Lost Files: The Beginning of the Problems

Identity Thievery Programs Enable You To Defend Yourself From Id Theft


Because of the rise of id theft occurrences being reported yearly, many organizations are applying their very own id theft programs to supply citizens education to battle this spiteful crime. Since being a victim of id theft could be a existence-altering experience, both emotionally and financially, understanding how to prevent the appearance of this crime through id theft programs will help you as well as your families live an ordinary and happy existence without another person meddling with your own personal information.

Even though the government has worked night and day to battle id theft, busting these crooks might take many years, or sometimes, they even live their very own lives without having to be caught. Because of this, different private and public banking institutions with id theft programs, like the Federal Trade Commission’s “AvoID Thievery: Deter, Identify, Defend”, are educating individuals to avoid id theft while giving help individuals who’ve victimized.


FTC’s National Id Theft Program

Because the U . s . States has got the greatest rate of id theft compared abroad, the Federal trade commission has worked fulltime to distribute on the internet and print informational materials to make sure all consumers know about this crime. With more than 20 million copies from the information guide distributed, the Federal trade commission id theft program is reaching one household at any given time to lessen the appearance of id theft in the united states.

Private organization which help consumers fight id theft will also be while using Federal trade commission id theft program to empower citizens in protecting themselves from the damages brought on by this crime. The “Deter, Identify and Defend” Program educates people and links with other organizations both in public and private sectors including police force agencies, consumer groups, federal agencies along with other trade associations to provide consumers choices on where to inquire about help.

The Federal trade commission id theft program releases an informational package for those organizations fighting id theft which include a how-to guide with instructions on educating customers to aid organizations facilitate outreach programs. Additionally, it features a sales brochure these organizations can certainly reproduce to provide to individuals who attend workshops and education sessions. To capture the amount of damage id theft may cause an individual’s existence, a ten-minute video of victims can also be incorporated within the program to describe to individuals how you can fight this crime.

While using Federal trade commission id theft program might help other organizations hold workshops and distribute educational materials about fighting id theft. Since education may be the only answer to staying away from this crime, consumers is now able to aware regarding how to identify these complaints and take immediate actions when they be a victim of id theft.



We’re just passed the midway point of the year and if this were our own health report, we’d be failing miserably when it comes to data breach prevention.

According to a recent report from Protenus and Databreaches.net, over 31 million healthcare records were breached in the first six months of 2019.  That is double the amount of 2018.

The information in these breaches was not caught and remediated quickly either.  Patient data was ‘for sale’ and available for manipulation on the dark web for months before being discovered in the American Medical Collection Agency breach.  With a confirmed 20 million records having been affected, the fallout from that will reveal itself in all of the days and months ahead – if not years.

So how did we get here?

Some of these were insider jobs – in fact, 60 of the incidents were a result of that. That means that over 3 million records were exposed because of existing employees.  These aren’t the hackers lurking on the dark web or in airports stealing your Wi-Fi, these are KNOWN actors in a business.  Hacking accounted for 60% of all incidents.  This means that out of 168 data breaches, phishing took down 88 businesses, with ransomware and malware being deployed at 27 of those.

The statistics are staggering, but what is also something to take note of – aside from the revelation that insiders are putting your business at risk – is that it’s not direct healthcare entities that are always responsible.  Yes, providers reported 72% of the breaches, but it was also health plans and business associates that are contributing to the overall numbers.

What does this mean?

It means that we can stand by and watch the numbers continue to elevate, the rate of increase continues to double and triple, or we can rework our approach, attack and react.  We’ve said it before, but every business owner – regardless of the vertical or channel in which they operate, need to say, “It is no longer an option of IF I’m part of a breach, but a matter of WHEN I’m part of a breach.”  Second to this must be the integration of cyber insurance into a business’s arsenal.  Surviving the breach is one thing, but thriving afterward and even during a breach, is another.

The post Halfway Health Check appeared first on HIPAA Secure Now!.


Every day in my newsfeed I’m alerted to yet another compromise to patient information.  The headline isn’t always the attention-grabbing ones that we see when major credit companies or big-box retailers are exposed. These are just listed, one after the other, identifying locations of healthcare businesses, whether it be hospitals or private practice, that have had possible exposures.

