Recent attacks illustrate how costly a security breach can be and why clinical laboratories and pathology groups must work to protect their information systems from ransomware attacks
Therefore, it is crucial clinical laboratories and pathology groups have a cybersecurity strategy in place for dealing with ransomware attacks. Running security drills may need to be part of that strategy. Managers and employees should undergo specific training and vendors must be vetted carefully. Without such a strategy, the question is not if an attack will happen, but rather when an attack will succeed.
Ransomware Attackers are Getting Better
“Ransomware is increasing in sophistication; it’s increasing in prevalence. The purveyors of ransomware are generally reinvesting the fees that they collect from the entities they extort to acquire more capabilities,” Beau Woods, Senior Advisor at the federal Cybersecurity and Infrastructure Security Agency (CISA), told The San Diego Tribune.
“They’re getting better, they’re getting more frequent, particularly during the pandemic where we’ve opened up more connectivity to allow more remote work,” he added.
The Scripps Health attack is notable for several reasons, with one being the length of the outage it caused. The attack was first detected on May 1 of this year. It took four weeks before Scripps could restore most of its network and get its Epic EHR back online, Health IT Security reported.
However, the ransomware attack on Universal Health Services (NYSE:UHS) may be the biggest attack so far. It took place on September 27, 2020, and caused a three-week outage. The company told The San Diego Tribune the incident had a $67 million impact on operations.
According to HIPAA Journal, “The phone system was taken out of action, and without access to computers and electronic health records, employees had to resort to pen and paper to record patient information. In the early hours after the attack occurred, the health system diverted ambulances to alternative facilities and some elective procedures were either postponed or diverted to competitors. Patients reported delays receiving test results while UHS recovered from the attack.”
At Utah Pathology Services, an employee e-mail hack resulted in the potential exposure of patient data. The malicious actors attempted to divert funds intended for a physician but failed to do so. However, the information of 112,000 patients was accessible to the hacker during the attempt.
“The compromised data varied by patient but could include names, contact information, insurance details such as ID and group numbers, medical and health information like internal records numbers and clinical and diagnostic information, and some Social Security numbers,” Health IT Security reported.
“We are seeing adversaries that are targeting our pharmaceutical companies, pharmaceutical research, laboratory companies, testing and really even out into the future manufacturing of the vaccine systems,” Bryan S. Ware (above left) Assistant Director for Cybersecurity for the Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) told CyberScoop. CISA Director Christopher Krebs (above right) added, “At the onset of the COVID-19 pandemic, we recognized just how vital the healthcare sector was to the response and we established Project Taken to bring to bear the government’s particular set of skills to protect those organizations.” (Photo copyrights: CyberScoop/Business Insider.)
Value of Patient Data on the Dark Web is Increasing
In the case of the Utah Pathology Services attack, the hackers were specifically after money. However, according to cybersecurity company SecureLink, patient records are “the new prize” for hackers. Healthcare data carries a value of its own on the digital black market. In fact, healthcare data is more valuable than credit card or banking data.
“Healthcare data is valuable on the black market because it often contains all of an individual’s personally identifiable information, as opposed to a single marker that may be found in a financial breach,” SecureLink wrote in a blog post.
A 2018 Trustwave Global Security Report estimated that a healthcare record is worth about $250. Trustwave, however, estimated the value of a banking record at less than $5. That strongly suggests health records are increasing in value.
And even after a healthcare entity has regained control of its IT infrastructure, the hacker still has possession of the stolen patient information. It may take weeks or years for the hacker to sell that information, meaning the breach represents a continuing threat to the healthcare organization and its patients.
Clinical Laboratories Must Prepare for an Attack
Simply understanding the threat is not enough. Clinical laboratory and pathology group managers must have robust plans in place for both protecting patient information and for dealing with a security breach should one occur.
According to a Health IT Security report, “The ransomware attack that struck all 400 UHS care sites and caused three weeks of EHR downtime in September, cost the health system $67 million in recovery costs and lost revenue.”
The report added, “Security researchers have long-recommended the need for providers to shift into a proactive security model, like zero trust. Recent reports show successful cyberattacks on healthcare providers doubled in the last year, with at least 560 providers falling victim to ransomware.”
To deal with the ransomware attacks, we wrote, “CISA, FBI, and HHS advise against paying ransoms. ‘Payment does not guarantee files will be recovered,’ the advisory states. ‘It may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities.’ The federal agencies advise organizations to take preventive measures and adopt plans for coping with attacks.
