As you might have heard, or possibly experienced, ransomware is a particularly nasty form of malware that holds your files hostage. In fact, DC webcams were hacked by ransomware before the inauguration! In the past, the ransom was usually just under $2,000 and, if you paid it, you probably got your files back. Those days are passing quickly.
Lately, one of the biggest dangers of ransomware is that they’ve figured if you’ve paid once, you’ll probably pay again, so paying actually sets you up to get hit again! “Fool me once, shame on you, fool me twice…” In fact, we recommend against paying the ransom at all!. If infected, you can contact the FBI and while they won’t get your files back, they will open a case. I suggest you have a strategy for ransomware prevention implemented BEFORE you get hit.
To add injury to insult, when you do come up with the Bitcoin to pay (no, they don’t take American Express), there’s a possibility that you WON’T get your files back! The unlock key simply doesn’t work, and the bad guys no longer are interested in you at all. They got what they wanted,they might even ask for MORE money! Another danger of ransomware is that newer variants will also start randomly deleting files until you pay up! Ouch!
Paying $600-$1,800 might not seem like a lot, but I am preparing for the day when the hackers don’t just demand money to return your files, they’ll start demanding MORE money to stop deleting your files, or worse yet, sell your files to your competitors! Can you afford a $20,000 ransom or risk your confidential data appearing in your competitors inbox?
Do you have a rock-solid backup policy? Have you been hit with ransomware and don’t want to fall prey again? Contact us today and let’s talk about ransomware prevention. Our EstesCloud cybersecurity suite has the vaccine for ransomware!
________________________________________ Click here to schedule a meeting to let us help you make your technology a no-brainer! Fill out the form below to get a fact sheet that will help you decide if you need managed IT services for your business.
HIPAA stands for the Health Insurance Portability and Accountability Act that was passed by Congress in 1996.
Essentially, HIPAA enshrines the means by which American workers and their dependents can keep their health insurance coverage should they change or lose their jobs.
HIPAA also sets industry-wide standards for electronic billing of health care services. Additionally, this law mandates the confidential handling of an individual’s medical information.
So what does this have to do with mobile devices? Plenty.
Mobile devices have affected every industry sector. With each passing day, more and more professionals conduct their business using tablets, laptops, or smart phones. This includes the medical industry. Doctors, nurses, and physician’s assistants routinely send confidential (HIPAA) data over satellite data plans and WiFi.
Securing HIPAA Data Remotely
In most cases, the medical industry’s use of mobile devices translates into better patient care. But it also opens personal medical data to the threat of cyber theft.
To maintain HIPAA compliance, health care professionals and IT managers should implement the following best practices when handling health care data on mobile devices:
Obtain Written Permission Before Operating via Mobile
Make sure to document the fact that your patients have signed off on communicating with your office via email or any other electronic means. Documented consent is critical to HIPAA compliance. It’s also one of the simplest and best ways to avoid embarrassing misunderstandings and potential legal suits down the line.
Stick to Proper Professional Jargon
The ease and speed of mobile devices often results in users relying on abbreviations, emoticons, and other forms of internet vernacular. Put simply: DON’T DO THIS. Due to the nature of the field, any HIPAA data created should be kept appropriate for long-term records. Remember that communications, notes, and files that appear unprofessional can subject health care practitioners to confusion at best and malpractice suits at worst. Treat every character you type on behalf of your job as the valuable work product it is. Your company and the patients you treat depend on accurate communications scripted in proper industry vocabulary.
Everything Goes Into the File
Remember that every email you send or receive, every file you upload or download, every conversation you have by phone is part of your patient’s official medical record. Text messages, phone calls, and conversational asides might not seem important in the moment. However, they all form a piece of the overall puzzle a patient’s profile presents. Be sure to record every instance of communication diligently to prevent confusion and delays in treatment, as well as to maintain HIPAA compliance.
Encrypt Your Transmissions
No one leaves for work each day while the door to the house stands open wide. That’s just common sense. By the same token, no one using a mobile device in the 21st century should send any transmission without securing that message via data encryption. User passwords activate only one tier of proper data security. DON’T STOP THERE! Due to the sensitivity of medical information, add as many layers as you can in the form of personal questions, icons, PINs, and other challenge-response tests. Remember that there’s no such thing as too much security.
Managed IT Keeps HIPAA Data Safe
Our ComplianceCare service from EstesCloud can help you solve all of your HIPAA IT issues.
Get more tips on protecting HIPAA data on mobile devices with our comprehensive advice on remote worker security. Because mobility increases the risk of cyberattacks, our helpful IT security guides can keep your employees and clients safe. Fill out the form below to receive a presentation on remote workforce security. This presentation was an event in partnership with the Loveland Chamber of Commerce. EstesGroup’s headquarters is in Loveland, Colorado, where we help small and midsize businesses deploy mobile cybersecurity solutions.
