Healthcare Data Breach Settlement: Hardening Defenses for PHI Protection and HIPAA Compliance

---
title: Suspicious Bulk Access to Patient Records Database
id: healthcare-bulk-patient-access-2026-001
status: experimental
description: Detects unusual bulk access patterns to patient databases indicating potential data harvesting. References: HIPAA Security Rule §164.312(b) access controls.
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
  - healthcare.phi
logsource:
  category: database
  product: mssql
detection:
  selection:
    DatabaseName|contains:
      - 'patient'
      - 'phi'
      - 'emr'
      - 'ehr'
      - 'medical'
    Statement|contains:
      - 'SELECT'
  filter_high_volume:
    Count|gt: 500
  timeframe: 5m
condition: selection and filter_high_volume
falsepositives:
  - Legitimate bulk reporting queries during scheduled reporting windows
  - Database maintenance activities
level: high
---
title: Potential PHI Data Exfiltration via Uncommon Protocols
id: healthcare-phi-exfiltration-2026-002
status: experimental
description: Detects potential exfiltration of healthcare data through unusual protocols or endpoints. References: NIST CSF PR.IP-4.
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
  - healthcare.dlp
logsource:
  category: network_connection
  product: windows
detection:
  selection_suspicious_ports:
    DestinationPort:
      - 21
      - 22
      - 23
      - 8443
  selection_suspicious_processes:
    Image|endswith:
      - '\\powershell.exe'
      - '\\cmd.exe'
      - '\\python.exe'
      - '\\php.exe'
  selection_suspicious_keywords:
    CommandLine|contains:
      - 'patient'
      - 'medical'
      - 'phi'
      - '.csv'
      - '.xls'
      - 'compress'
      - 'archive'
  condition: 1 of selection*
falsepositives:
  - Legitimate administrative file transfers
  - Authorized backup operations
level: medium
---
title: Unusual Authentication Patterns for Healthcare Applications
id: healthcare-auth-anomaly-2026-003
status: experimental
description: Detects anomalous authentication patterns to healthcare applications indicating potential credential compromise. References: MITRE ATT&CK T1078.
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1078.004
  - healthcare.auth
logsource:
  category: authentication
  product: windows
detection:
  selection_healthcare_app:
    TargetUserName|contains:
      - 'meditech'
      - 'epic'
      - 'cerner'
      - 'allscripts'
      - 'athena'
  selection_off_hours:
    EventID: 4624
    TimeGenerated between 22:00 AND 06:00
  selection_failed_attempts:
    EventID: 4625
  selection_new_device:
    WorkstationName|startswith: 'UNKNOWN'
  condition: selection_healthcare_app and 1 of selection*
falsepositives:
  - Legitimate after-hours clinician access for emergencies
  - Valid roaming user authentications
level: medium

// Hunt for bulk patient record access indicating potential data harvesting
let threshold = 500;
let timeWindow = 5m;
let sensitiveTables = dynamic(['patient', 'clients', 'patients', 'admissions', 'treatment', 'phi']);
Syslog
| where Facility in ('MSSQL', 'PostgreSQL', 'MySQL')
| extend TableMatch = column_ifexists(\"Message\", \"\")
| parse SyslogMessage with * \"SELECT\" Statement
| where Statement has_any(sensitiveTables)
| summarize Count = count() by SourceIP, UserName, bin(TimeGenerated, timeWindow)
| where Count > threshold
| extend RiskScore = iff(Count > threshold * 2, \"Critical\", \"High\")
| project TimeGenerated, SourceIP, UserName, Count, RiskScore
| order by Count desc


// Detect potential PHI exfiltration via web upload endpoints
let fileExtensions = dynamic(['.csv', '.xls', '.xlsx', '.', '.xml', '.zip', '.7z', '.rar']);
DeviceNetworkEvents
| where ActionType in ('ConnectionAccepted', 'ConnectionSuccess')
| where RemotePort in (80, 443, 8080, 8443)
| where InitiatingProcessFileName in ('powershell.exe', 'cmd.exe', 'winrar.exe', '7z.exe', 'curl.exe', 'wget.exe')
| extend RequestURL = tostring(RequestURL)
| where RequestURL has_any(fileExtensions) or InitiatingProcessCommandLine has_any(fileExtensions)
| where InitiatingProcessCommandLine has_any('patient', 'medical', 'phi', 'client', 'treatment')
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteURL, RemoteIP
| order by Timestamp desc