“The advisory suggests:
Training programs for employees, including raising awareness about ransomware and phishing scams. Organizations should ‘ensure that employees know who to contact when they see suspicious activity or when they believe they have been a victim of a cyberattack.’
Regular backups of data and software. These should be ‘maintained offline or in separated networks as many ransomware variants attempt to find and delete any accessible backups.’ Personnel should also test the backups.
Continuity plans in case information systems are not accessible. For example, organizations should maintain ‘hard copies of digital information that would be required for critical patient healthcare.’”
Given the enormous amounts of money hackers can earn from selling protected health information on the Dark Web, it is a near certainty these attacks will continue. Clinical laboratory and anatomic pathology group managers would be well advised to plan for the inevitability that their health system will be targeted.
The researchers believe their test ‘could reduce the number of unnecessary prostate cancer biopsies by 32%,’ UEA reported
New diagnostic technologies may make it possible for men to provide a urine sample that can allow a clinical laboratory to not only accurately diagnose prostate cancer but also help determine whether it is an aggressive form of prostate cancer. Researchers in the United Kingdom (UK) recently described just such a test in an online, peer-reviewed journal.
Development of a non-invasive method of diagnosing prostate cancer would be significant for anatomic pathologists in the United States. In the US alone, approximately 248,000 men will be diagnosed with this type of cancer in 2021. Prostate biopsies represent a major proportion of case referrals to community pathology groups.
Moreover, were such a non-invasive test for prostate cancer also able to identify those individuals with fast-growing prostate cancers, that would help urologists make more informed treatment decisions.
A Disease Men More Commonly Die ‘With’ Rather than ‘From’
According to CDC statistics, most men over the age of 80 will have some form of slow-growing prostate cancer when they die. However, a percentage of men each year contract a rapidly growing aggressive form of the cancer, and until recently, diagnosing which cancer a patient was fighting often required multiple invasive prostate needle biopsies. But that may soon change.
Researchers at the University of East Anglia (UEA) Norwich Medical School in the United Kingdom (UK) have developed a non-invasive urine test for prostate cancer that they say also can determine the aggressiveness of the disease. Knowing this may help physicians better assess a patient’s risk prior to ordering invasive needle biopsies, a UEA article notes.
The UEA test may also allow for self-collection of the biological sample, and if it proves accurate, the test could bring additional revenue to clinical laboratories that would perform the urine testing.
“In this work we develop a test that predicts whether a patient has prostate cancer and how aggressive the disease is from a urine sample. This model combines the measurement of a protein-marker called EN2 and the levels of 10 genes measured in urine and proves that integration of information from multiple, non-invasive biomarker sources has the potential to greatly improve how patients with a clinical suspicion of prostate cancer are risk-assessed prior to an invasive biopsy,” they wrote.
“While prostate cancer is responsible for a large proportion of all male cancer deaths, it is more commonly a disease men die with rather than from,” said Daniel Brewer, PhD, one of the lead researchers on this study. “Therefore, there is a desperate need for improvements in diagnosing and predicting outcomes for prostate cancer patients to minimize over-diagnosis and overtreatment whilst appropriately treating men with aggressive disease, especially if this can be done without taking an invasive biopsy.
“Invasive biopsies come at considerable economic, psychological, and societal cost to patients and healthcare systems alike,” he added. Brewer is Senior Lecturer in Cancer Bioinformatics and a group leader within the Cancer Genetics Team at UEA’s Norwich Medical School.
“Our new urine test not only shows whether a patient has prostate cancer, but it importantly shows how aggressive the disease is. This allows patients and doctors to select the correct treatment,” said Daniel Brewer, PhD (above), Senior Lecturer and Lead Researcher, UEA Norwich Medical School, in the news release. (Photo copyright: Eastern Daily Press.)
Possibility of Reducing Needle Biopsies by 32%
Called “ExoGrail,” the UEA’s new test builds on their earlier development of the Prostate Urine Risk (PUR) and ExoMeth tests. The test works by integrating two biomarkers.
Levels of gene expression of 10 genes related to prostate cancer.
The researchers tested ExoGrail on urine samples from 207 patients at Norfolk and Norwich University Hospital (NNUH) who also had needle biopsy samples available.
According to the published study, the UEA ExoGrail urine test enabled:
Results comparable to the biopsy findings.
