Emails landed in the inboxes of employees at several Massachusetts hospitals, seeking COVID-19 statistics for the Department of Health and Human Services. 

On the surface, the notices seemed innocuous, a chance to assist in the fight against the devastating coronavirus pandemic. Except for this: The emails were a hoax — and a dangerous one at that, according to a report in the Boston Business Journal. The phishing emails sought illegal access to the hospitals’ systems. Such emails — which often seem work-related, credible and innocent — can ultimately compromise data, lock down hospital systems and potentially disrupt patient care. And they also can endanger the job security of employees who fall victim to such schemes.

With the recent barrage of cyberattacks, federal agencies have urged extreme diligence, particularly at health care facilities. While attacks against other industries jumped 22 percent between Nov. 1 and the beginning of January, attacks against global healthcare organizations surged 45 percent, according to a report by Check Point Software Technologies Ltd. The average number of weekly attacks against each healthcare organization: 626, up from 430 in October.

Closer to home, the Sonoma Valley Hospital shut down its systems upon detection of an October ransomware cyberattack that targeted dozens of hospitals nationwide. Such attacks seek to encrypt and lock down systems, saying they’ll return the information only if paid.

The incidents put businesses and employees in awkward situations — self-reporting helps tremendously, but employers also struggle with whether workers need to be disciplined for not exercising more caution. Couple that with the fatigue and stress of pandemic-disrupted work environments and caring for COVID-19 patients, and employees have their hands full. 

The best way to stay out of trouble is to avoid falling for cyberattack schemes in the first place. Here are some tips:

• Be suspicious of any links in emails. Cyberattacks have become more difficult to spot, often masquerading as potentially important or very innocent notices. Requests for personal information likewise should put you on guard. If in doubt, separately email someone who would know whether the request or link was legitimate before clicking or responding in any way.
• Be extra careful on weekends and holidays. According to Check Point, ransomware attacks have concentrated on times with lighter IT and security staff.
• Follow all protocols from your IT staff. If you’re supposed to shut down your computer every night, do so. If you’re supposed to perform any updates that pop up, do so — even if it delays your work a bit.

Even the federal government has been so concerned about cybersecurity risks that it recently transferred oversight of the .gov domain from the U.S. General Services Administration to CISA, citing a desire to make the domain more secure and to keep “malicious actors” from impersonating it. 

If you’re coping with a difficult work situation and need a skilled advocate, Keller Grover offers free consultations to advise workers about their specific situations. In more than 25 years litigating fraud and employment cases, the lawyers at Keller Grover have recovered hundreds of millions of dollars for clients and class members.

 

Despite concerns about potential privacy issues, multiple states have been moving ahead with apps designed to alert people who may have been exposed to COVID-19 — a technology-based tool in the fight against a pandemic that has claimed more than 212,000 U.S. lives.

Roughly a dozen states have released contact-tracing apps, according to an Oct. 1 report by The New York Times. California was not listed among the states, though some localities are pursuing such apps. And Google said on its blog that U.S. states and territories representing about 45 percent of the population were exploring Exposure Notification System-based apps. But many worry that the apps may be sacrificing too much privacy for too little reward.

Notably, the apps are voluntary, typically requiring an adjustment to phone settings. Such apps can work through either location tracking, which relies on GPS and cell site data, or proximity, which uses Bluetooth technology to anonymously determine phones that have been within a particular range of each other for a specified time period.

Apple and Google have changed their smartphone operating systems so developers can create proximity tracing apps; the tech giants say personal health details and locations aren’t collected. Only public health authorities can use the system, according to Google. If someone gets a positive test result, that person can input the result using a unique authentication code, according to the Times. Those who opted to use the app and had their phones in close proximity with a “positive” phone would get an automatic notification.

Despite safeguards, it’s hard to predict the potential privacy side effects of contact-tracing apps. HIPAA and the FTC offer some protections; some argue that the country needs a comprehensive privacy law. Personal data can be incredibly valuable. Various concerns include:

• Proximity data may overestimate exposure because it doesn’t account for factors such as whether the people were wearing masks, were outside, the length of time they were near each other, and other potential variables — unless data collection gets more personal.
• Pandemic-related scams and spear phishing have jumped, and some worry that such apps could open new doors for fraudsters. Others wonder whether such apps could be taken over and repurposed.
• Congress members have offered several bills related to COVID-19 privacy. There is concern about how data will be stored/handled, whether it will be used solely for COVID-19 contact tracing, how long it will be tracked, limits to what could be tracked, whether it poses risk of overreach, and how long it will be kept — issues similar to those that arose relating to post-9/11 measures.

Ultimately, the efficacy of contact-tracing apps may be limited by Americans themselves. According to a Washington Post-University of Maryland poll earlier this year, almost 3 in 5 Americans are “either unable or unwilling” to use the Google-Apple alert system. Seniors, who face higher risks related to COVID-19, own fewer of the necessary smartphones compared with rates for the rest of the population. Many others don’t trust tech companies to keep health data private, the poll found.