HIPAA Technical safeguards are designed to decrease the possibility of a security issue or data breach in an organization.
Businesses handling protected health information (PHI) must have current and comprehensive technical safeguards in place to remain secure from any threats, whether internal or external. Organizations that require HIPAA technical safeguard compliance must determine the extent of their security measures and if they are reasonable and appropriately suited for the size of the organization. For example, internet filtering and full disk encryption may be appropriate and cost effective for entities with tens of thousands of records managed by multiple users, while a smaller organization may be sufficiently protected with a less complex antivirus, file encryption or simple firewalls.
What are HIPAA technical safeguards?
HIPAA technical safeguards are simply the policies and procedures for the use of technology put in place to protect patient health information. It includes the technology, software, hardware, administration and more. There are four main components:
HIPAA Access Control
This is a policy or procedure that controls who can access information. Only authorized people should be able to access certain information and all activity must be able to be tracked to a specific user. User verification and automatic log-off after times of inactivity, as well as emergency access procedures are addressed here.
HIPAA Audit Control
These controls are designed to record and examine activity where patient information is accessed or stored. The procedure should include a process that outlines the frequency, methods and scope of the audit, as well as processes for violations.
HIPAA Integrity Control
This control is in place to ensure patient data is not destroyed or altered. This typically begins with a risk assessment to determine how outside sources may be able to access the information and then addressing those areas of weakness. Protection for external storage of information is also included here. It can also include procedures, processes or software that authenticates information.
HIPAA Transmission Security
This technical HIPAA security safeguard addresses the concern of unauthorized access to patient information being transmitted over a network. The use of electronic medical records which allow medical personnel to access patient data inside an office or on the other side of the country, must be secure. Encryption is the key tool here.
Any technical safeguards will change as technology and threat landscape changes.
But with HIPAA security safeguard components in place, the opportunities for cyber attacks and data loss can be reduced significantly. While medical providers are required to follow HIPAA regulations, any network can be made more secure with the very same guidelines. EstesCloud ComplianceCare offers the best-of-breed HIPAA compliance services, making sure your practice will pass any audit that might come your way!
Take the first step to reduce cost and increase the productivity of your business. Give us a call at 888.300.2340, and
Continuing our EstesCloud IT Security blog series on the importance of cyber security, which began with why you should write a security policy, we continue with our next edition about malware.
A server malware protection policy is designed to protect your systems from cyberattacks. Malware is software with the intention to damage or disable computers or computer systems. It can be code, spyware, cookies, viruses, worms, Trojan horses, and more that compromise your PC and possibly your whole network! They can be very expensive to correct, not just in lost productivity, but also in equipment restoration or replacement.
Exploiting vulnerabilities in the hosts, communication networks or perimeter systems
Convincing a user to install infected software/apps
How and why to create a malware policy
Just as with any policy, you will begin with the “Why”. Why are you creating the policy? Presumably it’s to minimize the likelihood and the subsequent impact of an infection.
Let’s begin with some more basic questions:
Who does it apply to?
What equipment is included?
What are we talking about?
We can then ask questions that lead to solid definitions:
What is malware?
What damage can it cause?
What is an anti-virus program?
What is filtering software?
How is the malware policy activated?
Where do we go for additional resources?
The malware policy itself can be stated in various ways:
What the anti-virus program is, who installs it and what devices require installation.
What to do in case of new devices, suspected infection, suspicious or problematic software links.
How and when scans should be run and if they are manual or automatically scheduled.
How the software should be monitored, updated and management of the required updates
Rules about installing applications, downloading information, updating software, and opening attachments.
The use of filtering programs such as website blockers and e-mail scanning.
Rules about spam, junk mail, chain e-mails, social sites and any other applicable areas of potential risk.
Then it might be a good idea to make a malware policy response plan
Sometimes all the policies, plans and procedures can’t stop a cyberattack, in which case you may consider a malware response plan. This response plan should be included as part of the malware policy.
The malware policy back up plan kicks into action when there is an infection or a threat. It is typically a flow chart of action steps to mitigate as much damage as possible.
Step 1: Determine if there is a threat and how significant it is.
Step 2: Isolate the problem. The solution may require blocking internet services or shutting down a server or workstation to prevent further infection.
Step 3: Remove the problem. This is what the anti-virus programs are designed for. It may simply be a scan, repair, re-installing the OS from original disks, or even replacement of equipment.
