REMINDER: Renew your Drone Registrations

By Kathryn Rattigan on Posted in Drones

The Federal Aviation Administration (FAA) issued a reminder this week for all those whose drone registrations expire next month. If an individual or business registered a drone directly with the FAA through its DroneZone, you should log into your account to renew your registration. If you registered using a third-party service, you should contact that company to request DroneZone login credentials or create a new account and obtain a new registration.

The DroneZone (and its registration processes) was established in January 2018 and granted three-year registrations for $5. Remember that the FAA requires all drones to be registered, except those that weigh .55 pounds or less and are flown exclusively under the Exception for Recreational Flyers.

Check out the DroneZone here.

Walmart’s COVID-19 Testing by Drone Pilot Program

By Kathryn Rattigan on Posted in Drones

If you live within a one and a half-mile radius of the east side of the Walmart store in El Paso, Texas in a single-family home, within a one-mile radius of the North Las Vegas Walmart store in a single-family home, or within a one-mile radius of the Cheektowaga, New York Walmart store, then you are eligible to take part in the COVID-19 testing delivery-by-drone pilot program. It works like this: A drone drops off a testing kit with a self-administered nasal swab; the patient then ships the sample to Quest Diagnostics using a pre-paid shipping envelope. The results are provided to the patient online.

With the rising number of COVID-19 cases in these areas, the hope is to provide more testing and accessibility.

This program is available only while the supplies last. It is offered Monday through Saturday from 9:30 a.m. to 4:30 p.m. and Sunday from 10 a.m. to 4:30 p.m. This is yet another example of drones potentially increasing efficiency and improving accessibly for health care.

Privacy Tip #260 — Don’t Fall for the Worrisome Termination Email Sent from Your Boss

By Linn Foster Freedman on Posted in Cybersecurity, Privacy Tips

Just as ending a relationship with an email or a text message is bad form, employers don’t usually terminate employees with an email. Nonetheless, since a message that appears to address a termination is so drastic and final, it is hard to resist opening it, if only to see if your severance  is mentioned in the email.

Hackers know that we are curious by nature, so they have created a new phishing scheme to take advantage of that to get into a target company’s networks. The scheme works like this: an email is sent to an employee from an authority in the Human Relations department stating that the individual has been terminated. An attachment to the email provides further information about the termination and the severance payout, which appears to be on Google Docs. When the victim clicks on the attachment, they are directed to a fake Google Docs page and told to click on another link. When they click on that link, they are directed to a URL to download a file.

To make the download look totally legitimate, a fake security pop-up is presented to the user asking if the user is sure s/he wants to download the file. We’ve all seen those—that is good security. That security pop-up would not be included if it were a malicious email, would it? Yes, that is what they want us to think. When the user is lured into clicking on the file, the user unknowingly downloads either a Bauer loader malware or a Bazar backdoor. Bauer has been used to deliver ransomware such as Ryuk and the Bazare backdoor attempts to gain access to networks. This information is all thanks to the invaluable research done by Area 1 Security researchers.

 Tips to take away:

  • Be wary of termination emails—if you receive one, it is probably fake
  • If you really are terminated, Human Resources will get in touch with you one way or the other
  • Continue to be vigilant about phishing schemes and spoofing campaigns using executives’ identities
  • Think twice before you click or say “I agree”
  • Don’t open any attachments or click on any links that you are not expecting

Pick up the phone to confirm suspicious emails, links or attachments.

OCR Settles Another Right-of-Access Initiative Case

By Linn Foster Freedman on Posted in Health Information Privacy, HIPAA and Health Information

The Office for Civil Rights (OCR) issued a press release on November 12, 2020, announcing that it had settled its eleventh enforcement action in its HIPAA Right-of-Access Initiative. The settlement with Dr. Rajendra Bhayani, an otolaryngologist (ENT) practicing in Regal Park, New York, included a payment of $15,000, a corrective action plan and two years of monitoring by the OCR.

