HIPAA Horror Stories

Hacked Cameras at the Hospital

one-minute read

How important is your individual privacy to the big tech start-up selling video surveillance systems to places you visit? Is it important enough to get the details right? Is it important enough to protect passwords and access codes from hackers?

Camera Surveillance Vendor Might be a Business Associate

This protection was missing at one Silicon Valley company selling surveillance cameras. Verkada, Inc. failed to protect privacy and security because an international hacking collective was able to easily break in and gain access to live feeds of 150,000 surveillance cameras Verkada supplied to hospitals, police departments, prisons, schools, and companies like Tesla and Cloudfare, Inc., a software provider.

Some of the healthcare entities whose cameras were breached include Florida-based Halifax Health, Wadley Regional Medical Center in Texarkana, Texas, and Tempe St. Luke’s Hospital in Arizona. In one health system, hackers reported they looked through Verkada cameras focused on nine ICU beds.

A covered entity’s vendor in healthcare who creates, receives, maintains or transmits protected health information (PHI) is a business associate and is required to comply with HIPAA.

Basic Cybersecurity Protection includes Password Management

The hackers gained access through a “super admin” account, which let them access the cameras of all of Verkada’s customers. The group found a username and password for an administrator account publicly exposed on the internet.

The HIPAA Security Rule requires Administrative, Physical and Technical Safeguards to protect patient privacy and security. Password protection and access requirements are among the fundamental safeguards required in any HIPAA compliance program.

As horrifying as this hacking story is, the good news is that the hackers appear not to have been motivated by money – they didn’t threaten ransomware or sell videos on the dark web. As first reported by Bloomberg News which broke the story:

The data breach was carried out by an international hacker collective and intended to show the pervasiveness of video surveillance and the ease with which systems could be broken into, said Tillie Kottmann, one of the hackers who claimed credit for breaching San Mateo, California-based Verkada. Kottmann, who uses they/them pronouns, previously claimed credit for hacking chipmaker Intel Corp. and carmaker Nissan Motor Co. Kottmann said their reasons for hacking are “lots of curiosity, fighting for freedom of information and against intellectual property, a huge dose of anti-capitalism, a hint of anarchism — and it’s also just too much fun not to do it.”

Once Bloomberg notified Verkada of the hack, Verkada was able to disable all administrator accounts and stop unauthorized access.

The Security Rule is Easy to Follow if You Know the Steps

Covered entities who engage vendors need to know which ones are business associates (do they create, receive, maintain or transmit PHI) and if so, as a covered entity, you must conduct due diligence to ensure they understand and follow HIPAA.

Business Associates need to know and follow the rules too. Get the details right, because breaching security appears to be all too easy.

The HIPAA E-Tool® makes compliance fast and easy. Get your free HIPAA Quick Start kit, complete with a webcam privacy guard, HIPAA Hot Zone labels and a HIPAA checklist delivered directly to your office.

Don’t become a HIPAA Horror Story! HIPAA compliance is easy, when you know the rules.

Request A Demo

Copyright © 2021 ET&C Group LLC.

The HIPAA E-Tool® and Protecting Patient Privacy is Our Job®
are registered trademarks of ET&C Group LLC

Terms of Service | Privacy Policy

Powered by JEMSU

Mailing Address
The HIPAA E-Tool
PO Box 179104
St. Louis, MO 63117-9104

8820 Ladue Road Suite 200
St. Louis, MO 63124

You may have questions about COVID-19 and HIPAA. We have answers. 

We are open and answering questions about all the new modifications and waivers, coming from HHS, OCR, CMS, and the new CARES act.

If you need help with HIPAA during the COVID-19 pandemic, fill in the form, and we’ll get back to you.

Free hipaa kit!

hipaa compliance Quick start kit
Delivered free