Identification of people with prostate cancer and people without it.
Risk scoring that noted aggressive prostate cancer and need for biopsy.
Potential to reduce unnecessary biopsies by 32%.
“ExoGrail resulted in accurate predictions even when serum PSA [protein-specific antigen] levels alone proved inaccurate; patients with a raised PSA but negative biopsy result possessed ExoGrail scores significantly different from both clinically benign patients and those with low-grade Gleason 6 disease, whilst still able to discriminate between more clinically significant Gleason ≥ 7 cancers,” the researchers stated in their published study.
“The adoption of ExoGrail into current clinical pathways for reducing unnecessary biopsies was considered, showing the potential for up to 32% of patients to safely forgo an invasive biopsy without incurring excessive risk,” they noted.
Prostate Cancer Patients May Soon Have Options
While more research is needed, the new UEA Norwich Medical School ExoGrail test introduces compelling non-invasive methods for diagnosing prostate cancer. Patients with findings of aggressive cancer can proceed to biopsies, while others determined to have non-aggressive forms of prostate cancer may be able to avoid more invasive tests and the associated costs and stress.
Additionally, men may soon be able to collect their own specimens without the need to visit the primary care doctor or a patient service center.
A follow-up study underway at the University of East Anglia and the NNUH involves sending 2,000 men in the UK, Europe, and Canada home testing “prostate screening boxes” to “to collect men’s urine samples at-home,” according to a UEA new release, which noted that “the Prostate Screening Box has been developed in collaboration with REAL Digital International Limited to create a kit that fits through a standard letterbox.”
“We have developed the PUR (Prostate Urine Risk) test, which looks at gene expression in urine samples and provides vital information about whether a cancer is aggressive or ‘low risk,’” said Jeremy Clark, PhD, Senior Research Associate at UEA’s Norwich Medical School.
“The Prostate Screening Box part sounds like quite a small innovation, but it means that in future the monitoring of cancer in men could be so much less stressful for them and reduce the number of expensive trips to the hospital,” he added.
Anatomic pathologists and clinical laboratory managers will want to follow the progress of these clinical studies. A non-invasive, urine-based test for prostate cancer could be a game-changer if it can detect prostate cancer with comparable accuracy to the tissue-based diagnostics that are the current standard of care in the diagnosis of prostate cancer.
Four International Pandemics That Occurred Prior to COVID-19 and Contributed to Increased Clinical Laboratory Testing to Aid in Managing the Outbreaks
Since 1900, millions have died worldwide from previous viruses that were as deadly as SARS-CoV-2. But how much do pathologists and clinical laboratory scientists know about them?
SARS-CoV-2 continues to infect populations worldwide. As of May 28, 2021, the World Health Organization (WHO) reported that 168,599,045 people have been diagnosed with COVID-19 infections globally, and 3,507,377 individuals have perished from the coronavirus.
At the same time, federal Centers for Disease Control and Prevention (CDC) statistics show there have been 33,018,965 cases of COVID-19 in the United States, 589,547 of which resulted in death.
But COVID-19 is just the latest in a string of pandemics that spread across the planet in the past century. Since 1900, there have been four major international pandemics resulting in millions of deaths. But how many people even remember them? And how many pathologists, microbiologists, and clinical laboratory scientists working today experienced even the most recent of these four global pandemics?
Here is a summary/review of these major pandemics to give clinical laboratory professionals context for comparing the COVID-19 pandemic to past pandemics.
Spanish Flu of 1918
The 1918 influenza pandemic, commonly referred to as the Spanish Flu, was the most severe and deadliest pandemic of the 20th century. This pandemic was caused by a novel strand of the H1N1 virus that had avian origins. It is estimated that approximately one third of the world’s population (at that time) became infected with the virus.
According to a CDC article, the flu pandemic of 1918 was responsible for at least 50 million deaths worldwide, with about 675,000 of those deaths occurring in the United States. This pandemic had an unusually high death rate among healthy individuals between the ages of 15 and 34 and actually lowered the average life expectancy in the United States by more than 12 years, according to a CDC report, titled, “The Deadliest Flu: The Complete Story of the Discovery and Reconstruction of the 1918 Pandemic Virus.”
Interestingly, experts feel the 1918 flu strain never fully left us, but simply weakened and became less lethal as it mutated and passed through humans and other animals.
