Clinical laboratories and pathology groups should be on the alert to this new digital threat; telehealth sessions and video conferencing calls particularly vulnerable to acoustic AI attacks
Banks may be the first to get hit by a new form of hacking because of all the money they hold in deposit accounts, but experts say healthcare providers—including medical laboratories—are comparably lucrative targets because of the value of patient data. The point of this hacking spear is artificial intelligence (AI) with increased capabilities to penetrate digital defenses.
AI is developing rapidly. Are healthcare organizations keeping up? The hackers sure are. An article from GoBankingRates titled, “How Hackers Are Using AI to Steal Your Bank Account Password,” reveals startling new AI capabilities that could enable bad actors to compromise information technology (IT) security and steal from customers’ accounts.
Though the article covers how the AI could conduct cyberattacks on bank information, similar techniques can be employed to gain access to patients’ protected health information (PHI) and clinical laboratory databases as well, putting all healthcare consumers at risk.
The new AI cyberattack employs an acoustic Side Channel Attack (SCA). An SCA is an attack enabled by leakage of information from a physical computer system. The “acoustic” SCA listens to keystrokes through a computer’s microphone to guess a password with 95% accuracy.
“With recent developments in deep learning, the ubiquity of microphones and the rise in online services via personal devices, acoustic side channel attacks present a greater threat to keyboards than ever,” wrote UK study authors Joshua Harrison, MEng, Durham University; Ehsan Toreini, University of Surrey; and Maryam Mehrnezhad, PhD, University of London.
Hackers could be recording keystrokes during video conferencing calls as well, where an accuracy of 93% is achievable, the authors added.
This nefarious technological advance could spell trouble for healthcare security. Using acoustic SCA attacks, busy healthcare facilities, clinical laboratories, and telehealth appointments could all be potentially compromised.
“The ubiquity of keyboard acoustic emanations makes them not only a readily available attack vector, but also prompts victims to underestimate (and therefore not try to hide) their output,” wrote Joshua Harrison, MEng (above), and his team in their IEEE Xplore paper. “For example, when typing a password, people will regularly hide their screen but will do little to obfuscate their keyboard’s sound.” Since computer keyboards and microphones in healthcare settings like hospitals and clinical laboratories are completely ubiquitous, the risk that this AI technology will be used to invade and steal patients’ protected health information is high. (Photo copyright: CNBC.)
Why Do Hackers Target Healthcare?
Ransomware attacks in healthcare are costly and dangerous. According to InstaMed, a healthcare payments and billing company owned by J.P. Morgan, healthcare data breaches increased to 29.5% in 2021 costing over $9 million. And beyond the financial implications, these attacks put sensitive patient data at risk.
Healthcare can be seen as one of the most desirable markets for hackers seeking sensitive information. As InstaMed points out, credit card hacks are usually quickly figured out and stopped. However, “medical records can contain multiple pieces of personally identifiable information. Additionally, breaches that expose this type of data typically take longer to uncover and are harder for an organization to determine in magnitude.”
With AI advancing at such a high rate, healthcare organizations may be unable to adapt older network systems quickly—leaving them vulnerable.
“Legacy devices have been an issue for a while now,” Alexandra Murdoch, medical data analyst at GlobalData PLC, told Medical Device Network, “Usually big medical devices, such as imaging equipment or MRI machines are really expensive and so hospitals do not replace them often. So as a result, we have in the network these old devices that can’t really be updated, and because they can’t be updated, they can’t be protected.”
But telehealth, according to the UK researchers, may also be one way hackers get past safeguards and into critical hospital systems.
“When trained on keystrokes recorded using the video-conferencing software Zoom, an accuracy of 93% was achieved, a new best for the medium. Our results prove the practicality of these side channel attacks via off-the-shelf equipment and algorithms,” the UK researchers wrote in IEEE Xplore.
“[AI] has worrying implications for the medical industry, as more and more appointments go virtual, the implications of deepfakes is a bit concerning if you only interact with a doctor over a Teams or a Zoom call,” David Higgins, Senior Director at information security company CyberArk, told Medical Device Network.
