Simply Solving Cyber- Cory Brennan

Welcome to Simply Solving Cyber. I'm Aaron Pritz.

And I'm Cody Rivers.

And today we're here with Cori Brennan. She's an attorney at Taft and previously at Hall Render and has done a mix of both legal advisory and attorney work, as well as cyber consulting, a lot of healthcare and med tech experience. So welcome to the show, Cori.

Thank you for having me.

So dive right in here. So healthcare and cyber, two things we're seeing a lot right now in the news, and especially on breaches and PHI. So would love just to dive in and get your take on what you're seeing right now, the good, the bad, and the ugly.

Yeah, maybe start with like, why is everyone targeting healthcare? It's so immoral.

Well, first of all, it's a treasure trove of sensitive information, right? There is a lot of unsophisticated technology in place in healthcare organizations. Healthcare moves extremely slowly, so there's always a maturation issue in terms of what's next, the evolving kind of digital perspective. In order to be able to obtain the information that bad actors are looking for today, there is more of an emphasis on double ransom now. There's like 2 or 3 different ways that ransomware attackers will go after your data. They'll ask you for money to unlock, right, to get the decryption key to your data. They'll also ask you for money so that they won't release it on the dark web. But then they're also asking for money now to not erase all of their data, right? So there's a confidentiality, availability, and integrity issue there. Three different ways to pick you off.

That's a hat trick right there.

Right? So healthcare is really most susceptible, I think, to that because they need that sensitive information for the purposes of treating their patients appropriately, right? But they also don't want to be hammered with regulatory penalties for not having the appropriate security controls in place. So, I mean, it's really just a low-hanging fruit for bad guys, if you will.

So with healthcare though, they're thinking, hey, it's tough, budgets are small, we'll just get cyber insurance and we'll be covered in that scenario. So is that a good plan or?

It might be a good plan if it was a little bit easier to actually get cyber insurance these days. We're working with a lot of clients who are having a very difficult time renewing their cyber policies. That's for a multitude of reasons. The first probably being exactly how we started this conversation. Why is healthcare being targeted so regularly? Again, how much sensitive information these organizations have, uh, how little budget they have for security planning and advanced technology to protect that information. So all of those things combined are making it very difficult for a lot of our healthcare clients to retain their cyber insurance policies. But That being said, when they do have those policies, the deductibles are very high. The limits are low. You know, we're seeing like a pretty standard $5 million per claim and $5 million in the aggregate right now for cyber claims related to breach or incident. Across the board, that's not near enough, especially for healthcare organizations that maintain as much information as they do. So while that might be a good plan for other industries, it is certainly not great for healthcare. I think one of the things that we were talking about earlier too is that it's very difficult to get some of these claims covered under your insurance policy, even if you do have that in place. So things like ransomware or unintentional actions on behalf of your team that result in the exposure of PHI, you know, some of those things aren't covered by your policy. One thing we're seeing a lot of right now is there's been a kind of a drastic increase in the scrutiny of using advertising technologies on healthcare provider websites.

Oh, okay.

That there was OCR guidance released in December of 2022 that said, look, if you're, you know, if you're implementing these website tracking technologies and you are a regulated entity under HIPAA, it's a very good chance that the information that's being collected by these tracking technologies is going to be considered PHI.

Oh, wow.

If you're disclosing—

Regardless of what that information collected is.

Pretty much. Yeah. It's a very, very low bar set, right? Like IP address, URL, things like that are actually considered to be identifying information under HIPAA. All three of us know that every transaction that takes place over the internet includes the IP address of at least one side of that transaction. So those kinds of things that are being reported as breaches by healthcare organizations we tend to see they are not covered under someone's cyber insurance policy because it was an intentional act. They intentionally placed those tracking technologies on their websites.

Wow.

Doesn't mean that they were intentionally transmitting PHI, right? That was something that they didn't realize was happening. But that intentional placement in the first place really barred them from a claim under their insurance policy, which is wild.

Beyond kind of those claims that aren't covered, is it reasonable in this day and age, with your perspective from a legal standpoint on insurance, to be expecting insurance to cover anything more than your legal fees, your IR fees, your forensic fees. I think my challenge in the past has been like insuring intellectual property is tough, or maybe some are doing it now, but it's almost like you pay for the firefighting and the services. Insurance can cover those things, but are you really able to cover a company's intellectual property or loss of business reputation? That, that seems like no one would want to take that on.