“All those pandemics that have happened since—1957, 1968, 2009—all those pandemics are derivatives of the 1918 flu,” he told The Washington Post. “The flu viruses that people get this year, or last year, are all still directly related to the 1918 ancestor.”
1957 Asian Flu
The H2N2 virus, which caused the Asian Flu, first emerged in East Asia in February 1957 and quickly spread to other countries throughout Asia. The virus reached the shores of the US by the summer of 1957, where the number of infections continued to rise, especially among the elderly, children, and pregnant women.
Between 1957-1958, the Asian Flu spread across the planet causing between one to two million deaths, including 116,000 deaths in the US alone. However, this pandemic could have been much worse were it not for the efforts of microbiologist and vaccinologist Maurice Hilleman, PhD, who in 1958 was Chief of the Department of Virus Diseases at Walter Reed Army Medical Center.
Concerned that the Asian flu would wreak havoc on the US, Hilleman—who today is considered the father of modern vaccines—researched and created a vaccine for it in four months. Public health experts estimated the number of US deaths could have reached over one million without the fast arrival of the vaccine, noted Scientific American, adding that though Hilleman “is little remembered today, he also helped develop nine of the 14 children’s vaccines that are now recommended.”
During his lifetime, Maurice Hilleman, PhD (above), developed a staggering 40 vaccines to help prevent everything from measles, mumps, rubella, pneumonia, meningitis, hepatitis A and B, and other infectious diseases. (Photo copyright: Scientific American.)
1968 Hong Kong Flu
The 1968 influenza pandemic known as the Hong Kong flu emerged in China and persisted for several years. Within weeks of its emergence in the heavily populated Hong Kong, the flu had infected more than 500,000 people. Within months, the highly contagious virus had gone global.
According to the Encyclopedia Britannica, this pandemic was initiated by the influenza A subtype H3N2 virus and is suspected to have evolved from the viral strain that caused the 1957 flu pandemic through a process called antigenic shift. In this case, the hemagglutinin (H) antigen located on the outer surface of the virus underwent a genetic mutation to manufacture the new H3 antigen. Persons who had been exposed to the 1957 flu virus seemed to retain immune protection against the 1968 virus, which, Britannica noted, could help explain the relative mildness of the 1968 outbreak.
It is estimated that the 1968 Hong Kong Flu killed one to four million people worldwide, with approximately 100,000 of those deaths occurring in the US. A vaccine for the virus was available by the end of 1968 and the outbreaks appeared to be under control the following year. The H3N2 virus continues to circulate worldwide as a seasonal influenza A virus.
2009 H1N1 Swine Flu
In the spring of 2009, the novel H1N1 influenza virus that caused the Swine Flu pandemic was first detected in California. It soon spread across the US and the world. This new H1N1 virus contained a unique combination of influenza genes not previously identified in animals or people. By the time the World Health Organization (WHO) declared this flu to be a pandemic in June of 2009, a total of 74 countries and territories had reported confirmed cases of the disease. The CDC estimated there were 60.8 million cases of Swine Flu infections in the US between April 2009 and April 2010 that resulted in approximately 274,304 hospitalizations and 12,469 deaths.
This pandemic primarily affected children and young and middle-aged adults and was less severe than previous pandemics. Nevertheless, the H1N1 pandemic dramatically increased clinical laboratory test volumes, as Dark Daily’s sister publication, The Dark Report, covered in “Influenza A/H1N1 Outbreak Offers Lessons for Labs,” TDR June 8, 2009.
“Laboratories in the United States experienced a phenomenal surge in specimen volume during the first few weeks of the outbreak of A/H1N1. This event shows that the capacity in our nation’s public health system for large amounts of testing is inadequate,” Steven B. Kleiboeker, DVM, PhD, told The Dark Report. At that time Kleiboeker was Chief Scientific Officer and a Vice-President of ViraCor Laboratories in Lee’s Summit, Mo.
1.7 Million ‘Undiscovered’ Viruses
As people travel more frequently between countries, it is unlikely that COVID-19 will be the last pandemic that we encounter. According to the World Economic Forum (WEF), there are 1.7 million “undiscovered” viruses that exist in mammals and birds and approximately 827,000 of those viruses have the ability to infect humans.
Thus, it remains the job of pathologists and clinical laboratories worldwide to remain ever vigilant and prepared for the next global pandemic.
