HIPAA Survival Guide June 2017 Webinar

Introduction

 WannaCry was the "shot heard round the world!" It dominated both local, national, and international "news cycles" for several days. We are now more than a few weeks from the event and the public is still learning about additional infections. HHS responded to the blitzkrieg by publishing a recurring set of announcements providing mitigation strategies for the healthcare industry. Why? We suspect that HHS knows, as do the rest of us, that we have been fishing out of this pond for a while and the healthcare masses were (and remain) woefully unprepared for this kind of event.

We have crossed the Rubicon and there is no going back. In its recent guidance HHS has stated what we all know to be the obvious: the HIPAA Security Rule ("SR") is not the "end all and be all" of cybersecurity controls that the healthcare industry needs to put in place to respond to the "bad guys"...in fact it represents, according to HHS, nothing more than a floor. Here's the $$ quote:

It is expected that covered entities and business associates will use this process of risk analysis and risk management not only to satisfy the specific standards and implementation specifications of the Security Rule, but also when implementing security measures to reduce the particular risks and vulnerabilities to ePHI throughout an organization's entire enterprise, identified as a result of an accurate and thorough risk analysis, to a reasonable  and appropriate level. For example, although there is a not a Security Rule standard or implementation specification that specifically and expressly requires entities to update the firmware of network devices, entities, as part of their risk analysis and risk management process should, as appropriate, identify and address the risks to ePHI of using network devices running on obsolete firmware, especially when firmware updates are available to remediate known security vulnerabilities. [Emphasis Added].

There is potentially a plethora of lessons learned from WannaCry, but HHS has focused on two that appear to be the most obvious and important (i.e. from both a mitigation and an enforcement perspective): (1) covered entities ("CE") and business associates ("BA") need to have policies, processes and tracking mechanisms in place that allow them to meet the SR's Contingency Standard (i.e. visible, demonstrable, evidence or "VDE"-essentially Disaster Recovery); and (2) scanning your network on a periodic basis are the only ways to get "ahead of the curve" with respect to a WannaCry-like attack. Not doing so is facially likely to amount to "willful neglect" penalties-which start at $50K per violation.

The first lesson learned above HHS (and almost every other commentator) was made expressly. The second is implicit in the quote above and something we will discuss more at length below.

What is Ransomware? 

Ransomware is a type of malware (malicious software) distinct from other malware; its defining characteristic is that it attempts to deny access to a CE or BA's computer and PHI, usually by encrypting the data with a key known only to the "bad guys" who deployed the malware, until a ransom is paid. After the PHI is encrypted, the ransomware directs the CE or BA to pay the ransom to the hacker (usually in a cryptocurrency, such as Bitcoin because the latter is virtually untraceable) to receive a decryption key. However, the "bad guys" may deploy ransomware that also destroys or exfiltrates PHI, or ransomware in conjunction with other malware that may have unpredictable motives and objectives. Ransomware is not necessarily the result of a "hack" per se, there are many ways to compromise your network's perimeter that include low-tech but highly sophisticated social engineering schemes such as Phishing.

What is the cost of Ransomware? 

Although allegedly (circa May 23, 2017) the WannaCry perps have only collected $50K USD, this estimate is likely to increase significantly, given the built-in estimating demands of the ransom (e.g. the longer you wait to pay the more $$ it costs). In 2016, it is estimated that the cost of ransomware reached $1.5 billion, according to market researcher Cybersecurity Ventures. However, that number includes lost productivity and the cost of conducting forensic investigations and restoration of data, all of which makes actual cost data notoriously hard to estimate. The same is true for breach notification costs. And, more insidious yet, some ransomware attacks will also result in breach notification costs (e.g. in those cases where the underlying PHI was not encrypted according to NIST standards). In any case, it can be stated with a fair degree of certainty, that every organization infected will face non-trivial recovery costs, even if breach notification costs and civil monetary penalties are not factored in. The impact is likely to be perhaps the most severe for the SMB marketplace, where the talent gap for dealing with these kinds of attacks is the widest (often non-existent).