The facts behind the case are these: In September 2018, the OCR received a complaint from a patient alleging that Dr. Bhayani failed to provide her with access to her medical records after she requested them in July 2018. Following the complaint, the OCR provided technical assistance to Dr. Bhayani regarding compliance with the right-of-access requirements and closed the case. Similar to other recent settlements with the OCR, the patient lodged a second complaint, alleging that Dr. Bhayani still had not provided her with access to her records, and as a result of re-opening the file, the OCR “determined that Dr. Bhayani’s failure to provide the requested medical records was a potential violation of the HIPAA right of access standard.” Following the investigation, the patient received a copy of her medical records in September 2020.

According to OCR Director Roger Severino, “Doctor’s offices, large and small, must provide patients their medical records in a timely fashion. We will continue to prioritize HIPAA Right of Access cases for enforcement until providers get the message.”

Providers, the message is clear: carefully follow HIPAA’s right-of-access requirements.

Q3 Coveware Report: Unsettling Update on Ransomware

By Linn Foster Freedman on Posted in Cybersecurity

We spend a lot of time reporting on ransomware because we are seeing more incidents than ever before, and our readers comment that keeping them up to date on ransomware tactics is helpful. The ransomware gangs, strains and vectors are constantly changing, so it is very challenging for companies to keep up with their latest tactics.

The Coveware Quarterly Report is one resource that is very helpful in understanding the newest methods and successes of ransomware attackers, and Coveware’s Third Quarter Report was recently released.

The Report confirms what we are seeing in the field, and confirms how the landscape is changing. The big news is that the Maze group has allegedly dispersed, with some members joining others. Maze wreaked havoc last year, when it started exfiltrating data from victims before it dropped the ransomware and then threatened to publish the data if the company didn’t pay.

The Report is a must read, but here are some highlights (depressing as they are):

  • There is no guarantee that if you pay the ransom to delete data that they will actually delete it or that they will not come after you again. (They are criminals, after all). In Q3, exfiltration of data before the introduction of ransomware doubled, and half of all ransomware attacks included exfiltration of data. These are not promising statistics.
  • Although Maze is allegedly out of business, others have copied its tactics forexfiltrating data, including AKO, Ranzy, Netwalker, Mespinoza, Conti, Sekhmet, and Egregor. Egregor is believed to have inherited Maze. Sodinokibi has re-extorted victims after they have paid the ransom.
  • Some gangs provide fake proof that they have your data to get you to pay.
  • There is no guarantee that the exfiltrated data will not be sold to other groups.
  • Ransom demands are increasing.
  • The biggest ransomware threats in Q3 were Sodinokibi, Maze, Netwalker, Phobos, and DoppelPaymer.
  • Wasted, Nephilim and Avvadon made it into the top 10 list of market share of ransomware variants.
  • More than 50 percent of all attacks are successful through attacks on Remote Desktop Protocols (RDP). Coveware sees this method of attack as the most cost-effective way to compromise organizations and stresses the importance of properly securing RDP connections.
  • Almost 30 percent of attacks see the ransomware distributed via phishing emails, which have steadily increased since late 2019.
  • The average ransom payment in Q3 was $233,817, up 31 percent from Q2 2020.
  • The median ransom payment in Q3 was $110,532 up 2 percent from Q2 2020.
  • Ransomware is a disproportionate problem for small and medium-sized businesses—those with a median of 168 employees—which is up 68 percent from Q2 2020.
  • Most victims of ransomware have less than $50 million dollars in annual revenue.
  • Professional service firms, especially small ones such as law firms and accounting firms, are especially vulnerable.
  • The average number of downtime days of victimized businesses is 19 days.

These statistics are ones to pay close attention to and use when determining risk management priorities. It is clear from the Report that addressing RDP and employee education as top priorities makes sense. According to the Report, one possible reason for the increase in the use of RDP is “that the influx of remote and work-from-home setups using RDP and other remote technologies allowed threat actors to leverage attack vectors that previously didn’t exist.”

As coronavirus cases increase again throughout the U.S., remote working appears to be the norm, so ransomware attackers are using, and will continue to use, the shift from the office to the home to attack victims.

