Document Download
Global
Cybersecurity:
Keeping You Informed
Konica Minolta Healthcare Americas is committed to providing exceptional healthcare solutions to our customers by deploying cutting edge software, systems, and services. We know that our customers depend on us, now more than ever as we face not only a pandemic but also persistent cybersecurity threats in healthcare.
We are continuously vigilant and take cybersecurity seriously, understanding that surfacing these risks is the responsibility of all of us. This site is developed as a resource for our customers to share information relevant to securing patient data in your operations.
A Message for our Customers
As the Covered Entity your company has the responsibility to protect its PACS system (Exa server) and all interconnecting networks that house PHI data. Please ensure that your organization has the appropriate physical security and cybersecurity deployed to safeguard your PHI data from breach or ransomware. These measures should be aligned to your organizations risk acceptance and privacy rule standards, under the HIPAA regulatory requirements, from the Department of Health and Human Services (“HHS”).
These safeguards are (but not limited to):
- Reasonable perimeter security (area access restrictions).
- Appropriate network segmentation.
- Multiple firewalls and routers.
- Data encryption at any points of PHI. “At rest” and “in transit”.
- Appropriate endpoint protection. AV / Malware protection, Endpoint Detection and Response EDR.
- An appropriate Disaster Recovery and Business Continuity (DRBC) plan that is tested regularly to ensure it will work properly in the event of ransomware attack or system failure.
At no time should you have port 104 (or any other port) open directly to the internet without a robust and up to date VPN that uses 256 AES data encryption.
Current CVE’s
Current Common Vulnerabilities and Exposures (CVE) Information and Investigations for Konica Minolta Products
-
December 13, 2021
U.S. Cybersecurity & Infrastructure Security Agency (CISA) Website Link
Apache Log4j (CVE-2021-44228) – Apache Software Library Vulnerability
KMHA is aware of the vulnerability CVE-2021-44228 that affects Apache Log4j* software library. If exploited, this vulnerability allows remote code execution on vulnerable systems. Information on the CVE-2021-44228 can be found here: https://www.cisa.gov/uscert/ncas/current-activity/2021/12/13/cisa-creates-webpage-apache-log4j-vulnerability-cve-2021-44228
KMHA is actively assessing products that may utilize Apache Log4j to determine possible impact. Additional information will be available upon completion of analysis and testing. Our preliminary investigation has identified that most products are not impacted. We ask customers to please follow up with any 3rd party software, vendors or integrators in their environment, to determine if those products are affected or not.
Note: This is a global issue, and we ask that each customer also evaluate their exposure with all 3rd party software products in their environment, Customers should follow the appropriate guidance measures and technical bulletins published.
Please Contact the Call Center 1 (800) 945-0456 to inquire about this vulnerability and any impact to your Konica Minolta System.
* This vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. NIST National Vulnerability Database ****
Download the Technical Brief
Cybersecurity Related Alerts, News & Updates
-
Vulnerability Summary for the Week of May 9, 2022on May 16, 2022 at 1:55 pm
Original release date: May 16, 2022 High Vulnerabilities Primary Vendor -- Product Description Published […]
-
Vulnerability Summary for the Week of May 2, 2022on May 9, 2022 at 10:20 am
Original release date: May 9, 2022 | Last revised: May 11, 2022 High Vulnerabilities Primary Vendor -- Product […]
-
Vulnerability Summary for the Week of April 25, 2022on May 2, 2022 at 10:16 am
Original release date: May 2, 2022 High Vulnerabilities Primary Vendor -- Product Description Published […]
-
Vulnerability Summary for the Week of April 18, 2022on April 25, 2022 at 10:37 am
Original release date: April 25, 2022 | Last revised: April 26, 2022 High Vulnerabilities Primary Vendor -- Product […]
For all CISA mailing lists and feeds see their website.
Security & Privacy Environments
-
February 1, 2021
ecFirst Download File
HIPAA Fundamentals – An introduction to the fundamentals of HIPAA compliance.
-
February 1, 2021
ecFirst Download File
HIPAA Covered Entities – An Infographic
-
February 1, 2021
ecFirst Download File
HIPAA Business Associate — An Infographic
-
February 1, 2021
U.S. Department of Health & Human Services Download File
HIPAA Security Rule Crosswalk to NIST Cybersecurity Framework
-
May 3, 2020
U.S. Department of Health & Human Services Download File
Summary of the HIPAA Privacy Rule – Who is covered? What information is protected? How protected health information can be used and disclosed?
Cybersecurity Education & Training
-
April 11, 2021
U.S. Cybersecurity & Infrastructure Security Agency Website Link
CISA Security Tip (ST19-001) — Protecting Against Ransomware
-
February 1, 2021
ecFirst Download File
Ransomware: Fast Facts – An Infographic
-
February 1, 2021
U.S. Department of Health & Human Services Website Link
Ransomware Guidance from U.S. Department of Health & Human Services
-
February 1, 2021
U.S. Department of Health & Human Services Download File
Quick-Response Checklist from the HHS, Office for Civil Rights (OCR)
-
June 7, 2011
U.S. Department of Health & Human Services Download File
Cyber Attack Quick Response
Best Practices
-
February 23, 2021
ACR Bulletin: Recovery ModeAmerican College of Radiology Website Link
Cyber attacks have ramped up in recent years, and radiology practices must be prepared to respond decisively to potential breaches.
-
June 27, 2019
ACR Bulletin: Under AttackAmerican College of Radiology Website Link
Radiologists must make cyber security a priority to protect their businesses and patient data.
Contact Konica Minolta Healthcare Americas about Cybersecurity
AeroDR®, AeroSync®, DRYPRO®, FlexDR®, IMAGEPILOT®, informity®, IQUE®, PrintLink®, REGIUS®, SONIMAGE®, and Xpress CR® are registered marks of Konica Minolta Healthcare Americas, Inc.
AeroRemote™, KDR™, SKR™, SNIBLE™, SNV™, T2HI™, VIRSERBEST™, VIZION™, EXA™ and OPAL-RAD™ are registered trademarks of Konica Minolta Healthcare Americas, Inc.