Higgins elaborated on why healthcare is a highly targeted industry for hackers.
“For a credit card record, you are looking at a cost of one to two dollars, but for a medical record, you are talking much more information because the gain for the purposes of social engineering becomes very lucrative. It’s so much easier to launch a ransomware attack, you don’t even need to be a coder, you can just buy ransomware off of the dark web and use it.”
Steps Healthcare Organizations Should Take to Prevent Cyberattacks
Hackers will do whatever they can to get their hands on medical records because stealing them is so lucrative. And this may only be the beginning, Higgins noted.
“I don’t think we are going to see a slowdown in attacks. What we are starting to see is that techniques to make that initial intrusion are becoming more sophisticated and more targeted,” he told Medical Device Network. “Now with things like AI coming into the mix, it’s going to become much harder for the day-to-day individual to spot a malicious email. Generative AI is going to fuel more of that ransomware and sadly it’s going to make it easier for more people to get past that first intrusion stage.”
To combat these attacks patient data needs to be encrypted, devices updated, and medical staff well-trained to spot cyberattacks before they get out of hand. These SCA attacks on bank accounts could be easily transferable to attacks on healthcare organizations’ patient records.
Clinical laboratories, anatomic pathology groups, and other healthcare facilities would be wise to invest in cybersecurity, training for workers, and updated technology. The hackers are going to stay on top of the technology, healthcare leaders need to be one step ahead of them.
Collected data could give healthcare providers and clinical laboratories a practical view of individuals’ oral microbiota and lead to new diagnostic assays
When people hear about microbiome research, they usually think of the study of gut bacteria which Dark Daily has covered extensively. However, this type of research is now expanding to include more microbiomes within the human body, including the oral microbiome—the microbiota living in the human mouth.
One example is coming from Genefitletics, a biotech company based in New Delhi, India. It recently launched ORAHYG, the first and only (they claim) at-home oral microbiome functional activity test available in Asia. The company is targeting the direct-to-consumer (DTC) testing market.
According to the Genefitletics website, the ORAHYG test can decode the root causes of:
“Using oral microbial gene expression sequencing technology and its [machine learning] model, [Genefitletics] recently debuted its oral microbiome gene expression solution, which bridges the gap between dentistry and systemic inflammation,” ETHealthworld reported.
“The molecular insights from this test would give an unprecedented view of functions of the oral microbiome, their interaction with gut microbiome and impact on metabolic, cardiovascular, cognitive, skin, and autoimmune health,” BioSpectrum noted.
“Microbes, the planet Earth’s original inhabitants, have coevolved with humanity, carry out vital biological tasks inside the body, and fundamentally alter how we think about nutrition, medicine, cleanliness, and the environment,” Sushant Kumar (above), founder and CEO of Genefitletics, told the Economic Times. “This has sparked additional research over the past few years into the impact of the trillions of microorganisms that inhabit the human body on our health and diverted tons of funding into the microbiome field.” Clinical laboratories may eventually see an interest and demand for testing of the oral microbiome. (Photo copyright: ETHealthworld.)
Imbalanced Oral Microbiome Can Trigger Disease
The term microbiome refers to the tiny microorganisms that reside on and inside our bodies. A high colonization of these microorganisms—including bacteria, fungi, yeast, viruses, and protozoa—live in our mouths.
“Mouth is the second largest and second most diverse colonized site for microbiome with 770 species comprising 100 billion microbes residing there,” said Sushant Kumar, founder and CEO of Genefitletics, BioSpectrum reported. “Each place inside the mouth right from tongue, throat, saliva, and upper surface of mouth have a distinctive and unique microbiome ecosystem. An imbalanced oral microbiome is said to trigger onset and progression of type 2 diabetes, arthritis, heart diseases, and even dementia.”
The direct-to-consumer ORAHYG test uses a saliva sample taken either by a healthcare professional or an individual at home. That sample is then sequenced through Genefitletics’ gene sequencing platform and the resulting biological data set added to an informatics algorithm.