Campari Hit with Ransomware Attack

By Linn Foster Freedman on Posted in Cybersecurity

Campari, the Italian drinks company, recently announced that it was hit with a cyber attack that encrypted its data and potentially exfiltrated some data.

According to Campari, “We are still investigating the attack and…determining to what extent there has been any loss of confidentiality. At this stage, we cannot completely exclude that some personal and business data has been taken.”

OCR’s Tenth Right to Access Settlement Is Small but Meaningful

By Linn Foster Freedman on Posted in Enforcement + Litigation, HIPAA and Health Information

The Office for Civil Rights (OCR) recently settled a tenth case under its right-to-access initiative with California-based Riverside Psychiatric Medical Group (RPMG), for $25,000.

Although a relatively small settlement in the amount paid, it shows that the OCR is taking patients’ requests for access to their medical records seriously, and that no complaint is too small to investigate and enforce.

In this case, the patient complained to the OCR in March of 2019 that she had made multiple requests for her records from her provider, but never received the records. Following the complaint, OCR provided technical assistance to RPMG and closed the case. However, when the patient still did not receive he records, the patient filed a second complaint with the OCR.

The OCR reopened its file (which is never a good thing after technical assistance and a closing of a case) and launched a subsequent investigation. That investigation found that RPMG’s failure to respond to the patient’s request was a potential violation of HIPAA.

In defense of the failure to provide the patient access to her records, RPMG alleged that it was not required to produce psychiatric records under HIPAA, which the OCR admitted is true. However, the OCR stated in its press release “[W]hile the HIPAA Rules do not require production of psychotherapy notes, they do require covered entities (1) to provide requestors a written explanation when it denies any records request in whole or in part, (which RPMG did not do), and (2) to provide the individual access to his or her medical records other than psychotherapy notes (and information compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative action of proceeding).”

RPMG sent the patient all of her records, except for psychotherapy notes in October 2020.

If you haven’t figured it out yet, when the OCR said that patients’ access to their records was a priority for enforcement in 2020, this tenth case shows that it is serious, no matter how small the entity or the request. It is also clear that the OCR will only give you one chance for technical assistance. Tread carefully when responding to patients’ request for access to their records with these settlements as guidance.

The Effect of a Biden-Harris Presidency on Privacy in the U.S.

By Kathryn Rattigan on Posted in Data Privacy

How will a Biden-Harris presidency affect the U.S. privacy landscape? Let’s take a look.

Federal Privacy Legislation

On both sides of the political aisle there have been draft proposals in the last 18 months on federal privacy legislation. In September, movement actually happened on federal privacy legislation with the U.S. Setting an American Framework to Ensure Data Access, Transparency and Accountability Act. To read the bill, visit https://www.billtrack50.com/BillDetail/1242877.

With a Biden-Harris administration, there is potential for continued movement on federal privacy legislation. This movement would likely come from Congress since both the Republicans and Democrats have previously supported (and are pushing for) privacy bills.

E.U.-U.S. Privacy Shield and Data Transfers

With the 2020 “Schrems II” decision  looming over international data transfers, the Biden-Harris administration is likely to pave the way for negotiations with the European Commission for a new version of the Privacy Shield. However, the Schrems II ruling will continue to be a real challenge. The hope is that there can be effective, productive dialogue with the E.U. and that the U.S. can convey the fact that there is a mutually beneficial relationship with intelligence agencies in the U.S. and member states of the E.U.

FTC Enforcement and FCC Rules

During Chairman Joseph Simons’ tenure, the Federal Trade Commission (FTC) has been very active on privacy issues. Examples include the FTC’s enforcement actions against Facebook, Google and YouTube, as well as the Children’s Online Privacy Protection Act (COPPA) rulemaking proceeding held in 2019. Just this past week, the FTC announced a settlement with Zoom for alleged data security failings. While the FTC was certainly busy under a Republican-led agency, it is likely that we will see a heightened level of scrutiny and more enforcement under a Biden-Harris administration. While Chairman Simons can serve until 2024, he might step down, and it is also likely that the FTC will gain more Democratic commissioners.

