PRIVACY & SECURITY: COORDINATING ACTIVITIES WITHIN ACADEMIC MEDICAL CENTERS SPEAKERS & HEALTH SYSTEMS / AMCS David Behinfar, JD, LLM, CHC, CHRC, CCEP, HCISPP, CIPP/US Chief Privacy Officer UNC Health Care System Colleen Ebel, Chief Information Security Officer UNC Health Care System SPEAKERS & HEALTH SYSTEMS / AMCS  Terry Ziemniak Assistant Vice President and Chief Information Security Officer Carolinas Healthcare System WWW.LINKEDIN.COM/IN/TERRYZIEMNIAK SPEAKERS & HEALTH SYSTEMS / AMCS • The University of Arizona is the leading public research university in the American Southwest. • University of Arizona Health Sciences (UAHS) is comprised of five academic colleges:  College of Medicine-Tucson  College of Medicine-Phoenix  College of Nursing  College of Pharmacy Katherine Georger, JD, CHC, CHRC, CIPP/US  College of Public Health HIPAA Privacy Officer • Affiliation agreements with two The University of Arizona healthcare partners: • Banner Health (Banner University Medicine) • Dignity Health d/b/a St. Joseph’s Hospital & Medical Center (UA Cancer Center) THE IMPORTANCE OF BUILDING A COLLABORATIVE RELATIONSHIP BETWEEN INFORMATION SECURITY AND PRIVACY IN AN ACADEMIC MEDICAL CENTER OVERVIEW  Recent Breaches and Implications for AMCs  AMCs: Big Data Research and Quality Improvement Activities  Unique challenges for Privacy and Security Offices  Importance of Shared Core Values  Case Examples NON HEALTHCARE ENTITY AND HEALTHCARE ENTITY BREACHES  Yahoo (500 million accounts) possible state sponsored attack lead to data theft of names, email address, contact information and security questions/answers (Sept 2016)  America’s JobLink (4.8 million users) ‘code misconfiguration’ lead to unauthorized access to full name, birth dates and Social Security number (3/12/2017)  Internal Revenue Services (700,00 records) “Get Transcript” online application was hacked. IRS thinks “identities were stolen to file fraudulent tax returns in the future.” (2/29,2016)  Banner Health (3.7 million individuals) was breached by attacker by means of their point of sales devices (7/13/2016).  Newkirk (3.3 million BCBS customers) attacker gained access by means of an administrative portal on third party application (8/5/2016)  21st Century Oncology (2.2 million records) cyber intruder accessed database (3/4/2016)  HHS/OCR Wall of Shame May 1 – May 9 2017.  16 reported breaches  31,250 records ACADEMIC MEDICAL CENTERS/UNIVERSITY BREACHES IN THE NEWS…  Feinstein Institute for Medical Research (stolen unencrypted laptop 13,000 subjects) failed to conduct an accurate and thorough risk analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI $3.9 million (3/17/16)  UMass Amherst (malware infected workstation impacted1,670 individuals) UMass failed to designate all of its Health Care Components when hybridizing, incorrectly determining that SLH Center where the breach of ePHI occurred, were not covered components. $650,000 (11/22/2016)  University of Mississippi Medical Center (password protected computer stolen from ICU 10,000 individuals) OCR found that UMMC was aware of risks & vulnerabilities dating back to 2005, but no significant risk management activity occurred until after breach. $2.75 million (7/25/2016)  Oregon Health & Science University (unencrypted laptop (4,022) , unencrypted thumb drive or cloud (3,044)) Found widespread vulnerabilities in HIPAA compliance program. Students/residents used unencrypted thumb drives or cloud-based solution without a BAA. Plus 2 large breaches 2009 & 2012 (unencrypted laptop, unencrypted thumb drive impacting 15,000 patients). $2.7 million (7/18/2016)  University of Washington Medicine Failure to implement policies to prevent, detect, contain, and correct security violations. Employee downloaded email containing malware – affecting 90,000 individuals/patients who had their ePHI accessed. Underscores need for organization-wide risk analysis. $750,000 (12/14/2015)  New York Presbyterian/Columbia University (disclosure of ePHI of 6,800). NYP & CU are separate covered entities participating in an affiliation $4.8 million (5/7/2014) Two years later, NYP paid another $2.2 million (4/21/2016) for the unauthorized filming of two patients.  UCLA Health Between 2005-2008, unauthorized employees repeatedly access patient PHI. $865,000 (7/11/2011). July 2015 announced breach impacting approximately 4.5 million patients; November 2016, UCLA investigating similar claims of staff snooping in Kanye West’s records. RECENT DATA BREACH STATISTICS – HEALTHCARE • “The healthcare industry is being hunted and hacked by the elite financial criminal syndicates that had been targeting large financial institutions until they realized health-care databases are more valuable,” said Tom Kellermann, chief cybersecurity officer at Trend Micro Inc. http://www.bloomberg.com/news/articles/2015-05-07/rising- cyber-attacks-costing-health-system-6-billion-annually • Medical records, which often contain Social Security numbers, insurance IDs, addresses and medical details, sell for as much as 20 times the price of a stolen credit-card number, according to Dell SecureWorks, a unit of Dell Inc. http://www.experian.com/assets/data-breach/white- papers/2015-industry-forecast-experian.pdf https://www.forbes.com/sites/danmunro/2015/12/31/data-breaches-in-healthcare-total- over-112-million-records-in-2015/#47a9cabd7b07 DATA BREACH STATISTICS