HIPAA Case Study #77 Premera Blue Cross Sept. 25, 2020

Case Study #77

Premera Blue Cross

$6,850,000

Sept. 25, 2020

Trigger

Premera Blue Cross is a large health insurer in Washington and Alaska
Hackers use email phishing attack to install malware and gain access to Premera computer systems
The hackers were undetected for 9 months
Investigation finds that Premera has not done a risk assessment

Key Highlights

A few snippets from case documents

Legend

HIPAA Police are variously referred to as "OCR", "HHS-OCR" or just "HHS"

Patient Data is called "ePHI" or "PHI" or electronic Protected Health Information

HIPAA Rules are written in the "C.F.R." or Code of Federal Regulations

Hospitals, insurers, pharmacies, practices, labs, associates.. who must obey HIPAA are called "Covered Enitites"

HIPAA Rules that have been violated are called "Covered Conduct"

Chief of the HIPAA Police is usually called "OCR Director"

Comments & Questions

Cyberattacks on healthcare companies are hugely expensive in several ways
These case documents are going deeper into computer security lingo:
quote: "This undetected cyberattack, otherwise known as an advanced persistent threat ..."
Email is still a threat vector!?!? Seems like modern enterprise architecture and firewalls ought to prevent this sort of attack - partition the email system from the EHR patient data
quote: "...hackers used a phishing email to install malware that gave them access to PBC’s IT system..."
It took 9 months to discover the hackers were in the system- is this a case where there are so many users that it is hard to detect hackers?
Making sense of the fine amount:$6.85m / 10.4m patients records exposed = $0.66 each
Are any of "The Blues" - Blue Cross Blue Shield - companies using modern tech / architectures? Send your comments to me at bert@clinicnerds.com
Eventually I'll stop being surprised by the fact that a large healthcare company hasn't done a risk assessment. Are the IT resources stretched too thin? Did the IT people request the resources but were denied? Is there a shortage of IT security people? Email me at bert@clinicnerds.com if you have thoughts.

Lessons

Conduct and document an enterprise-wide risk assessment
Encrypt all computers
At least once a month, somebody needs to look at audit trailor access logs
Dir Severino with a clever turn of phrase:
quote: “If large health insurance entities don’t invest the time and effort to identify their security vulnerabilities, be they technical or human, hackers surely will.” said OCR Director Roger Severino.
These cases drag on for years -it started March 2015; was settled Sep 2020; then Premera was on probation for 2 years
One of the jobs of the the HIPAA Specialist is to documentthe policies and procedures for things like encrypting all computers
If it isn't documented, then it didn't happen- I recommend a HIPAA Notebook
Talk about HIPAA policies and procedures at the monthly team meeting

Keyword Tags