No, no. And we're seeing more and more policies with adverse media-related events, right? So some of that like PR function, um, some that are more heavy into the forensic investigation. But interestingly, what we don't see very often, or a lot of our clients suffer, is any kind of services that are provided or costs incurred related to investigating a potential breach or a potential issue. Are not covered under cyber insurance policies.

Until it is what it is.

Until it is what it is and you've notified them, hey, this is where we're at. So if a lot of our clients need help to determine whether or not something is a breach, whether or not their information has been impacted or not, which you would think would be a little bit more obvious, especially like in a ransomware attack, but for healthcare organizations in particular, it's really not because where they keep that sensitive information is not in their internal hard drives or file systems. It's more in like your, electronic medical record system or other types of imaging systems, things like that, which are not always the target for ransomware attacks. So investigating that, determining what information has been impacted, how many potentially impacted individuals there are, all of that is kind of pre-breach work that's not covered under the policy. So it's been really difficult for a lot of our clients to figure out how to foot that bill.

Interesting. Interesting. All right. Well, so Also too, I know you probably have to give a small fine print that you, this is not legal advice, but for someone who's not a lawyer, help me understand earlier back to the, the website traffic. How does that work? Is it like a, cuz of a BAA or how does, how is that a breach?

Yeah, that's a good question. I've been kind of living in that world lately, so it's easy for me to just skim right over it. Expect you to know what I'm talking about, but basically there's not a specific list of identifiable information under HIPAA. HIPAA actually defines. PHI, protected health information, as individually identifiable health information. And they kind of leave it up to the imagination. What they do provide is a list of information elements that you have to remove from a dataset to make it de-identified. So we use that as kind of like the reverse, right? If these are the things we need to remove from a dataset for it to be de-identified, these are the things that they're probably looking for and consider identifiable. In that list, there's 18 different items. One of them is IP address, one is URL. We have email addresses, first name, last name, geographic location, things like that. Again, you know, it's 2023. We're moving into the era of digital marketing, advertising technologies, data analytics, things like that. And so a lot of these organizations have been implementing web tracking technologies like Google Analytics, Google Ads, Facebook Pixel, those kinds of technologies on their website. And what OCR has said is that in relation to HIPAA, in the event that you are collecting, transmitting, disclosing any information on a user, an individual who is visiting your website as a healthcare provider, as long as that disclosure of information through a web tracker includes any of those identifiable elements, so IP address, URL, any of that, that is considered to be PHI. So you are now disclosing PHI to a third-party web tracking technology vendor like Facebook or Google. And the only way to do that in an authorized manner is to either have written authorization from the patient every time it happens or to have a business associate agreement in place.

Wow.

Unfortunately, vendors like Facebook and Google refuse to have any kind of business associate agreement.

Zuckerberg's not returning your clients' calls?

He is not. You know what? He is not. And actually, it's interesting because really when you first take a look at this issue, you want to point your finger at Facebook and Google and say, what the hell are you doing? You know, this is crazy. It's ridiculous. But Ever since these types of technologies have existed, they've had terms of use and privacy policies, and here's what you can and can't do when you use our technology. One of those things is do not collect protected health information. Do not use this for the purposes of transmitting information related to individually identifiable health information. So it's really not Facebook or Google here. I mean, really, unless you look at the fine print, we know what they were trying to do, but it's really the healthcare organizations, not, truly understanding that the information that they were collecting did constitute PHI, but also I think it clearly indicates a big gap in operations within healthcare organizations with their marketing and their IT and security teams, right? There's obviously a process that most organizations have in place for like change management related to their websites and when they produce or introduce new code on their websites, that'll go through a change management process that's reviewed.

Yep.

But that marketing process has never really been integrated into that.

So is everyone rushing to turn this stuff off, or can you turn it all off to get compliant, or what's the right step?

Yeah, that's a good question. And I joke quite regularly that there are marketing departments across the country with my picture on a dartboard and they're throwing darts at it regularly because most of marketing executives are on the call with our clients when they're asking the same question, what do we do now? And every time that I've looked at them and said, yeah, you should probably turn it all off. Are like, you are crazy. Yeah.

It's not something we're going to do. And they shut down the ability to interact with the patients in the way that they had needed to or had been accustomed to, right?