Genefitletics’ machine-learning platform next converts that information into a pre-symptomatic molecular signature that can predict whether an individual will develop a certain disease. Genefitletics then provides that person with therapeutic and nutritional solutions that can suppress the molecules that are causing the disease.
“The current industrial healthcare system is really a symptom care [system] and adopts a pharmaceutical approach to just make the symptoms more bearable,” Kumar told the Economic Times. “The system cannot decode the root cause to determine what makes people develop diseases.”
Helping People Better Understand their Health
Founded in 2019, Genefitletics was created to pioneer breakthrough discoveries in microbial science to promote better health and increase longevity in humans. The company hopes to unravel the potential of the oral microbiome to help people fend off illness and gain insight into their health.
“Microorganisms … perform critical biological functions inside the body and transform our approach towards nutrition, medicine, hygiene and environment,” Kumar told CNBC. “It is important to understand that an individual does not develop a chronic disease overnight.
“It starts with chronic inflammation which triggers pro-inflammatory molecular indications. Unfortunately, these molecular signatures are completely invisible and cannot be measured using traditional clinical grade tests or diagnostic investigations,” he added. “These molecular signatures occur due to alteration in gene expression of gut, oral, or vaginal microbiome and/or human genome. We have developed algorithms that help us in understanding these alterations way before the clinical symptoms kick in.”
Genefitletics plans to utilize individuals’ collected oral microbiome data to determine their specific nutritional shortcomings, and to develop personalized supplements to help people avoid disease.
The company also produces DTC kits that analyze gut and vaginal microbiomes as well as a test that is used to evaluate an infant’s microbiome.
“The startup wants to develop comparable models to forecast conditions like autism, PCOS [polycystic ovarian syndrome], IBD [Inflammatory bowel disease], Parkinson’s, chronic renal [kidney] disease, anxiety, depression, and obesity,” the Economic Times reported.
Time will tell whether the oral microbiome tests offered by this company prove to be clinically useful. Certainly Genefitletics hopes its ORAHYG test can eventually provide healthcare providers—including clinical laboratory professionals—with a useful view of the oral microbiome. The collected data might also help individuals become aware of pre-symptomatic conditions that make it possible for them to seek confirmation of the disease and early treatment by medical professionals.
New lawsuit contends that the promissory notes Holmes allegedly issued on behalf of defunct clinical laboratory company Theranos are now overdue
Just weeks before Elizabeth Holmes is scheduled to begin her prison term for conviction in the federal investor fraud case related to now-defunct clinical laboratory company Theranos, the long-running legal saga of the former company founder/CEO continues to bring new twists.
This time, news emerged via a lawsuit that Holmes allegedly owes $25 million to Theranos creditors. CNBC obtained a copy of the suit and detailed its contents in a March 17 case update.
Theranos ABC, a company set up on behalf of the creditors, alleged in the lawsuit that “Holmes has not made any payments on account of any of the promissory notes,” CNBC reported. The suit was filed in Superior Court of California Count of Santa Clara.
Elizabeth Holmes (above), founder and former CEO of clinical laboratory company Theranos with husband Billy Evans of Evans Hotels. Holmes lives with Evans and the couple’s two children in the area near San Jose, California. Holmes gave birth to her second baby in February, according to People. In January, Holmes was convicted on three counts of wire fraud and one count of conspiracy. In addition to restitution, Holmes has been ordered to spend up to 11 years and three months in prison. (Photo copyright: Axios.)
Holmes Allegedly Issued Three Promissory Notes
The complaint stated that Holmes allegedly executed the following three promissory notes while she was still CEO at Theranos:
August 2011 in the amount of $9,159,333.65.
December 2011 in the amount of $7,578,575.52.
December 2013 in the amount of $9,129,991.10.
A promissory note is a written promise to pay a party a certain sum of money with a specified due date for the repayment of principal and interest.
“Theranos ABC has demanded payment of promissory note one and promissory note two from Holmes, but Holmes has failed to pay any amounts on account of promissory note,” according to the lawsuit, CNBC reported. The first two notes are overdue, and the third note is due in December.