If you are part of a private practice or small organization that works in the healthcare industry, you need to be aware: this is happening in your office.  It doesn’t always happen in the huge hospital with thousands of employees, the locations that we assume have less control over such a large employee base.  This is happening everywhere.  The doctor’s office with the same 3 people who have run the front office for years; the dentist you’ve been going to see since you were a child.

Patient data is a coveted treasure among cybercriminals and unless you are taking measures to protect it from end to end, you are at risk.  While working with a trusted IT advisor is critical, you also need to ensure that you are covered if a breach does occur.

Those compromises that are listed in my newsfeed don’t say that patient data was stolen and sold, they merely confirm the fact that it was seen by uncertified eyes.  That means, they don’t know what happened, but they do know that it could pose a problem in the future.  So, in order to protect their business and reputation, they are going to incur the cost of credit monitoring.  What you don’t hear about is the cost of the forensic expert or additional breach resources that were needed even to identify if data was compromised.

Verify that you have a cyber insurance policy to protect you in such an incident.  Without it, your business and its health are at risk of “not making it”.

The post Scrolling Through the Breaches appeared first on HIPAA Secure Now!.

cyber insurance policy


Approximately 25,000 patients are being notified by Adirondack Health that their protected health information (PHI) may have been obtained by a hacker.

Vermont-based Adirondack Health is part of the Adirondacks Accountable Care Organization (ACO). Adirondacks ACO analyses health data for the entire region and is made up of all the Adirondack region’s hospitals.

The Breach

On March 4, 2019, it was discovered that an unauthorized individual had accessed an employee’s email account for two days. After discovering the unauthorized access, Adirondacks ACO began checking every email and attachment in the affected employee’s account, looking for any PHI that may have been accessed.

Adirondacks ACO discovered that two employees had been discussing information regarding patients who had missed a baby wellness exam and other screenings, as part of their population health analysis. The employees were planning to send the information, contained in a “gap-in-care” spreadsheet, to providers so they could determine how to contact their patients.

That’s when an unauthorized individual from outside the U.S. remotely obtained access to the email account. At this time, no evidence suggests that the email was opened by the unauthorized party, however, the possibility could not be ruled out.

The Exposure

The unauthorized access was not due to a phishing attack, and a spokesperson for Adirondack Health stated he does not believe the employee could have avoided it. The spokesperson also stated that policies are being changed as a result of the incident.

Information contained in the exposed spreadsheet includes patients’ names, dates of birth, Medicare ID numbers, health insurance member numbers, as well as limited treatment and/or clinical information. Some patients also had their Social Security numbers listed.

Adirondacks ACO began notifying patients of the breach in early July. 25,000 letters of notification have been sent to affected patients, with only a few remaining.

For patients who had their Social Security numbers listed on the spreadsheet, free credit monitoring and identity protection will be provided by Adirondacks ACO.

The post 25,000 Patients’ Data Exposed in Email Hack appeared first on HIPAA Secure Now!.

Adirondacks Accountable Care Organization

Warning – You’ve Been DataMined!



It impacts vast sums people every day when we’re blissfully not aware.

Today’s high-tech world is drowning in data but is starved for understanding. Data mining is the quest for significant patterns and trends. It is also been known as poor people stepchild to statistcial analysis.

To provide you with a good example you want to target to purchase food and also you make use of your store card for discounts and fast checkout. It provide the store an eye on how frequently you shop, what foods you want and also at what prices within this situation it is a win-win situation. This continues thoughout your entire day while you bank visit the mall, service station, and so forth.

However details are more and more collected without your understanding or consent. “Black Boxes” how big cigarette packs happen to be set up in 40 million vehicles to watch speed, seatbelt use, and much more. Only 5 states currently require the buyer be advised of the fact.


The trade-off is somone has an eye on where and when you drive,your food intake, what over-the-counter medications you purchase,regardless of whether you smoke or otherwise,in which you fly with whom, what you love to read watching and put money into.

Anyone item isn’t invasive however when birth certificates, credit histories, property deeds, military records, and insurance claims are pulled together it paints a really intimate picture. Increase the mix that an average joe is viewed by surveillence cameras 75X each day.


Previously decade a surge of technologies have occurred and also the pressing appetite of marketers for details about consumers makes data collection less voulutary and much more worrisome.

Data mining is very large business. Companies vacuum up data from private and public records, aggragate it evaluate it then sell it to buyers varying from private companies towards the CIA. If the error exists there’s no understanding from you as a result it can not be fixed.