-- Hunt for processes accessing sensitive patient data files
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'powershell.exe'
   OR Name =~ 'python.exe'
   OR Name =~ 'php.exe'
   OR Name =~ 'cmd.exe'

-- Correlate with file handles to patient directories
LET suspiciousHandles = SELECT *
FROM handles(pid=Pid)
WHERE Name =~ 'patient'
   OR Name =~ 'PHI'
   OR Name =~ 'medical'
   OR Name =~ 'emr'
   OR Name =~ 'client'

SELECT P.Pid, P.Name, P.CommandLine, P.Username, H.Name as AccessedFile, P.CreateTime
FROM pslist() AS P
LEFT JOIN suspiciousHandles AS H ON P.Pid = H.Pid
WHERE H.Name IS NOT NULL


-- Scan for potential data staging artifacts common in PHI exfiltration
SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs=\"/*\")
WHERE Name =~ 'patient'
   OR Name =~ 'PHI'
   OR Name =~ 'export'
   OR Name =~ 'backup'
   AND (Name =~ '.zip' OR Name =~ '.csv' OR Name =~ '.xls' OR Name =~ '.rar')
   AND Size > 1000000  -- Files larger than 1MB

# Healthcare PHI Access Control Hardening Script
# Run with elevated privileges

Write-Host \"[+] Starting Healthcare PHI Hardening Audit...\" -ForegroundColor Cyan

# 1. Audit Database Access Controls
Write-Host \"[*] Auditing SQL Server access controls...\" -ForegroundColor Yellow
$sqlInstances = Get-Service -Name \"MSSQL*\" | Where-Object {$_.Status -eq 'Running'}
foreach ($instance in $sqlInstances) {
    Write-Host \"    Found SQL Server Instance: $($instance.DisplayName)\" -ForegroundColor Green
    # TODO: Implement SQL-specific audit queries per environment
}

# 2. Review Recent Failed Authentication Attempts
Write-Host \"[*] Checking for recent failed authentication patterns...\" -ForegroundColor Yellow
$failedEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
if ($failedEvents) {
    $failedSummary = $failedEvents | Group-Object -Property {$_.Properties[5].Value} | Where-Object {$_.Count -gt 5}
    foreach ($account in $failedSummary) {
        Write-Host \"    ALERT: Account '$($account.Name)' had $($account.Count) failed logons\" -ForegroundColor Red
    }
} else {
    Write-Host \"    No excessive failed logons detected\" -ForegroundColor Green
}

# 3. Audit File Access Permissions on PHI Directories
Write-Host \"[*] Auditing PHI directory permissions...\" -ForegroundColor Yellow
$phiPaths = @(
    \"C:\\Program Files\\EHR\",
    \"C:\\PHI\",
    \"C:\\PatientRecords\",
    \"D:\\MedicalRecords\"
)

foreach ($path in $phiPaths) {
    if (Test-Path $path) {
        Write-Host \"    Auditing: $path\" -ForegroundColor Green
        $acl = Get-Acl -Path $path
        $accessRules = $acl.Access | Where-Object {$_.AccessControlType -eq 'Allow'}
        foreach ($rule in $accessRules) {
            if ($rule.IdentityReference -notmatch \"^(BUILTIN\\\Administrators|NT AUTHORITY\\\SYSTEM|DOMAIN\\\EHR-Admins)\") {
                Write-Host \"      WARNING: Non-admin access granted to $($rule.IdentityReference) - $($rule.FileSystemRights)\" -ForegroundColor Red
            }
        }
    }
}

# 4. Enable Enhanced Auditing for PHI Access
Write-Host \"[*] Configuring enhanced audit policies...\" -ForegroundColor Yellow
auditpol /set /subcategory:\"File System\" /success:enable /failure:enable | Out-Null
auditpol /set /subcategory:\"Logon\" /success:enable /failure:enable | Out-Null
auditpol /set /subcategory:\"Object Access\" /success:enable /failure:enable | Out-Null
Write-Host \"    Enhanced audit policies configured\" -ForegroundColor Green

Write-Host \"[+] Hardening audit complete. Review warnings and take corrective action.\