As a solo provider running a private practice I take the protection of my patient’s protected health information seriously. Security checks are part of my every day operations, including daily software updates. I believe in holistic healthcare and educate my clients on scams and everyday dangers routinely. With over two decades in the field as a doctorate level licensed provider, and over five years of experience as a HIPAA Compliance Officer for small non profits to organizational departments with over 6000 patient files, I knew what to keep safe. I also believed I knew how to keep it safe.
I was wrong. Not only did my software and vigilance not hold up against the attack, the embedded malware was running in the background of my desktops, laptops, and cellphones for over three months. When I realized I had experienced a breach (due to $10,000 in bank transfers), I turned to the big name companies I had relied on for anti-virus monitoring, VPN services, routine full scans, notifications of any recent new threats or scams out there targeting small businesses or individuals, and other services. They denied I had any malware on my devices, and worse, when I asked them for support they said all they could tell my bank, or the agencies I have to report the breach to, that I must have fallen for a phishing scam or bribery.
To stop the active break, I had to remove power to all devices with any history of access to any patient related account, or the wifi at the home or office. As I was scrambling to replace my hardware, find a way to safely contact my patients, and restore some vestige of privacy in my own home, someone suggested I look at a Cyber Security firm that focused on safety for small businesses with enterprise grade software and live monitoring. Enter Strafe Cyber.
Even though my account of the incident seems implausible, and I had limited understanding of how this incident began, the employees listened to everything I had to say. They came up with a plan to help me identify what was causing the issues while protecting my new hardware so I could contact my patients and re-open the office safely. Within 24 hours they had isolated a piece of the malware code and provided me with a notification I can use to show the bank, investigating agencies, and my liability insurance company that I wasn’t lying, or having a really serious ongoing psychotic deviation from reality.
As a provider, I am Covered Entity. A Covered Entity is responsible for protection of the data at the same legal and ethical enforcement levels no matter how many patients they have. 1 or 100,000. And if you’re a 1099 contractor with a large online mental health provider, you signed a contract taking responsibility for anything that happens to PHI on your computer, phone, or other device. “I tried” or “I didn’t know” offers about as much protection as a wet paper bag.
Be aware, be protected, and if you don’t contact Strafe Cyber, at least contact your liability insurance company and bank to make sure the software you are using is enough to prove you are not at fault in a data breach or financial fraud event. As a business, you are not insured by the FDIC. If you’re using a smaller bank or credit union, they may not have the software needed to detect fraud. That’s a whole other problem for another rant.
Protect yourself. Protect your patients. Do it now, before you have to write 132 letters and file a report on yourself with the federal government for a HIPAA Breach. The impetus is on you, the provider, to prove you took all the precautions you could. Look it up on the federal government website for HIPAA. Don’t rely on what your last supervisor told you.