Right, right. And we've had some folks that have told us, well, we might as well just turn the whole website off, which is a little drastic, but you know, yeah. So first things first, you need to know what you have in place, right? What are you concerned about? What tracking technologies are on your website? How are they functioning? Why are they implemented? So knowing that is the first step, and that's been one of the toughest steps because, again, that gap between marketing and compliance and IT is pretty drastic. So—

I imagine the marketing and infosec relationship is super strong.

Right. They love us.

Exactly. It just has been, you know, it's grown over time, the types of technology that those marketing teams are, you know, using for their purposes, but not really always considered, especially in healthcare, again, We move so slow in healthcare. So between that, you know, knowing what you need to know, what you don't know, right? Mm-hmm. But also there are certain tracking technologies that I always recommend to clients. Like if you're using this, just turn it off now.

Gotcha. So, so speaking of technologies and tools, and this is one that was to the negative or an unknown, I guess, an unknown outcome. You're seeing clients, and again, we mentioned earlier in healthcare with budgets are tight. So do you see a lot of folks that just say, hey, yeah, I got these tools, I've got X number of tools and they're right here and I feel great and I feel safe, you know, I'm, I'm good to go. I've got interns, I've got tools, I'm great.

Yeah, that's one of my favorite things to tell clients is, look, it's that shiny brand new tool that you have right there and you think that's an easy button, but unfortunately it's not because the people and processes, the resources that are built around those tools, right? They need to be in place for a tool to function properly, to be able to unlock the full potential of any kind of tool that you have in place. So those organizations that are rushing with their budgets to just buy the bright, shiny new technology because they think that's going to solve all of their problems. Unfortunately, that's just not the case. And we do see that regularly in the incident response area, right? So we have clients who experience a breach, maybe it's a ransomware attack, maybe it's a successful phishing attempt, whatever it may be. And they're confused as to why this bright, shiny new tool isn't allowing them to sufficiently recover from that attack. Why can I not press this button? And it immediately stops whatever is happening, helps us to recover, restore our systems.

You had it deployed to 10% of the assets, right?

Right. Or it's completely encrypted or your assets aren't working anymore. The people and process developed around that is so important, and we see it because it causes such a delay in the restoration of services and processes and being able to get back to treating patients the way that you were without having to write notes on a piece of paper, right? You need your systems back up and running, but unfortunately, I think we don't have enough resources in healthcare as it is, be it clinicians or providers or the support from an IT team or security team, and it's just not there. So you buy a technology, hopefully a managed service, thinking that your vendor is going to be there to support you, and it's just not happening.

Right. So you've been focused fairly heavily in healthcare, but your domain is really privacy, security, incident response, data protection. As you've moved to Taft, you've kind of wanted to lay into that experience but broaden. So what have some been some of the other sectors that you've gotten exposed to? What is hot for you guys or for you right now outside of healthcare?

Yeah, so when I was leaving Halrender, which by the way is a very difficult decision, I had very good relationships not only with my colleagues, coworkers, but many clients there. I had been working so heavily in this area of the web tracking technology breaches, lots of health systems working hand in hand trying to investigate this issue and figure out where to go from there. And as I was leaving, I mentioned kind of flippantly, like, well, maybe now I'll have the opportunity to work with some of these marketing techno ad tech companies. Yeah, see the other side and just be like, hey, do you have any idea what's going on in healthcare right now and why this is happening? And the fact that you need to probably be more cognizant that these— this is part of your client base and they have different regulations or rules that govern them. But that's exactly what I've had the opportunity to do in the transition to TAF, which has been really insightful, really great. Again, I really wanted to broaden my experience in that area of information privacy and technology, but the opportunity to work with the ad tech companies and a couple of other really like technology-specific, really cool, new evolving technologies has been really interesting. And also staying on the forefront of these new state privacy laws that are up and coming right now, which is everyone's kind of following suit with California, which is pretty typical, I think. But knowing that that's something especially for technology technology vendors who have customers all over the country and all over the world. That's something that's really important that we really didn't deal with as much when I was working with healthcare clients.

So are you getting into the AI, ChatGPT, all of this technology booming right now? And obviously some of the benefits and challenges that go with that are quite interesting.

Yeah, yeah, the AI stuff primarily from like an intellectual property standpoint and how to protect that IP when you are working with customers who are purchasing this type of AI, but not as much as I am with, interestingly enough, I guess the initial development of these AI solutions. So like the initial, like algorithm training.

Right.

