Health and Human Services  (HHS) received its first data breach report of 2022. 

An intruder was found to have accessed the network of Florida-based hospital system Broward Health, affecting more than 1.3 million of its patients and staff members. 

Kicking off the year with a massive cyber attack is a nightmare that no medical practice would ever want to experience. So how did a nationally recognized healthcare system fall victim to one? And what can other practices learn from the incident?

Let’s have a closer look.

Here’s What Happened

On October 15, 2021, the intruder gained access to the Broward Health through the office of a third-party medical provider. The said provider was given permission to access the system so that it could provide healthcare services.

Just four days later on October 19, Broward Health discovered the breach and immediately carried out the necessary actions in response to it. Unfortunately, in the four days that the intrusion went undetected, the attackers were able to exfiltrate or remove personal medical information from Broward Health’s systems, affecting a total of ​​1,357,879 people.

What information was compromised?

With the sheer number of protected health information (PHI) exposed, the Broward Health data breach has affected the largest number of individuals since August 2021.

The PHI included:

• Names
• Dates of birth
• Addresses
• Phone numbers
• Financial or bank account information
• Social Security numbers
• Insurance information and account numbers
• Medical information (including history, condition, treatment, and diagnosis)
• Medical record numbers
• Driver's license numbers
• Email addresses

What did Broward Health do?

According to its statement, Broward Health carried out the following actions upon learning of the breach:

• Contained the incident
• Notified the FBI and the Department of Justice (DOJ)
• Required a password reset for all employees
• Implemented multi-factor authentication (MFA) for all of its system users
• Began implementing additional minimum-security requirements for devices that have access to their network but are not managed by their IT
• Engaged an independent cybersecurity firm to conduct an investigation
• Engaged an experienced data review specialist to conduct an extensive analysis of the data to determine what was impacted

Here’s What You Can Learn From the Breach

According to Steve Moore, a chief security strategist at Exabeam, an organization can still be vulnerable to data breaches even if they have a robust security stack. One of the ways these intrusions take place is through compromised credentials, particularly those that belong to third-party vendors and partners. 

Besides having a detailed plan on how to respond to a data breach, it’s important to note that prevention plays a huge part in an organization’s cybersecurity incident response plan. Here are a few cybersecurity best practices that you can learn from the Broward Health incident:

Access Control Management

Despite the fact that it poses a lot of risk and can result in unfavorable outcomes, vendor access is necessary in healthcare. It’s simply something healthcare organizations like yours can’t do without. The best way around this is by stringently managing and controlling access to your network.

Access control management is considered a security essential for healthcare organizations. It’s actually one of the cybersecurity best practices endorsed by the Center of Information Security, more commonly known as The CIS Controls. 

According to The CIS Controls, it’s important that you use processes and tools to create, assign, manage, and revoke access credentials and privileges for all accounts using your clinic’s assets and software.

Manage what access the accounts have and ensure that users only have access to the data or assets appropriate for their role. There should also be strong authentication mechanisms in place to protect critical or sensitive practice data or functions.

To know more about what access control is, why you need it, and what measures you can apply in your practice, check out our blog post about access control.

Cybersecurity Awareness Training

Since the COVID-19 pandemic broke out, 90% of organizations in the United States had adopted a remote working setup for most of their employees. Unfortunately, only 29% of those organizations actually train their staff about the best practices of working remotely. That is a huge security risk!

Does your medical practice have regular cybersecurity awareness training in place?

Cybersecurity awareness and skills training is also one of the 18 CIS controls we highlighted in our Cybersecurity Essentials for Healthcare Practices ebook. To reduce the risk of a cyber attack in your organization, you should establish and maintain a regular cybersecurity awareness program that effectively influences the behavior and actions of your workforce.

How your employees respond to a potential cyber attack plays a critical part in the success or failure of your cybersecurity program. According to Verizon’s 2021 Data Breach Investigations Report (DBIR), 85% of data breaches in 2020 involved human interaction. 

Human error is the weakest link in the cyber chain, and cybercriminals take full advantage of this.

Simply put, it is much easier for an attacker to entice one of your employees to click a malicious link or open an infected file than to find an exploit and sneak into your network directly.

Your practice’s network users (including yourself) can cause disastrous cyber incidents whether intentionally or not. These incidents can be due to mishandling data, missending emails, losing devices, using weak passwords, or using the same passwords used on public sites.

Implementing cybersecurity awareness training is key to keeping your practice safe from falling victim to cyber attacks. With regular and effective training, your workforce can learn to spot, respond to, and avoid any cyber threat that comes their way.

If you want to know more about what cybersecurity awareness training is, why your practice needs it, how you do it, and how often it should be done, this blog post addressing frequently asked questions is a great place to start!