This is an evolving issue as we head into winter; we’ll keep you posted.

Awareness of your rights helps you protect them. If you think your rights have been violated, we offer free consultations. In more than 25 years litigating fraud and employment cases, the lawyers at Keller Grover have recovered hundreds of millions of dollars for clients and class members.

Related:

• It’s up to you: More privacy protections likely to reach November ballot
• Coronavirus and your rights: Balancing protection and privacy
• Coronavirus and your job: 8 FAQs about your rights at work 
• New California laws draw more privacy lines around consumers 

Cyber threats have business risk management experts more nervous than ever before a pair of new surveys finds. For employees, this indicates the need that increasing numbers of employers take seriously their responsibility guarding personal information, but it also means the threat has grown. 

Heading into 2020, 39 percent of risk management experts responding to the Allianz Risk Barometer ranked cyber incidents as the most important business risk globally — for the first time pushing that concern ahead of worry about business interruption. Similarly, 30 percent of HR professionals said they felt “extremely challenged” about cyber security issues, according to an XpertHR survey. 

In our increasingly connected world, data breaches have become more frequent, sophisticated and severe, the Allianz report noted. As well-known brands grapple with significant breaches, millions of customers can be affected for years.

The best way to protect yourself is to be vigilant. If you have been harmed by poor business practices — or suspect that a business is playing fast and loose with personal info — we’re here to help. 

California offers some of the greatest protections for consumers in its California Consumer Privacy Act. It’s key to note that the act doesn’t differentiate between your role as an employee and your role as a consumer. While national law on this topic can be somewhat fluid, what’s clear is that when you provide the numerous, sensitive amounts of personal data required to get a job and get paid — or to even look at a website sometimes — you should be able to trust that such valuable information will be handled with care.

Our attorneys help protect your rights, including your fundamental — but increasingly complex — right to privacy. If you need help understanding your legal options and protections in this area, contact Keller Grover for a free consultation. In more than 25 years litigating fraud and employment cases, the lawyers at Keller Grover have recovered billions for clients and class members. 

See more that we’ve written about California privacy laws.

While HIPAA Journal has reported an ascending trend over nearly the past decade in healthcare data breaches, 2019 has seen the industry reporting record numbers.

A historic number of records have been exposed daily, trending at a rate of one (occasionally even two) data breaches per day. The resulting 31.6 million healthcare records breached from January 2019 to June 2019 is double the number exposed for all of 2018. 

Since then July and August claimed gold and silver medals, respectively, for the worst months in history for healthcare data breaches; and September reported an increase of 168 percent from the month prior in healthcare records compromised, despite a decrease in breaches.

The sheer volume is staggering and puts healthcare organizations at risk of potentially substantial fines if the data breaches result in HIPAA privacy rules violations.

But what does it really mean for individual patients who have been impacted?

In a recent study on the types of information compromised in healthcare data breaches, of breaches analyzed, researchers found that:

• 66 percent exposed sensitive demographic information including Social Security numbers, dates of birth, and driver’s licenses numbers.
• 71 percent exposed demographic or financial information including payment data.

According to the study the largest risk for compromised individuals is having their data used by hackers to commit fraud or identity theft. In fact, only 16 percent of breaches included in the study exposed medical information without compromising demographic or financial data.

This risk assessment is particularly noteworthy as during the first half of this year hacking incidents accounted for 60 percent of all incidents and 88 percent of breached records according to the 2019 Mid-Year Data Breach Barometer Report.

These findings reiterate an important aspect of cybercrime for the average person that our firm has previously covered – majority of data breaches are financially driven.

Although considerable reporting on 2019 breaches center on the overwhelming industry total, focus of the significance ought to be on the individual level – the type of information that is being targeted and the motivation for accessing it.

Healthcare providers and third parties should take precautions to safeguard your sensitive data and have legal obligations to do so. However, with an industry-targeting trend this substantial its valuable to take steps yourself to help keep personal data secure.

Below are new and previously shared cybersecurity tips, some from Verizon and some from cybersecurity companies Norton and McAfee.

• Update your anti-virus and other software regularly.
• Vigilantly and frequently check your bank account and credit activity.
• Be smart about passwords. Make sure they’re strong, don’t use the same one on every site, and change your passwords regularly. Password management applications can help.
• If you have an account with an organization that has been the victim of a big security breach, change your password and find out what information could be at risk. If you suspect data was compromised, place a fraud alert on your credit to ensure new or recent requests undergo scrutiny.

Has your privacy been violated? Contact Keller Grover for a free consultation. During more than 25 years of litigating, the lawyers at Keller Grover have secured billions for their clients.