What I have seen quite a bit of recently is whether I'm working with a vendor specifically or with a customer, or I guess I should say a participant, is a lot of AI solutions, again, in healthcare that are using like medical images and de-identified medical data, clinical data, clinical outcomes data. To feed and train these algorithms that are then creating this AI solution on the other side, right? It's been really interesting to navigate some of the potential legal concerns with using like an MRI result or an ultrasound image, totally de-identifying it, which is difficult enough because there's so much metadata in those images, but using those images, feeding this algorithm, and then seeing kind of the output of that. Participation, like on the other side, here's some of the reports that are generated. It's really cool.

Yeah, I know on the marketing side, and actually I, we do some internal marketing here for our company, and just playing around with some of those tools just to see what it would do depending on the tool you use and the what it's being trained against or the source of the thing. I know one of the big things in digital and marketing is like if you're asking it to create an infographic and it's pulling pieces and parts of actual art or actual copyrighted imagery, how much of what it pulls is infringing on that. And you don't really get a source list of here's where it got pulled from. So a lot of people are jumping into this stuff and unfortunately feeding their intellectual property into the tool or their confidential data to say, summarize this and rewrite my code. And then all of a sudden, like, what did you just ingest into the public cloud?

Yes. Yeah, no, absolutely. Seeing that very regularly. It actually, interestingly, I'm working with a client who is kind of looking at how to create this AI-generated retargeting solution that is based on an individual user's emotional reaction to certain advertisements. Like how many people click on a link that is focused emotionally. I think they call it psychographic. Marketing. So like it's focused emotionally on how much you love your cat and what would happen if your cat wasn't here anymore. So click on this link that potentially is pet insurance, cat insurance, medical insurance for your cat. Or is it more of an emotional reaction if this advertisement is based on you're going to go broke paying for all of the new shots and vaccines for your new cat? So buy this cat health insurance because that'll cover the cost of these vaccines. So are these users having more of a reaction to the financial penalty or how much they love Fluffy? And seeing how that is feeding this algorithm for marketing purposes is very interesting. And how that like emotional psychographic, I guess, response, how do you protect that from an intellectual property standpoint?

Yeah. What is the button you can click to take your wife's cat off of your hands? I'm asking for a friend.

I mean, I would be really interested to see what about like the percentage of the emotional reaction to that one.

I have the opposite of all that stuff that you said about our family cat, but that's just me.

Oh no, I get it. I think that would probably be a high percentage.

I'm just a dog person. I can't hide behind that.

I get it. No, I get it.

Excellent. You mentioned earlier with what's out there, what are the frameworks, what are people doing? There's new privacy laws coming up and talking about frameworks, and this is something that I'm interested in your take because we see this a lot. As you said, you changed sides from healthcare side and marketing side and learning. On our side, we have clients that are large organizations that we're building risk programs for them and what questions to ask to, for vendors and frameworks that they follow to help mitigate risk. What are you seeing from those who are, whether there's NIST, there's SOC 2, there's HITRUST, and there's quite a few out there, the result of aligning to a policy or to a framework or not aligning to a framework in the event of a breach or an incident?

Yeah, primarily those issues come up in contractual obligations, right? Negotiating a contract, be it on the vendor side or the client side, customer side, whoever that may be. But in healthcare, we see it very often with our covered entity or regulated entity clients. So healthcare providers or business associates looking for their technology vendors in specific to attest to a lot of extremely high standards of security safeguards to protect their information. Obviously, that's important, but what we do see now is that regulated entities are trying to leverage their business associate agreements to get vendors to agree to represent and warrant more than is really required in a business associate agreement. Really, that BAA is pretty prescriptive under HIPAA, what written assurances need to be in a BAA. And so including any more than that, I typically advise against doing that. Use master services agreement or whatever it may be to have that conversation with your vendor about what security controls they have in place that go above and beyond HIPAA, which I did sort of get my lunch fed to me just a couple of years ago or a year and a half ago now. COVID time, everything goes by much quicker. But when the HITECH Act amendment came out, I think it was 2020, and that basically said that regulated entities, again, covered entity or business associates who have a, an industry standard framework for security that they adhere to as part of their organizational information security program actually have the opportunity to reduce their penalties under HIPAA if there is an enforcement action against that particular regulated entity for something. So say that a covered entity experiences a breach, they've reported that breach to OCR, so HHS's Office for Civil Rights, that's who investigates HIPAA breaches. Any breach that's reported that is over 500 impacted individuals has like a mandatory compliance investigation.

