99 articles · Healthcare · page 3 of 5
Articles
Week of 11 December 2023
For hospitals, HTI-1’s model cards covered only the EHR vendor’s own algorithms
In December 2023, a federal health IT rule made electronic record vendors explain the predictive tools they supply. For models a hospital built itself or bought elsewhere, the record system only had to hold the information, and the hospital had to produce it.
Week of 4 December 2023
HHS could mandate hospital cybersecurity on its own; paying for it needed Congress
In December 2023, HHS sketched a cybersecurity baseline for hospitals, two ways to make it binding and incentives that needed Congress. Rules could arrive on the agency’s own timetable; the money could not. Hospitals had to plan for that gap.
Week of 27 November 2023
Ardent took one network offline, and emergency departments in six states had to answer for it
Over Thanksgiving 2023, Ardent Health took its network offline to fight ransomware. The decision was made centrally but felt locally, in hospitals carrying partners’ names across six states. Multi-state operators need those lines of authority settled before the next holiday weekend.
Week of 23 October 2023
How a troubleshooting file handed over an administrator’s session in the Okta breach
Attackers inside Okta’s support system reused live sign-in tokens found in files customers had uploaded for troubleshooting. Health systems send vendors logs and screenshots daily, and each one’s risk depends on what it contains, what HIPAA says it is, and how long it stays usable.
Week of 2 October 2023
Fourteen thousand accounts, 6.9 million people: the 23andMe ratio every health data platform should measure
Attackers walked into a sliver of 23andMe accounts and, through a feature that connects relatives, reached data on millions. Health systems run portals, proxy access and research platforms with the same arithmetic: weak sign-in, generous sharing, and data whose protections change hands.
Week of 28 August 2023
Medicare’s negotiated prices would reach hospital pharmacies as refunds, and refunds have float
Medicare named its first ten drugs for price negotiation in August 2023. Hospitals with their own pharmacies inherited three problems with three different owners: the cash a refund ties up, the tangle with 340B, and the reconciliation systems both depend on.
Week of 31 July 2023
Prospect Medical’s ransomware attack ended up on the table in a hospital sale
Ransomware hit Prospect Medical Holdings in August 2023, striking an operator already short of money and midway through selling three Connecticut hospitals. For operators like that, cyber resilience becomes a balance-sheet and deal term, priced by buyers, lenders and state approvers.
Week of 10 July 2023
HCA’s data on 11 million patients sat in an email-formatting store, outside the EHR’s controls
HCA Healthcare’s 2023 breach came not from its clinical systems but from storage used to format patient emails. Outreach data looks harmless field by field, yet together it is protected health information and deserves the same care as the medical record.
Week of 15 May 2023
The FTC’s breach rule proposal drew the HIPAA line through the middle of a data flow
One patient’s health data can answer to different regulators as it moves from a hospital to a consumer product to an app. The FTC’s May 2023 proposal spelled out where those lines fall, and why sharing with advertisers can count as a breach.
Week of 8 May 2023
After the emergency, telehealth’s rules landed on clinicians one deadline at a time
The COVID-19 emergency ended in May 2023, and telehealth’s pandemic flexibilities unwound on schedules set separately by Congress, the DEA, OCR and the states, each landing on a different workforce question: what clinicians may prescribe remotely, where they may practice, which tools they may use.
Week of 17 April 2023
HIPAA’s reproductive health proposal asked records to know what they hold
OCR’s April 2023 proposal turned on why information was requested, not what it was. Yet it, and the state laws that followed, assumed a health system could find sensitive details in a record and keep them labeled. Few could.
Week of 20 March 2023
A chatbot’s history sidebar is a records system with someone else’s retention policy
OpenAI’s March 2023 bug was small as breaches go, but it showed health systems that every staff conversation with an AI assistant is stored data held by a vendor. HIPAA’s familiar questions follow: what goes in, how long it stays, who sees it.
Week of 27 February 2023
BetterHelp’s intake form was a privacy promise the ad stack broke
The FTC’s BetterHelp case involved a company outside HIPAA, yet it reached every health organization with a website or app. What patients are told at sign-up is a promise, and the tracking tools behind the page must be built to keep it.
Week of 13 February 2023
Why a file-transfer server belongs on the list of systems that hold PHI
The GoAnywhere breach reached patient data through file-transfer software most health systems saw as mere plumbing. In fact it is a store of sensitive data with its own exposure, retention and accountability, and it deserves the care given to any core system.
Week of 23 January 2023
Hive’s takedown removed a supplier, not the ransomware market
The FBI’s covert takedown of the Hive ransomware group spared many victims, hospitals among them, from paying. But it removed one criminal brand. The hired attackers, their methods and the hospital weaknesses they exploited were untouched, and each needed a different response.
Week of 26 December 2022
Section 524B gave hospitals a baseline to buy against
A spending law signed in December 2022 told medical device makers to build in cybersecurity. It never mentioned hospitals, yet it handed them something they had long lacked: a federal baseline to cite when choosing devices and writing contracts. Older equipment stayed where it was.
Week of 28 November 2022
Hospital websites had a HIPAA problem because nobody owned the tags
OCR’s December 2022 bulletin on tracking code created no new rule. What it exposed was a gap in who was in charge: the scripts on hospital websites and portals sat with marketing teams and agencies, outside the controls protecting every other system holding patient data.
Week of 14 November 2022
What Hive’s victims gained by calling the FBI early
The FBI had held Hive ransomware’s decryption keys for months when federal agencies warned health care about the gang, and victims who reported got them. Health systems should decide now when to call, what to share and how reporting fits their other deadlines.
Week of 31 October 2022
How hospitals spent the OpenSSL week waiting for ‘not affected’
A week’s warning of a critical OpenSSL flaw should have made the answer easy. For health systems, it hinged on suppliers saying their products were not affected, and few hospitals could get that reassurance quickly, in usable form, or at all.
Week of 10 October 2022
In a merged health system, the network decides which hospitals go to paper
Ransomware at CommonSpirit Health in 2022 sent some of its hospitals to paper for weeks while others carried on. In a merged health system, shared logins, shared networks and who can order a shutdown decide how far one attack spreads.