For the Federal Communications Commission (FCC), a Biden-Harris administration may also lead to a revival of the net neutrality rules.

Cybersecurity

Many experts agree that cyber-attacks are the number one national security threat in the U.S., both from a geopolitical and an economic standpoint. A recent report, the Cyberspace Solarium Commission report, states that one of the biggest reasons for continued cybersecurity issues in the U.S. is the failure of strategy and leadership in this arena, and that now is the time for greater accountability of the government to defend against cyber-attacks.

Big Tech and the U.S.’s International Relationships

There has been a lot of scrutiny on how a Biden-Harris administration will regulate Big Tech in Silicon Valley. Biden has already pledged to create a task force for investigating online harassment, extremism and violence, so it is likely that there will be a focus on privacy, surveillance and hate speech online through some of the Big Tech players in Silicon Valley. We may also see some shifts in the U.S.’s relationship with China when it comes to privacy.

Of course, none of this change will happen overnight, so we’ll be watching as the train chugs forward.

Sensitive Personal Information – What Is It and What Does It Mean for California Privacy Rights Act Compliance?

By Deborah George on Posted in Data Privacy, Websites

The California Privacy Rights Act (CPRA) expands the definition of personal information as it currently exists in the California Consumer Privacy Act (CCPA). The CPRA adds “sensitive personal information” as a defined term, which means:

(l) personal information that reveals:

(A) a consumer’s social security, driver’s license, state identification card, or passport number;

(B) a consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;

(C) a consumer’s precise geolocation;

(D) a consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership;

(E) the contents of a consumer’s mail, email and text messages, unless the business is the intended recipient of the communication;

(F) a consumer’s genetic data; and

(2) (A) the processing of biometric information for the purpose of uniquely identifying a consumer;

(B) personal information collected and analyzed concerning a consumer’s health; or

(C) personal information collected and analyzed concerning a consumer’s sex life or sexual orientation.

This is perhaps the broadest definition of personal information in the country as it now includes entirely new classes of personal information such as racial, ethnic origin, religious or philosophical beliefs or union membership, the content of a consumer’s mail, email and text messages, genetic data, biometric data, and data collected and analyzed concerning a consumer’s health or sex life or sexual orientation.

What does this mean for a business that is covered by the CPRA? In a previous post, we provided a detailed overview of  the CPRA, but suffice it to say that if the business had to comply with CCPA, it also will likely be covered by CPRA. Given this new definition of sensitive personal information, one of the first steps in thinking about CPRA compliance will be to think about data mapping to determine whether the business collects any of these new categories of sensitive personal information. The CPRA is still very much a consumer-focused law with the goal of expanding consumer knowledge about the types of personal information businesses collect about consumers and how that personal information is used, sold, or shared. It will be a critical first step for businesses to understand the data and personal information they collect about consumers and whether they collect any sensitive personal information under this new definition.

C-Suites: Cybercrime Damages Expected to Reach $6 Trillion by 2021

By Linn Foster Freedman on Posted in New + Now

According to Cybersecurity Ventures, cybercrime is the fastest growing crime in the U.S., with damages expected to reach $6 trillion globally by 2021. Therefore, it is axiomatic that C-Suites continue to address the risk associated with cybercrime and how cybercrime will affect the business.

Ransomware continues to be one of the biggest risks to company operations. Statistics show that ransomware attacks are becoming more prolific and expensive. According to the most recent Coveware Q3 Report, ransomware incidents and ransom demands are increasing. Ransomware attacks are leaving a company paralyzed for an average of 19 days.

The inability to conduct business operations for 19 days can be devastating, especially to small and medium-sized businesses. Having an incident response plan, contingent operations plan, and disaster recovery plan is essential to minimizing the risk of failed or stalled operations. Those companies that are prepared for an attack and can implement these plans are better able to respond to a cyber-attack that leaves the company paralyzed.

It is clear that cyber-attacks and cybercrime damages are continuing to soar, particularly while companies’ workforces are working remotely. It is crucial to evaluate and put your incident response, contingent operations and disaster recovery plans in place now.

LexBlog