Sure.

Which is reported. So, so say that that investigation takes place after you report the breach, you know, like you are going to either be in really big trouble or your compliance officer is going to be really happy that they spent all that money on that tool to provide your policy.

Seriously?

Your template policies, no. But basically what that amendment says is that if the information security program that you have in place is aligned to an industry standard framework like NIST, ISO, and then I think it says similarly situated industry recognized frameworks, which we draw those from other state privacy laws, that any penalties that would be levied against any fines for the breach, OCR has the opportunity to consider consider that industry standard framework that you have in place and reduce your penalties. So it's like a mitigation factor, if you will.

So basically have a plan that's aligned to something that's generally accepted and you get some credit.

Exactly. They'll consider it and it's not promised, but it's interesting because I think me in particular, this is not legal advice, but I think that it's clear that regulators are recognizing that HIPAA is just not enough, right? They're not going to create a whole new statutory regulation, but what they are doing is they're creating an incentive for organizations to go above and beyond HIPAA, which again, recognizing that HIPAA is pretty antiquated and really isn't—

2012, was that the last update? Or I know it's more than a decade.

I mean, that was the last update and it was like 3 things and related to encryption. I think again, back to our original conversation about the web tracking technologies, advertising technologies.

Nobody contemplated it.

Nobody contemplated it. No one thought that. And so this huge outrage and uproar from the healthcare industry around this is, yeah, that is what HIPAA says. Thanks for the guidance, OCR, but maybe it's time to update this and contemplate new technologies. But the only other thing I wanted to mention about the industry standard framework piece is that I have helped several clients respond to compliance investigation data requests from OCR over the past few years. And just recently in 2022, we saw a data request come through from OCR that it was funny because say there's 25 questions on a typical data request and they're like, give us your policy about encryption, give us your policy for incident response, and show evidence that you followed it. So those are the 25 kind of canned questions. And then they just slapped a question 26. It's like, also, are you using an industry recognized cybersecurity framework? Really? Uh, yes, question mark. But it, obviously it's something that they're taking into consideration now. And that's the first time we'd seen it.

Awesome. So what, what's next for you, Corey, on your horizon? What are you looking to do or accomplish? But, you know, either within legal or privacy or cyber?

Great question. So I'm getting married in September. I'd really like to get over that hump first. But in terms of professionally, again, the transition that I made between Hallrender and Taft, now a very, very difficult decision. And Hallrender, very respectable healthcare-focused law firm that I really could have seen myself continuing to grow at. But the point of my transition was to grow as an attorney. And I've worked in healthcare pretty much my whole working life. I started in medical device, you know, clinical engineering security to working for a very large health system in security and then doing healthcare law once I graduated from law school. So having the opportunity to expand my horizons and expertise beyond just healthcare is really what my intention was, though I find myself like constantly gravitating back to the healthcare. Like the vision, the mission, the values, you're like kind of roll your eyes at it when you're ingrained in it, and then when you're on the outside looking in, you're like Oh, that's why I really like to do this. So it's interesting. I don't know. I'm kind of just riding the wave, seems like.

Good. Well, it's always good to diversify your career portfolio and keep learning and never stop that because I'd rather be busy than bored. And continuous learning is the way to continually develop. So, yeah.

And I think that the government is really going to dictate where I go with privacy and security laws.

Wow, very authoritarian.

I'm just like, whatever these crazy people decide to do with some of the stuff that's coming up right now, that's where I'm going to be next, I guess. Might as well hitch my horse to that wagon.

There you go. Awesome. Well, Cory, really appreciate having you on the show. I know there's a number of our clients that I think will love to tune into this episode and get some nuggets of where they're at on their journey and things that they need to consider. So I appreciate you joining us and sharing your story and perspectives.

Thanks for having me. I appreciate it. I know we were kind of all over the place, but there's a lot to talk about. Every time I'm with you guys, it's like everywhere.

So it's kind of cyber uzis day.

It's everywhere.

And so it's—

How do you focus on one thing?

Yeah, well, you know what? That's one of our taglines. You got to follow.

I thought you were going to the Visa, "It's everywhere you want to be." The biggest enemy of cyber is—

programs is lack of focus.

Oh, yeah. Lack of focus and trying to take on too much. That will destroy any cyber leader or program.

Yeah, it's very difficult.

I get that.

Absolutely. Awesome. Thanks