Elizabeth Holmes’ Prison Term Could Be Delayed
News of the lawsuit, which was filed in December 2022, came to light at a court hearing on March 17. During that hearing, Judge Edward Davila heard arguments about whether Holmes should remain free pending her appeal. She is otherwise scheduled to report to prison on April 27 to begin her sentence after being convicted in January 2022 of defrauding Theranos investors.
Davila, who oversaw Holmes’ criminal case, is expected to issue a decision about her freedom during the appeal early this month. The judge is also weighing options for Holmes to pay restitution to her victims.
Prosecutors have asked that she pay back $878 million to Theranos’ former investors and other victims, according to court records reviewed by Dark Daily. The government has argued in court papers that Holmes continues to live a wealthy lifestyle despite her claiming she has no meaningful assets since the collapse of Theranos and her trial.
“Defendant has lived on an estate for over a year where, based upon the monthly cash flow statement defendant provided to the US Probation Office, monthly expenses exceed $13,000 per month,” according to court documents filed by prosecutors ahead of the March 17 hearing. “Defendant asserted that her partner pays the monthly bills rather than her but also listed her significant other’s salary as ‘$0.’”
Holmes’ attorneys argued that the government cannot take an “all or nothing” approach to restitution, and that payments should only be made to investors who testified during the trial, the Associated Press reported.
For Victims, Full Restitution Can Be Rare
The federal Department of Justice (DOJ) acknowledges in its overview of restitution that victims often never collect what they are owed by guilty parties.
“The chance of full recovery is very low,” the DOJ notes. “Many defendants will not have sufficient assets to repay their victims. Many defendants owe very large amounts of restitution to a large number of victims. In federal cases, restitution in the hundreds of thousands or millions of dollars is not unusual. While defendants may make partial payments toward the full restitution owed, it is rare that defendants are able to fully pay the entire restitution amount owed.”
Clinical laboratory professionals will note the irony that one of the biggest convicted fraudsters in US history is now largely attempting to avoid punishments associated with her crimes. If Judge Davila agrees to let Holmes remain free pending her appeal, she could stay out of prison for years and perhaps not have to pay restitution for that length of time as well.
The coming weeks will prove to be pivotal in the final outcome of the case.
Start of ex-Theranos president and COO Sunny Balwani’s federal trial will be pushed to mid-March due to COVID-19 spike in California
Just when most clinical laboratory managers and pathologists thought the guilty verdict in the Elizabeth Holmes fraud case would bring an end to the saga, we learn her chapter in the Theranos story will instead extend another eight months to September when the former Silicon Valley CEO will be sentenced. However, a brand-new chapter will begin in March when the fraud trial of ex-Theranos president and COO Ramesh “Sunny” Balwani begins.
Holmes’ fraud trial concluded on January 3 with the jury convicting her on one count of conspiracy to defraud investors and three counts of wire fraud after seven days of deliberation and nearly four months of trial proceedings.
Holmes remains free on a $500,000 bond while awaiting sentencing.
Elizabeth Holmes is seen above arriving at the US District courthouse in San Jose, Calif. On January 3, the former Theranos CEO was convicted on three counts of wire fraud and one count of conspiracy to defraud investors. US District Judge Edward Davila set Holmes’ sentencing date for September 26. Clinical laboratory directors and pathologists who have closely followed the trial will have to wait eight months for the conclusion of this chapter in the Theranos saga. (Photo copyright: The Guardian.)
“I would be utterly shocked if she wasn’t sentenced to some term of imprisonment,” Amanda Kramer, JD, a former federal prosecutor who is now a partner with New York-based Covington & Burling LLP, told NPR.
“What is the sentence that will deter others who have a failing business from making the choice to commit fraud, rather than owning up to the failings and losing their dream?” she added.
Holmes, 37, faces a possible prison sentence of 20 years in prison as well as a $250,000 fine and possible restitution. But some legal experts expect a much shorter prison sentence for the disgraced CEO, who has no prior criminal history and is a first-time mother of a son born last July.