Data thefts are rising incorporated are banks, charge card companies, and also the greatest from the data brokers Choicepoint. When their records were breach they left huge numbers of people prone to id theft.

In conclusion technologies are not going anywhere soon so we love convience but we should be aware and turn into vigilant. In fact it is here we are at Congress to step-up and get the job done to produce a fundamental bill of legal rights for those information. This can give to us necessary protection.


Identity Thievery can there be expect victims?



Among the less popular Id thievery sources originates from none

apart from your charge card company as well as other supply of an information leak and in addition Visa fine processing companies for breaches of security rather of enhancing the affected company improve their security. the majority of the bigger information mill indeed secure however a burglar breach may happen to the most dependable of companies you cant ever be completely protected from Id theft, and also you certainly do not want your a good credit score in danger.

There’s a truly amazing quantity of data breeches each year, from a multitude of sources, for example obtained from The Id Theft Resource Center (a nonprofit organization) backed with a grant provided by the U.S. Department of justice through the Office for that Victims of Crimes, they don’t publish any information that isn’t



Creative works


Here are a few statistics for 2018 of exposed records:


Banking/Credit/Financial final amount of files uncovered-  1,709,013


Business-  415,233,143


Education-  1,408,670


Government/Military-  18,236,710


Medical/Healthcare-  9,927,798


Final amount of records exposed-  446,515,334




You’ve certainly heard of all the firms that promise or perhaps guarantee to safeguard your identity they often include different levels of insurance from $10,000.00 to some awesome million in case your identity is stolen, They’ll pay millions of if you’re able to convince their satisfaction that you simply endured millions of or even more in losses because of the Id thievery but beware some major companies limit their liability to expenses incurred legally or through other services THEY deem as necessary because of the failure or defectiveness of the service, in almost any situation they’ll generally pay only for legal costs or any other charges connected using the failure of the service, the price of these programs varies depending largely the quantity of insurance, so if you choose to use one of these to assist in protecting your identity inspect the guarantee carefully.


Identity thievery basics


Id theft is among the latest buzzword inside our society in recent occasions. Id theft describes hiding one’s original identity and unlawfully misusing another person’s identity. The individual pretending to become another person tries to earn money at the expense of others and bakes an abusive utilization of fake identity. The appearance of this type of crime has elevated partially because of the expansion within our communication network where individuals interact or learn about only the presence of body else but haven’t met them person. Since you don’t recognize your partner by looks it’s simpler for identity thieves to walk into others shoe and gather vital information for his or her own selfish motives. Id theft also occurs from distance if somebody may call or talk to every other person simply to gather some private information after which misuse the information provided.


Emergence of Internet aside from supplying many facilities and as being a blessing for individuals has additionally added a great deal to this already established crime.

With increasingly more business houses using Internet and computerized systems for his or her official workings elevated quantity of significant data are actually available on web. In addition to the acquiring vital statistics associated with a corporate house or any important individual information, identity thieves do disguise to fool others and acquire some information such as the charge card number or even the ssn. Thievery of charge card number and ssn can lead to an excellent loss and trauma for that victim. Because the offender can use the charge card for withdrawing money from others account as well as the crimes committed through the crook could be related to the victim because the crook was utilizing a fake identity of body else.

This growing type of crime has elevated concern of numerous and individuals are actually finding methods to combat such malicious actions that create loss to innocent citizens. Aside from following a general instructions and counting on social systems to avoid such crimes certain individual efforts are also needed to safeguard one from identity thieves. You have to be careful to not provide any private info on Internet or other public communication systems that may be utilized by anybody. Once perfectly confirmed verification some good info might be shared if it is very urgent. Also you ought to not depend on other people without careful verification from the identity of your partner.

It’s dependent on great regret that such identity thieves many a occasions bank upon the sentiments of excellent citizens and fool these to have fast money. Many such installments of false identity happen to be reported in recent past where individuals make believe you be somebody in great necessity of help so when some virtuous person comes forward to assist them to they simply breach others making personal profits at the fee for others.