Step 4: Recovery. Once the problem has been isolated and eliminated, check the systems for any other problems. Depending on the depth of infection, you might consider the venerable “format C:” to remove most (but not all!) infections. Be careful you don’t re-infect your system as you restore data, and make sure you close the attack vector so you don’t get re-infected! It is absolutely essential that your backup and disaster recovery plan be 100%, as some infections (like CryptoWall) cannot be removed!
Step 5: Communication. Talk about the malware was able to cause damage. Talk about the situation with users and make any needed adjustments with the IT company to avoid it happening again in the future.
The bulk of information involved in a malware policy is in the communication to users about what it is, how it can be prevented and what to do in case there is an infection. With EstesCloud Server Care, ClientCare, and our HIPAA Compliance Care antivirus and filtering software installed, incidents can be avoided and you’ll have support if there is an issue.
CompleteCare:Maintaining your own IT infrastructure is expensive and frustrating. EstesCloud CompleteCare combines the benefits of our ServerCare and ClientCare programs into one comprehensive program that protects your entire IT infrastructure at a predictable fixed cost. Let the EstesCloud team become your Trusted IT Advisor, so you can get back to growing your business. Let’s start the conversation!
ServerCare: A proactive approach to IT that includes regular scheduled maintenance and monitoring is essential to maintaining a healthy network and a productive staff. EstesCloud ServerCare will give you peace of mind knowing that our team is continually watching and caring for your servers. Discover the Benefits of ServerCare.
ClientCare:Proactive support for your desktops, laptops, and mobile devices. We provide all of the monitoring, patching, and security tools for your systems, plus full access to our help desk services 24/7/365. EstesCloud ClientCare will ensure your valuable data is secure whenever and wherever it is needed. Take control of your systems today.
Are you worried, as a consumer, about your data being lost, stolen or publicized?
As a healthcare provider, are you concerned about the liability you could face as a result of an attack?
KPMG LLP, is an audit, tax and advisory firm helping their clients get insight so they can address industry specific concerns and opportunities. According to their 2015 Healthcare Cybersecurity Survey:
“Eighty-one percent of healthcare executives say their organizations have been compromised by at least one malware, botnet or other kind of cyberattack during the past two years, according to a survey by KPMG.
They stated the greatest risk in healthcare cybersecurity is in:
External Attacks
Sharing Data with Third-Parties
Employee Crime
Wireless Computing
And 27% from Inadequate Firewall protection
In February 2013, Red Spin, a Health IT security firm published a report that over 29 million patient records had been compromised due to healthcare cybersecurity breaches since 2009. Since then, we have experienced two of the largest known healthcare cybersecurity breaches. In the last two years, both CHS and Anthem were attacked.
In July 2014, the giant Community Health Systems (CHS) malware attack affected 4.5 million people. In February 2015, health care provider Anthem was hacked, impacting 80 million records, including the company’s own CEO. In both cases, it wasn’t medical information that was compromised, but rather patients’ private information including full names, addresses, social security numbers and more.
Spending has been increased to prevent attacks, but this trend is being seen more in large organizations rather than small ones. The small companies just don’t think it can happen to them, but when trends are showing high numbers of compromise and low confidence of protection, it is time to get support. A security audit to access the need and vulnerabilities of the systems is the first step.
If you are in the healthcare industry and are subject to HIPPA law compliance, it is critical to protect your client data from a healthcare cyberattack.
CompleteCare:Maintaining your own IT infrastructure is expensive and frustrating. EstesCloud CompleteCare combines the benefits of our ServerCare and ClientCare programs into one comprehensive program that protects your entire IT infrastructure at a predictable fixed cost. Let the EstesCloud team become your Trusted IT Advisor, so you can get back to growing your business. Let’s start the conversation!
ServerCare: A proactive approach to IT that includes regular scheduled maintenance and monitoring is essential to maintaining a healthy network and a productive staff. EstesCloud ServerCare will give you peace of mind knowing that our team is continually watching and caring for your servers. Discover the Benefits of ServerCare.
ClientCare:Proactive support for your desktops, laptops, and mobile devices. We provide all of the monitoring, patching, and security tools for your systems, plus full access to our help desk services 24/7/365. EstesCloud ClientCare will ensure your valuable data is secure whenever and wherever it is needed. Take control of your systems today.
How much fear is behind the tens of thousands of daily searches for backup disaster recovery?
How do you know your backup recovery will work? What will you be able to restore, really? Globally, the search is on for the best backup and disaster recovery solutions for businesses. As it becomes easier to create and share data, the need for backup services increases. Fortunately, new cloud computing technologies allow for endless data sharing and syncing, and these interactions can be protected by replication services.