While sentencing typically takes place within a few months of a verdict being reached in a federal criminal trial, US District Judge Edward Davila set 1:30 p.m. September 26, 2022, as the date for Holmes’ sentencing hearing, according to his order dated January 12.
The Mercury News reported the lengthy delay in sentencing may be due to the start of Balwani’s upcoming trial on identical fraud charges. The delay in Holmes’ sentencing will allow for Balwani’s trial to begin in mid-March after being pushed back one month due to a spike in COVID-19 cases in California, The Mercury News reported.
Judge Davila will preside over Balwani’s trial as well.
Jury Acquits Holmes on Patient-related Charges
Holmes was acquitted of conspiracy to defraud patients of the now-defunct blood-testing laboratory and the jury failed to reach a unanimous decision on three other wire fraud charges.
University of Michigan Law Professor Barbara McQuade, a former US Attorney and an NBC News Legal Analyst, told CNBC she expects prosecutors to rethink their strategy in the Balwani trial based on the jury’s acquittal of Holmes on conspiracy and fraud charges involving Theranos patients.
“Knowing that this jury acquitted on all of the patient counts, I think that strategically, they should look to find a more direct way to explain why that is part of the fraud, that they necessarily knew that ultimately patients would be defrauded. And that although they didn’t know these individual patients by name, they knew that they existed in concept,” McQuade said.
One of the jurors in the Holmes’ trial, Wayne Kaatz, told ABC News he and other jurors were dismayed by their inability to come to a unanimous consensus on the three of the charges. A mistrial was declared on those three counts.
“We were very saddened,” Kaatz said. “We thought we had failed.”
Did Holmes Charm the Jury?
When Holmes dropped out of Stanford at age 19 to form Theranos, her goal, she claimed during testimony, was to transform healthcare by creating a blood-testing device capable of performing hundreds of clinical laboratory tests using a finger-stick of blood. She became a Silicon Valley sensation because of her charisma and charm, which she used to sell her dream to big money investors such as Oracle co-founder Larry Ellison and former US Secretary of State George Shultz.
Kaatz acknowledged Holmes’ personality also impacted the jury.
“It’s tough to convict somebody, especially somebody so likable, with such a positive dream,” Kaatz explained to ABC News, noting, however, that he voted guilty on the three counts on which the jury could not agree. “[We] respected Elizabeth’s belief in her technology, in her dream. [We thought], ‘She still believes in it, and we still believe she believes in it.’”
In the light of Holmes’ conviction, McQuade suggested it would not be shocking to see Balwani consider a plea deal in exchange for a lighter sentence.
“Could we perhaps, enter a guilty plea and get a reduction for acceptance of responsibility?” she said. “It’s certainly something that you have to look at.”
And so, the saga continues. Clinical laboratory directors and pathologists who followed Holmes’ trial with rapt interest should prepare for a new set of twists and turns as Ramesh Balwani prepares to face his own day in court.
As a Theranos insider and whistleblower, Tyler Schultz was able to provide information about the ongoing failures in medical laboratory testing at the once-high-flying Theranos to regulators and at least one journalist
What’s it like to be a whistleblower in a high-profile clinical laboratory? Few clinical laboratory workers will ever know. But former Theranos employee Tyler Shultz does know, after helping to expose the Silicon Valley blood-testing startup’s deceptions.
The 31-year-old Shultz reportedly celebrated the news of former Theranos CEO Elizabeth Holmes’ conviction on four charges of defrauding investors with champagne, joy, and a healthy dose of vindication, according to NPR.
“This story has been unfolding for pretty much my entire adult life,” Tyler Shultz (above), whistleblower in the Elizabeth Holmes fraud trial, told NPR from his parents’ home in Silicon Valley. “All of a sudden, it was just a weight was lifted. It’s over. I can’t believe it’s over,” he added. A former employee of now defunct clinical laboratory company Theranos, Shultz is CEO at Flux Biosciences, a company he co-founded. (Photo copyright: Deanne Fitzmaurice/NPR.)
Shultz Interns Briefly at Theranos
In 2011, Shultz was a biology major at Stanford University—where Elizabeth Holmes herself briefly attended—when his grandfather, former US Secretary of State George Shultz, a Theranos board member, introduced him to Holmes.
