Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/18/2019
10:30 AM
Jason Polancich
Jason Polancich
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

The Rx for HIPAA Compliance in the Cloud

For medical entities, simply following HIPAA cloud service provider guidelines is no longer enough to ensure that your practice is protected from cyber threats, government investigations, and fines.

The challenges of secure healthcare IT are really hard! It's akin to navigating a barbwire minefield that's surrounded by an endless sea infested with fast, hungry sharks. And it's raining.

That may sound a bit flippant — and it is — but it's also an insightful way to describe the frustrating level of complexity involved in making digital healthcare information more secure and legally compliant. At best, your chance of success is always questionable, and even small missteps come with severe penalties.

About five years ago, the Department of Health and Human Services (HHS) expanded the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a set of laws aimed at providing continuous healthcare coverage and controlling the electronic transmission of healthcare data. The expansion laid out the responsibilities of covered entities (CEs), such as medical practices and insurance companies, and business associates (BAs), referring to technology providers and vendors.

In 2016, the law got even more detailed with guidance for how BAs and cloud service providers (CSPs) should behave in order to be suitably "cyber secure." The new regulations issued very thorough written guidance and set up very stiff penalties for things like data breaches, data loss, and data theft. Since that time, investigations and legal charges have been ongoing — and increasing in volume. If you are curious, you can take a look at the current list of open cases under investigation by the Office of Civil Rights, which has the job of policing HIPAA-covered cyber events.

Recently, a healthcare customer of mine described HIPAA cloud compliance as a big boat that's been hastily built and not tested on the open water. Holes spring up everywhere and, when you plug one, another opens up at the same time.

With all these holes, simply following HIPAA CSP guidelines is not nearly enough to ensure that your company or practice is protected from cyber threats, government investigations, and fines. Each entity involved in handling electronic healthcare information must continuously take extra precautions to keep their risk levels as low as possible.

If those companies (or their IT providers) were to take a look at the cloud networks and client-accessible web portals where they're storing data and hosting things, they'll often find some interesting and unexpected "meetings" going on between their networks and external, often high-risk, IP addresses and networks around the globe.

In other words, if you look at the servers your cloud apps and networks are talking to behind your back and assess them for their cyber threats, you'll find you're opening yourself up to all sorts of potential badness — and HIPAA-policed things like breaches — via vectors like Tor, ransomware, phishing, malware, and botnet-delivered attacks.

By using focused IP and network threat intelligence, healthcare companies and their technology providers can add simple but effective protection measures to more traditional firewall approaches that automatically block access to their networks, data, sites, and apps before the bad things occur.

How do you get started? Here's a checklist to cover the fundamentals:

  • Make sure all your apps, websites, and other networked assets are sufficiently logging inbound and outbound network connections to grab IPs that attempt or make connections.
  • Ensure you have adequate tooling to search, alert, and report on the IP and network data you're collecting with a SIEM or similar tool.
  • Use a quick and accurate service or tool to identify, score, and "rack and stack" the threat profiles of all the collected IP addresses by things like blacklist type and volume, type of threat with which the IPs have been associated, and recency of incidents.
  • Proactively and aggressively provide feedback about the worst and most threatening offenders to your network and web application firewalls for block-listing.
  • Monitor collected IP data over time to catalog baseline patterns and anomalies that warn of current or future incidents.

These methods will help develop a core process you can rely on to profile "normal" traffic patterns between your cloud and external services in order to spot suspicious communications patterns more quickly, which will lead to better threat response and mitigations downstream in your environments before data goes missing. For example, if your cloud all of a sudden starts talking to strange servers in China for a week, you can immediately start looking around for another hole in the boat. At the very least, it's a sign of potential problems to come. 

Too often, medical practitioners and healthcare companies assume that technology providers bear all the burden (and legal risk) for protecting them from the dangers of HIPAA violations. In actuality, the burden to protect businesses and health IT practices is still very much on the non-technical covered entities.

Related Content:

Jason Polancich is co-founder, app designer and digital marketing lead for Musubu.io. Polancich is also a linguist, software engineer, data scientist, and intelligence analyst. He originally founded HackSurfer/SurfWatch Labs (Pre-VC), a cyber analytics firm founded in 2013 ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/22/2019 | 1:59:49 PM
At heart, the cloud is
Jus an enormously long RJ-45 cable from your network to a server somewhere else in the world that has unknown security features running and unknown personnel at the keyboard   For that reason alone it should be suspect and HIPAA only complicate the requirements.  Add in cloud-web apps and you have a hadean nightmare.  HIPAA should never be cloud based.  And I have seen hospitals that use cloud-based patient apps!!!   PRISIM comes to mind and the web version of EYECOM.  No way, ever, should they be used. 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: A GONG is as good as a cyber attack.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20925
PUBLISHED: 2020-11-24
An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects: MongoDB Inc. MongoDB Server v4.2 versions prior to 4.2.1; v4.0 versions prior to 4.0.13; v3.6 versions...
CVE-2020-5641
PUBLISHED: 2020-11-24
Cross-site request forgery (CSRF) vulnerability in GS108Ev3 firmware version 2.06.10 and earlier allows remote attackers to hijack the authentication of administrators and the product's settings may be changed without the user's intention or consent via unspecified vectors.
CVE-2020-5674
PUBLISHED: 2020-11-24
Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2020-29002
PUBLISHED: 2020-11-24
includes/CologneBlueTemplate.php in the CologneBlue skin for MediaWiki through 1.35 allows XSS via a qbfind message supplied by an administrator.
CVE-2020-29003
PUBLISHED: 2020-11-24
The PollNY extension for MediaWiki through 1.35 allows XSS via an answer option for a poll question, entered during Special:CreatePoll or Special:UpdatePoll.