Lately once the world was struck by a regrettable natural disaster of tsunami the aid of world put in through every means. Government organizations of nations struck with this calamity had set websites to create people conscious of the damages incurred and collect the aid of them when they could lead towards the well-being of victims. Following a genuine websites many fraudulent websites were also located simultaneously to bank upon people’s sentiments for private interests. Such occurrences and many more turn it into a moral responsibility of each and every citizen in the future forward and help in curbing this social crime.


Cyber Security Breach

The motivation behind hackers has evolved noticeably over the last couple of years. Developing harmful viruses is less about “bragging rights” or satisfying the creator’s ego and is becoming more and more about generating profit or commercial return.

The destruction of data on your computer or corruption of programs you use is a common side effect and what people have traditionally associated with a computer virus. The reformatting of your computer “c: drive”, especially at work, and the loss of valuable data used to be an incredibly painful experience.

The widespread deployment of data back up solutions within companies to comply with legislation and other factors means less and less valuable data is now stored on your computer’s local hard drive. More importantly for the virus writer this attack does not generate much tangible profit so there is not much motivation to develop more sophisticated programs to counter improved anti virus applications and corporate network security.

However, there is profit for the virus writer in turning your computer into a spam distribution machine. “Spam” is email sent without the permission of the person receiving the message. Hackers gain control of your computer through a Trojan Horse which gives them the same access rights as the user. Once your computer is controlled by the hacker it becomes known as a “Zombie.” A group of zombie machines is known as a “botnet.”

By controlling a botnet a hacker can generate profit in a number of ways. The botnet can be used to exhort a ransom from a company by threatening launch a damaging “Distributed Denial of Service” (DDoS) attack against its web site. The botnet can also be hired out to other hackers.

The most common way of profiting from a botnet is to use it to send out spam email. According to the security software company Sophos over 50% of all spam email now originates from botnets. Hackers use spam email to drive traffic to pay per click advertising sites or distribute virus programs further. Using a zombie computer helps cover their tracks.

The drive for generating profit is clearly evident in a new form of virus dubbed “Ransomware” by security experts which started to appear in 2005. Ransomware, as the name suggests, holds data on your computer “hostage.” Files on your hard drive are encrypted with a password. The user is then contacted and asked to pay a ransom to release the file.

Here are some simple tips and strategies to help prevent your computer turning into a “Zombie.”

• Keep your computer up to date with the latest software patches for Windows and other Microsoft programs. Most viruses and other malware exploit vulnerabilities in widely used programs.
• Install a reputable anti virus program. Keep the definitions up to date and scan your computer regularly.
• Install a personal firewall or buy a router with a hardware firewall. Ideally you need a firewall solution which filters both incoming and outgoing traffic from your computer to the internet.
• Never open spam email or associated email attachments which is frequently used to distribute virus programs. Use a spam filter to help reduce the amount of spam you receive.



Quest Diagnostics, one of the country’s biggest blood testing providers announced upon Monday that nearly 12 mil patients may have had their delicate information compromised in a data break.


The breach happened at one of Quest’s billing selections vendors, American Medical Collection Company (AMCA). Quest was notified upon May 14, that between September 1, 2018, and March thirty, 2019, an unauthorized individual got access to AMCA’s systems.


The information stored on AMCA’s techniques which may have been compromised includes economic information, medical information, and other personal data (such as Social Security Numbers). Lab test results were not available by AMCA, therefore were not affected in the breach.


Comprehensive information regarding the breach has not however been provided to Quest.


“ Quest is using this matter very seriously and it is committed to the privacy and safety of our patients’ personal information. Since understanding of the AMCA data security event, we have suspended sending collection demands to AMCA, ” the company mentioned.


The post Quest Diagnostics Data Break the rules of Could Impact Nearly 12 Mil Patients appeared 1st on HIPAA Protected Now! .

Data Breach


We previously wrote an article about the ransomware attack striking a Michigan doctor’s office, leaving their patients with no medical records and leading the practice to closure. This article is intended to provide professional insight into the liability of the practice despite its decision to close its doors.

The following blog was written by Matthew Fisher, Chair of Health Law Group and a Partner at the law firm of Mirick O’Connell where Matt focuses on guiding practices and companies through the labyrinth of healthcare regulations.

A two physician practice in Michigan recently drew significant attention for deciding to unexpectedly close after losing all of its patient and billing records.  In brief, the practice suffered a ransomware attack that blocked access to all files.  The attackers demanded a ransom of $6,500 to restore access.  The physicians refused to pay the ransom (a response that in isolation is not a bad one).  The publicly stated reason for not paying is that the physicians could not receive a guarantee that the attackers would actually restore access.  When the ransom was not paid the attackers deleted all of the files.

