HHS reports international cyber threat to healthcare organizations

To keep our pulse on the HIPAA industry, we subscribe to the U.S. Department of Health and Human Services' HIPAA Security Rule Distribution List. This past week we've seen a lot of activity on the list, so I'm sharing some of it via this post. The reasons behind its surge in activity of course, are the WannaCry ransomware attacks.

SEE RELATED: 3 Key Lessons Learned From WannaCry Ransomware Cyberattacks

If you are the victim of ransomware

1. Contact your FBI Field Office Cyber Task Force immediately to report a ransomware event and request assistance. These professionals work with state and local law enforcement and other federal and international partners to pursue cyber criminals globally and to assist victims of cyber-crime.
2. Report cyber incidents to the US-CERT and FBI's Internet Crime Complaint Center.
3. For further analysis and healthcare-specific indicator sharing, please also share these indicators with HHS' Healthcare Cybersecurity and Communications Integration Center (HCCIC) at HCCIC_RM@hhs.gov

HHS Office of Civil Rights guidance on HIPAA specific to WannaCry

As outlined in its online ransomware fact sheet, HHS presumes a breach in the case of a ransomware attack. The entity must determine whether such a breach is a reportable breach no later than 60 days after the entity knew or should have known of the breach.

SEE RELATED: FACT SHEET: Ransomware and HIPAA [HHS]

Ransomware guidance also includes important information about ransomware and how compliance with the HIPAA Security Rule helps entities prepare for ransomware attacks. This includes regard to contingency planning. OCR has shared its FAQ on sharing of cyber threat indicators here.

Important Note: If the data is not encrypted by the entity to at least NIST specifications when the ransomware attack is deployed, then OCR presumes a breach occurred, due to the ransomware attack. As such, the Covered Entity or Business Associate would need to prove that the ePHI was encrypted when the attack occurred and the ransomware containerized (or encrypted again) already-encrypted ePHI.

SEE ALSO: HIPAA Breach Notification Rule

Where can I find the most updated information from the U.S. Government?

• US-CERT - Alert - TA17-132A
• ICS-CERT - Alert - 17-135-01

• ASPR TRACIE: Healthcare Cybersecurity Best Practices
• Fact Sheet on the FDA's Role in Medical Device Security