Kentucky Chamber’s Cyber Security and Data Privacy Seminar – February 28

Wyatt Tarrant & Combs, LLP is sponsoring the Kentucky Chamber’s Cyber Security and Data Privacy seminar on Tuesday, February 28, 2017, at the Griffin Gate Marriott Resort in Lexington, Kentucky.  We’ve put together a terrific panel of presenters, including, among others, representatives of Homeland Security and Crowdstrike, the firm that detected the Russian involvement in the hack of the Democratic National Committee.

A recent survey by the National Association of Corporate Directors indicates that Continue reading

New HIPAA Guidance on Ransomware: OCR’s encryption “gold standard” is no longer “golden”

By Margaret Young Levi and Kathie McDonald-McClure

softwareRansomware encrypts a user’s data and denies access to that data until a ransom is paid. The U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) has released new guidance to help health care entities better understand and respond to the ever-increasing threat of ransomware.  On July 11, 2016, HHS posted a blog entitled “Your Money or Your PHI: New Guidance on Ransomware.”  The HHS blog post includes a Fact Sheet for health care entities regarding ransomware.  This blog post highlights some of the more striking points in the OCR Fact Sheet and considerations for entities subject to HIPAA in addressing ransomware attacks.

Ransomware can cause harm beyond denying access to data.  The OCR Fact Sheet provides useful technical details about how ransomware malware works, and notes that data can be exfiltrated (i.e., transferred outside the computer network system).  Exfiltration can occur before or after the ransomware attack that encrypts the data.  It depends on the type of malware employed in the attack.  An April 2016 ransomware report from the Institute for Critical Infrastructure Technology (ICIT) provides even more technical details about the types of ransomware currently in use.  The ICIT report states that advanced persistent threats (APTs) and other hackers interested in collecting confidential data use ransomware as a form of distraction while stealthily using other malware to exfiltrate data.

The use of ransomware has skyrocketed.  According to OCR, the number of ransomware attacks has risen steeply in the last year, from an average of 1,000 per day in 2015 to an average of 4,000 attacks daily since January 1, 2016, including some very public attacks on hospitals.  Hospitals and other health care providers are especially vulnerable to Continue reading

Corporate Counsel magazine quotes Wyatt attorneys on changes to Tennessee data breach law

Kathie McDonald-McClure and Matt San Roman, members of Wyatt’s Data Privacy & Security Service Team, were recently interviewed for Corporate Counsel magazine.  The article, “Tennessee Enacted the Toughest Data Breach Law Yet,” addresses the new amendment to the Tennessee Identity Theft Deterrence Act of 1999.   The amendment, among other changes, may eliminate the “encryption safe harbor” rule (pending a legislative fix to other language that may keep it in).  Other states may follow suit if cybercriminals demonstrate ways around popular encryption methods.

Please note that the full text of the article is only available to subscribers.  To read our prior blog posts discussing the Tennessee amendment in more detail, click here and here.

Kathie McDonald-McClure to present at Health Enterprises Network/HIMSS event on HIPAA in integrated healthcare

HEN-HIMSS Whose Data Is It AnywayKathie McDonald-McClure, member of Wyatt’s Data Privacy & Security and Health Care Service Teams, will be speaking at an event presented by the Health Enterprises Network and Bluegrass Healthcare Information and Management Systems Society (Bluegrass HIMSS) entitled, “Whose Data Is It Anyway?”  Ms. McDonald-McClure will share strategies for achieving a “Yes-Yes” as well as avoiding the “No-No’s” under the Health Information Portability and Accountability Act of 1996 (HIPAA) with the exchange of health information in an integrated healthcare setting.

Please click here for more information and to register.

Date: January 21, 2016
Time: 5:00 p.m. – 6:00 pm (Cocktail Hour and Registration); 6:00 – 8:00 p.m. (Presentation).

Location:
Kosair Charities Clinical & Translational Research Building
505 S. Hancock Street
Louisville, KY 40202