99 articles · Healthcare · page 4 of 5
Articles
Week of 3 October 2022
Five principles, three committees: the AI blueprint inside a hospital
In 2022 the White House published five principles for fair, safe AI. They sounded new, but hospitals already practiced most of them under other names. Extending trusted clinical committees to algorithms worked better than building a separate AI bureaucracy.
Week of 1 August 2022
Why buying the same software as your neighbors removes your fallback
Ransomware at one NHS software supplier knocked urgent care systems offline across many providers at once, and neighbors could not cover for each other because they ran the same product. U.S. health systems buying shared software face the same exposure.
Article · 21 June 2022 · Simon Malian
The Rising Threat of Medical Device Hacking & How Healthcare Organizations Can Prevent It
All attacks on the healthcare industry are vital to address. We believe the most pressing area to mitigate is the hacking of medical devices.
Week of 20 June 2022
Dobbs moved health privacy risk outside the medical record
After the Supreme Court’s abortion decision, attention went first to medical records, where HIPAA already set rules. The bigger exposure for health systems lay at their own digital edges, and in consumer data they never held but patients assumed was protected.
Week of 13 June 2022
Internet Explorer retired; its clinical applications did not
Internet Explorer was retired, but hospitals’ old clinical web applications were not. A compatibility mode in Edge kept them running, and the list it required became a ready-made map of legacy risk, best worked down by who could fix each site.
Week of 30 May 2022
No patch yet: Follina and Confluence tested who may switch things off
Two security holes were being exploited before any fix existed, leaving health systems with workarounds only. What decided the outcome was organizational: who could authorize switching something off, who could actually do it everywhere, and who checked that it worked.
Week of 11 April 2022
Ninety days at a time: telehealth’s stack of temporary permissions
In April 2022, another 90-day renewal of the public health emergency kept telehealth running on borrowed time. Patients saw one service. Underneath, health systems had to manage separate permissions with different owners and end dates, and tell patients which one their visit relied on.
Week of 28 March 2022
Spring4Shell rewarded hospitals that could size a response in hours
Four months after Log4Shell, a Java flaw with a similar nickname set off fresh alarm, and early reports mixed it up with another bug. Its narrow conditions tested whether tired hospital IT teams could size a response in hours.
Week of 21 March 2022
A support engineer two contracts away: Okta, Lapsus$ and the hospital front door
In March 2022, Okta revealed that a support engineer at one of its subcontractors had been compromised. For hospitals that run every clinical login through one identity provider, the real exposure was two months of silence, and the logs they never kept.
Week of 14 March 2022
Why hospitals could prepare for CIRCIA before CISA wrote its rule
The cyber incident reporting law signed in March 2022 set two deadlines in statute and left who is covered to a rulemaking that would take years. The decisions those deadlines force, inside a hospital’s incident command, never depended on the rule’s details.
Week of 10 January 2022
Surveyors counted the people hospitals don’t employ: the CMS staff rule after the Supreme Court
Once the Supreme Court let the CMS staff vaccination rule stand, the test became: could a hospital show a surveyor everyone who counted as staff, including contractors, students and practitioners it didn’t employ? Few had a single list that reached past the payroll.
Week of 27 December 2021
Why good-faith estimates weighed most on the therapist’s office
From January 1, 2022, every state-licensed provider owed uninsured and self-pay patients a written price estimate before scheduled care. Hospitals had billing teams to absorb it. Therapists and small practices, where self-pay is common and treatment has no fixed end, mostly did not.
Week of 20 December 2021
Oracle bought Cerner, and Cerner customers inherited a cloud strategy
Oracle’s December 2021 deal to buy Cerner gave hospitals running Cerner’s records a new owner with its own database, cloud and priorities. What mattered next was roadmap, hosting and contract terms, and when to act on each.
Week of 22 November 2021
Omicron’s scarcest resource was staff, and few hospitals could count them in real time
When Omicron arrived in late November 2021, hospitals braced for a flood of patients. What actually ran out that winter was staff able to work, and every hard decision hinged on how fast leaders could piece together who was available from scattered systems.
Week of 27 September 2021
Trust nobody owned: the expired root certificate and hospital legacy clients
On September 30, 2021, a widely used root certificate expired. The websites were fine; the old software talking to them broke. In hospitals, the trouble hid in devices and integrations whose trust lists nobody owned or even knew about.
Week of 13 September 2021
A breach with no attacker: the FTC’s warning to health apps
In September 2021 the FTC said a health app that shares users’ data without permission has suffered a breach. That moved breach prevention out of the security team and into three business decisions: what code ships, what partners receive, what users agreed to.
Week of 30 August 2021
Hurricane Ida and the IT dependencies that sit under the EHR
Hurricane Ida knocked out Louisiana’s grid and phone networks, and hospitals ran on generators for days. The week tested three layers hidden beneath the electronic health record, each owned by a different team: power, connectivity and hosting.
Week of 19 July 2021
How a bed-count fine repriced hospital price secrecy
In July 2021, CMS proposed tying hospital price transparency fines to bed count, so the biggest systems could no longer cheaply pay to keep their rates hidden. Compliance became a permanent data product, read most closely by payers, employers and competitors rather than patients.
Week of 12 July 2021
A permanent telehealth benefit with an in-person clock attached
Medicare’s July 2021 proposal made home telehealth for mental health the first permanent post-pandemic benefit. Its conditions turned continuity of care into a record-keeping task: where the patient is, how the visit happens, and when they were last seen in person.
Week of 17 May 2021
Ireland’s HSE attack was decided in the eight weeks before encryption
Ireland’s health service is remembered for the morning its hospitals went to paper. The independent review told a less dramatic, more useful story: the outcome was settled during nearly eight unnoticed weeks, across three stages of entry, dwell and response.