According to NPR, the younger Shultz was so impressed by the charismatic Holmes that he asked her if he could intern with Theranos after his junior year. Following his internship, he accepted a full-time position as a research engineer with Theranos, a stint that lasted only eight months. Shultz quit Theranos the day after he emailed Holmes in 2014 to alert her to failed quality-control checks and other troubling practices within the company’s clinical laboratory.
According a 2016 profile of Shultz in The Wall Street Journal (WSJ), his email to Holmes resulted in a “blistering” reply from then-Theranos President and COO Ramesh “Sunny” Balwani, who “belittled Shultz’s grasp of basic mathematics and his knowledge of laboratory science.”
Yet, Shultz told NPR, “It was clear that there was an open secret within Theranos that this technology simply didn’t exist.”
After leaving Theranos, Shultz became a key source for the WSJ’s 2015 exposé of Theranos. Using an alias, he also contacted state regulators in New York about the Theranos Edison blood-testing device’s shortcomings. In response, Theranos responded with threats of lawsuits and intimidation, the WSJ reported.
In an interview with CBS News, Shultz said, “I am happy that she was found guilty of these crimes and I feel like I got my vindication from that, and I feel good about that.”
Whistleblowers Were Critical to WSJ’s Investigation
Former WSJ reporter John Carreyrou, who authored the newspaper’s investigative series into Theranos, credits the Theranos whistleblowers for blowing the cover on the clinical lab company’s deceptions.
“I would not have been able to break this story without Rosendorff, Tyler, and Erika,” Carreyrou told NPR, referring to Shultz and two additional Theranos whistleblowers: one-time Theranos Laboratory Director Adam Rosendorff and laboratory associate Erika Cheung. “Tyler and Erika were corroborating sources, and that was absolutely critical.”
In the interview with CBS News, Tyler described the damage his role as a Theranos whistleblower caused to his relationship with his grandfather, former Secretary of State and Theranos board member George Shultz. Tyler said the elder Shultz did not believe his claims about Theranos’ regulatory deficiencies and the Edison device’s shortcomings until he neared the end of his life.
“That was extremely tough. This whole saga has taken a financial, emotional, and social toll on my relationships. The toll it took on my grandfather’s relationship was probably the worst. It is tough to explain. I had a few very honest conversations with him,” Shultz told CBS News.
While the elder Shultz never apologized to his grandson, Tyler said his grandfather ultimately acknowledged he was right.
“In one of my last conversations with him he told me a story about how he got Elizabeth invited during fleet week in San Francisco to go give a speech to United States Navy sailors. He said with tears in her eyes, she told the room about how she was so honored and humbled that her life’s work would be saving the lives of United States servicemen and women,” Shultz recalled in the CBS News interview.
“He said he could not believe that anybody could get in front of these men and women who are willing to put their lives in front of our country and lie directly to their face as convincingly as she lied,” he added.
George Shultz died in February 2021.
Jury’s Ruling on Defrauding Patients
In an interview with CNBC, Shultz said his one disappointment with the verdict was that Holmes was not found guilty of defrauding patients. Calling the patients “the real victims,” Shultz said, “I did what I did. I stuck my neck out to protect those patients, not to protect Betsy DeVos’ $100 million investment.” (The jury voted Holmes guilty on three counts of wire fraud and one count of conspiracy to commit fraud against Theranos’ investors, but not guilty on conspiracy to defraud and commit wire fraud against Theranos patients.)
Tyler Shultz was listed as a potential witness in the Holmes trial but was not called to take the stand. He—along with many clinical laboratory directors and pathologists who have closely followed the Holmes trial—will now await news of Holmes’ sentencing. Holmes could face up to 20 years in prison for each guilty verdict, but she’s likely to receive a lighter sentence.
The trail of Ramesh Balwani is expected to begin sometime in March. That trial can be expected to produce additional revelations about the problems of Theranos and how and why management is alleged to have knowingly reported inaccurate clinical laboratory test results to thousands of patients.
