Cybersecurity

Protecting our customers with cybersecurity vigilance.

graphic of a virtual lock on a digital background

Konica Minolta Healthcare Americas is committed to providing exceptional healthcare solutions to our customers by deploying cutting edge software, systems, and services. We know that our customers depend on us, now more than ever, as we face not only a pandemic but also persistent cybersecurity threats in healthcare. 

We are continuously vigilant and take cybersecurity seriously, understanding that surfacing these risks is the responsibility of all of us. In 2023, Konica Minolta Healthcare Americas achieved 2-year HiTrust Certification. This site is developed as a resource for our customers to share information relevant to securing patient data in your operations
 

lock graphic image

A Message for our Customers

As the Covered Entity your company has the responsibility to protect its PACS system (Exa server) and all interconnecting networks that house PHI data. Please ensure that your organization has the appropriate physical security and cybersecurity deployed to safeguard your PHI data from breach or ransomware. These measures should be aligned to your organizations risk acceptance and privacy rule standards, under the HIPAA regulatory requirements, from the Department of Health and Human Services (“HHS”).

These safeguards include but are not limited to:

  1. Reasonable perimeter security (area access restrictions)
  2. Appropriate network segmentation
  3. Multiple firewalls and routers
  4. Data encryption at any points of PHI. “at rest” and “in transit”
  5. Appropriate endpoint protection. AV/Malware protection, Endpoint Detection and Response EDR
  6. An appropriate Disaster Recovery and Business Continuity (DRBC) plan that is tested regularly to ensure it will work properly in the event of ransomware attack or system failure

At no time should you have port 104 (or any other port) open directly to the internet without a robust and up-to-date VPN that uses 256 AES data encryption.

graphic of a virtual lock floatingover a tablet computer
graphic of a lock symbol on a tile

Current CVE’s

Current Common Vulnerabilities and Exposures (CVE) Information and Investigations for Konica Minolta Products

Apache Log4j (CVE-2021-44228) – Apache Software Library Vulnerability
December 13th, 2021
U.S. Cybersecurity & Infrastructure Security Agency (CISA)

Apache Log4j (CVE-2021-44228) – Apache Software Library Vulnerability

KMHA is aware of the vulnerability CVE-2021-44228 that affects Apache Log4j* software library. If exploited, this vulnerability allows remote code execution on vulnerable systems. Information on the CVE-2021-44228 can be found here: https://www.cisa.gov/uscert/ncas/current-activity/2021/12/13/cisa-creates-webpage-apache-log4j-vulnerability-cve-2021-44228

KMHA is actively assessing products that may utilize Apache Log4j to determine possible impact. Additional information will be available upon completion of analysis and testing. Our preliminary investigation has identified that most products are not impacted. We ask customers to please follow up with any 3rd party software, vendors or integrators in their environment, to determine if those products are affected or not.

Note: This is a global issue, and we ask that each customer also evaluate their exposure with all 3rd party software products in their environment, Customers should follow the appropriate guidance measures and technical bulletins published.

Please Contact the Call Center 1 (800) 945-0456 to inquire about this vulnerability and any impact to your Konica Minolta System.

* This vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. NIST National Vulnerability Database ****

Download the Technical Brief

 

Latest News

Cybersecurity Related Alerts, News & Updates

Weekly summaries of new vulnerabilities along with patch information from CISA & US-CERT
CISA logo
Beckhoff Automation TwinCAT Package Manager
published on:
November 7th, 2024 - 7:00 AM
Read the full bulletin
Rockwell Automation FactoryTalk ThinManager
published on:
October 31st, 2024 - 8:00 AM
Read the full bulletin
Foreign Threat Actor Conducting Large-Scale Spear-Phishing Campaign with RDP Attachments
published on:
October 31st, 2024 - 8:00 AM
Read the full bulletin
Fortinet Updates Guidance and Indicators of Compromise following FortiManager Vulnerability Exploitation
published on:
October 30th, 2024 - 8:00 AM
Read the full bulletin

For all CISA mailing lists and feeds see their website.

HIPAA logo

Security & Privacy Environments

Summary of the HIPAA Privacy Rule
May 4th, 2020
U.S. Department of Health & Human Services

Who is covered? What information is protected? How protected health information can be used and disclosed?

HIPAA
February 1st, 2021
ecFirst

Infographic explaining HIPAA covered entities

Cybersecurity Education & Training

Cyber Attack Quick Response Infographic
U.S. Department of Health & Human Services

This Cyber-Attack Quick Response guide will explain steps that a HIPAA covered entity or its business associate should take to respond to a ransomware or other cyber-related attack.

man with a floating globe made of screen images
cybersecurity abstract design

Best Practices

ACR Bulletin: Recovery Mode
February 23rd, 2021
American College of Radiology

Cyber attacks have ramped up in recent years, and radiology practices must be prepared to respond decisively to potential breaches.

USFCR Verified Vendor