Outspoken Wecht wants readers to understand ‘the multifaceted challenges of the interface of law and medicine’
Pathologists will recognize the name of nationally-acclaimed forensic pathologist Cyril Wecht, MD, JD, who for more than a half-century has been at the center of many of the country’s highest-profile civil and criminal cases. Thus, Dark Daily readers will be intrigued to learn the so-called “godfather of forensic pathology” has published a memoir that takes readers behind the scenes of many of his most controversial forensic pathology cases.
In his recently published memoir (above), forensic pathologist Cyril Wecht, MD, JD, offers readers an inside look at some of his most controversial cases, as well as a defense of his own brushes with the legal system. Anatomic and clinical pathologists may be especially intrigued by Wecht’s description of how “he was acquitted on charges of personally profiting from his office as Allegheny County Coroner” during a federal public corruption charge that was dismissed in 2008, the book’s description states. (Photo copyright: Exposit Books.)
A ‘No-Holds-Barred’ Account
According to TribLIVE, the book—written by Wecht and award-winning writer/filmmaker Jeff Sewald—is a “no-holds-barred account” of Wecht’s personal and professional life. Among the more interesting tidbits are details regarding Wecht’s 1972 discovery that JFK autopsy materials and specimens had gone missing.
“They had been in the government’s possession, so nobody could have touched them, but now the metal container which has held John Kennedy’s brain in formalin was no longer on the list of contents. In addition, various photographs and microscopic tissue slides were also no longer listed. The President’s brain was missing!” wrote Wecht, who argued Lee Harvey Oswald did not act alone in killing JFK and may not have fired the shots that killed him.
In 2006, Wecht faced an 84-count federal public corruption trial, which resulted in him resigning as Alleghany, Pa. medical examiner, the Pittsburgh Post-Gazette reported. In his memoir, Wecht wrote extensively about his public corruption trial. TribLIVE noted Wecht “expresses particular disgust” over the accusation that he supplied Pittsburgh’s Carlow University with cadavers in exchange for use of their laboratory space for his own practice. His trial ended in a hung jury.
“The body-snatching issue was seized upon by the media and was the subject of some of the most horrible cartoons ever,” Wecht wrote. “What made them especially horrible was the fact that I believe anti-Semitism was at their core. They made me look wicked and shadowy, like a ‘Shylock’ who was willing to stoop as low as selling human corpses for a handful of shekels. It was sickening.”
Wecht became known nationally through media appearances and his many decades of work as a medical-legal consultant in civil and criminal cases. At the 2000 Forensic Science and the Law Conference, television host and political commentator Geraldo Rivera, JD, stated, “I’ve known Cyril Wecht for most of my 30-year broadcasting career, and my respect for him has only grown over the decades. His skills as an attorney, as a pathologist, as a medical examiner are legendary.
“Dr. Wecht has guided my audiences through our coverage of crimes ranging from the Kennedy assassination to the O.J. Simpson trial to the JonBenet Ramsey murder mystery,” Rivera added. “And whether or not my audiences knew it, they were getting an education in forensic science—and a lesson in how medical science is applied to this country’s criminal laws.”
An ‘Expert’ and an ‘Irritant’
Though also certified in anatomic pathology and clinical pathology, Wecht has spent his career as a forensic pathologist focused on determining the cause of death. He has performed approximately 17,000 autopsies and has supervised, reviewed, or been consulted on approximately 30,000 additional postmortem examinations, the Cyrilwecht.com website states.
Cyril Wecht, MD, JD (above), told the Pittsburgh Jewish Chronicle that he wrote this memoir so readers could understand the “… complexity and the multifaceted challenges of the interface of law and medicine, specifically in the realm of pathology, and how important it is for justice to be served, with the input from forensic science, and how the system can be subverted, perverted, suppressed, and manipulated.” (Photo copyright: Pittsburg Business Times.)
Pathologists who followed Wecht’s career may know of his reputation “as both an expert and an irritant,” noted the Pittsburg Post-Gazette. For his part, Wecht stated, “If I had been a bit more diplomatic and patient, and a little less antagonistic and controversial, I might have achieved more,” the newspaper reported.
Anyone interested in forensic pathology will likely enjoy reading the behind-the-scenes stories from Wecht’s more than six decades of work. But Wecht’s memoir should be particularly intriguing and informative for clinical and anatomic pathologists, as well as all medical laboratory scientists.