The expected next step would be for the practice to pull out one of hopefully many backups, restore all files up to the point of the backup, and then continue on its way.  Since this particular practice made the headlines, that usual course outcome did not happen.  In this particular instance, the physician practice did not have a backup (or at least none that has been reported) and declared that all of its files were lost.  As a result of not having any files and not wanting to take the time to restore the practice, the physicians provided roughly thirty days notice of the practice shutting down entirely.

Will closure of the practice be the end of the story?  Unfortunately, the physicians likely may only hope that closure ends the entire story.  In all likelihood, this practice could help set precedent for future claims in the event of a catastrophic outcome from a ransomware attack.

Finding one silver lining may be a good way to approach the assessment of potential liability.  Instead of shutting down immediately, as noted above, the practice provided slightly over thirty days advance notice of the closure.  Giving patients thirty days to find a new physician is consistent with the suggested course of action contained in model ethical guidelines.  The ethical guidelines look to provide a patient with sufficient or reasonable time to transition and that the physician terminating the relationship continue to provide care during the transition period.  The thirty days here may be enough for that to happen.

Now for the potential liabilities.  If all records have been lost, then the practice will clearly not be able to respond to any patient’s request for access under HIPAA.  Failure to respond to a request for access is one of, if not the, most common types of non-compliance with HIPAA.  When access is denied, many individuals will submit a complaint to the Office for Civil Rights.  In this case, the entire patient population of the practice could theoretically submit such a complaint.  Given the total breakdown, could the loss of all records be the spur for OCR to issue the first fine for a denial of access?  It is possible, especially since OCR has used settlements in the past to provide lessons about key issues of HIPAA compliance.  For example, OCR could point not only to the need to fully respond to a request for access, but fault the practice for not having a disaster recovery and backup plan, and very likely for not having done a risk analysis.

A second area of potential is malpractice related claims.  A patient could assert an adverse outcome from a procedure or service and the physicians would be without records to defend against the claim.  Malpractice claims can rely heavily upon pouring through medical records to piece together exactly how care was provided and to assess the quality of care provided by the physician(s) who are the subject of the claim.  If no records exist, then how can services be assessed?  Unless some supporting records could be found from another facility, it could leave the physicians severely handicapped in their ability to produce any sort of defense.

A third potential liability could arise from claims brought by patients in repeat care is not covered by insurance and/or a patient is forced to pay out of pocket due to being in a deductible range.  Since all of the records are gone, tests will very likely need to be repeated to obtain relevant and needed information.  While the practice may not have the records, each patient’s health insurance company will certainly have a record of a claim being submitted for the service and in all probability the claim being paid.  While the health insurance company may be made aware of the record loss, a natural response from insurance would be that it will not cover the service again because it will then be forced to pay for the failure of the physician practice.  Alternatively, even if insurance is willing to cover the service again, a patient could have a high deductible health plan or other form of coverage where that patient will need to pay out of pocket for the service.  In either scenario, whoever pays for the service could look to the physicians who lost the records and seek to make them pay for the unnecessary repetitive services.  The argument would flow that the loss of records was the direct cause of the repeat service being needed and that any financial harm should fall on the causative actor.

While those are only three potential liabilities, each possibility could easily occur.  A natural response could be for the physicians to seek liability insurance carriers for the practice to cover any damages.  Without being able to get into the exact specifics of the case, the insurance carriers could seek to deny coverage.  If the practice was negligent in protecting its records, was not fully accurate in filling out an insurance application, or took other steps not called for by the insurance policy, then coverage could be denied.  As such, the physicians could easily be fully on the hook for any resulting damages.

While no data breach is good, when extreme outlier cases arise the outcomes become even worse.  While it is too late for the particular practice in Michigan to change the outcome, the total loss of data should be a wake up call to other practices and organizations that good, comprehensive security is essential.

Is Your COMPANY's Data on the Dark Web, Find out TODAY!!!


Copyright © 2015 - 2018 Sentree Systems, Corp.. All rights reserved.

Sentree Systems, Corp. | 6137 Crawfordsville Rd Ste F #177 Indianapolis, IN 46224 | 317-939-3282