99 articles · Healthcare · page 5 of 5
Articles
Week of 3 May 2021
Four weeks on paper: what Scripps exposed about downtime plans
After a ransomware attack, Scripps Health spent most of May 2021 without its electronic health record. Downtime plans written for hours failed over weeks on three separate fronts: keeping care safe, keeping revenue flowing and keeping staff going.
Week of 12 April 2021
Microsoft and Nuance: the recording is the asset to govern
Microsoft’s April 2021 deal for Nuance put software that listens to doctor visits inside a giant cloud platform. For health systems, the decisions that mattered concerned the recording itself, who checks the draft note, and the contract governing both.
Week of 5 April 2021
Information blocking compliance lived in EHR defaults
The federal ban on information blocking took effect on April 5, 2021, and health systems found that compliance was decided less by policy than by portal settings and records queues. Three questions mattered: what gets released, when, and how withholding is defended.
Week of 4 January 2021
Credit for security practice, payable only in arrears
Signed on January 5, 2021, a short HITECH amendment told regulators to go easier on breached organizations with recognized security practices. The catch: it takes a year of practice already running, so the credit is earned only before an incident, with everyday evidence.
Week of 21 December 2020
How the No Surprises Act turned a medical bill into four data handoffs
Written to protect patients from shock medical bills, the No Surprises Act made a patient’s financial experience depend on four handoffs of information between schedulers, billing systems, health plans and an arbitration portal, and on whoever owned each one.
Week of 7 December 2020
Patient access is won or lost at the records counter
HHS’s December 2020 plan to speed up patients’ access to their own records stalled. It still pinpointed where access breaks down: the response clock, the identity check and the delivery path. All three are operational, and none needed a final rule to fix.
Week of 16 November 2020
Permission to donate cybersecurity arrived without the money to run it
In November 2020, regulators finally let hospitals give cybersecurity to the small physician practices around them, free of charge. A legal barrier fell overnight. Whether anyone was actually safer depended on budgets, staffing and who would run the tools year after year.
Week of 26 October 2020
Price transparency files: mandated, massive and hard to read
A 2020 rule forced health plans to publish the prices they negotiate, but not to make them usable. Whether the files were worth anything came down to three problems the rule left to plans, employers and intermediaries: sheer volume, unclear meaning and accountability.
Week of 21 September 2020
What a nationwide EHR outage at UHS asked of nurses and unit leaders
Universal Health Services lost systems across its network in September 2020. The downtime binder mattered less than a human question: could staff trained on electronic records run a unit on paper for days, and then put it all back?
Week of 7 September 2020
When a hospital diverts, the whole region absorbs the attack
A ransomware attack in Düsseldorf is remembered for a disputed death. Its lasting message for health systems is regional: when one hospital closes its doors to ambulances, the risk moves onto crews and neighboring hospitals that rarely plan for it, or measure it.
Week of 31 August 2020
Blackbaud’s breach exposed patient data that fundraising never needed
The Blackbaud ransomware attack reached hospitals through their fundraising foundations. It revealed donor databases holding more patient information, for longer, than fundraising needed, and showed why keeping less data is the one safeguard that still works after the others fail.
Week of 27 July 2020
Lifespan’s stolen laptop and the home office risk analyses missed
A laptop stolen from an employee’s car cost Lifespan $1,040,000. The July 2020 settlement turned on missing encryption, a weak device inventory and absent agreements, landing just as health care’s office staff moved home, beyond the reach of risk analyses written for hospital buildings.
Week of 6 July 2020
Why hospital COVID reporting turned out to be infrastructure
In July 2020, HHS told hospitals to stop sending COVID-19 capacity data to the CDC and use a new HHS route instead. The switch revealed reporting as real infrastructure, and hospitals still counting by hand paid for every change.
Week of 1 June 2020
UCSF’s ransom decision was shaped long before the attack
Ransomware hit servers at UCSF’s School of Medicine in June 2020, and the university chose to pay. The decision looked like a crisis call but was largely settled in advance, by backups, where data lived, insurance terms and which advisers were already on retainer.
Week of 4 May 2020
Password spraying against research labs: an old attack on a new target
In May 2020, US and UK cyber agencies warned that state-backed hackers were guessing common passwords across health and research organizations to reach COVID-19 work. The defenses were familiar; applying them across academic medicine’s tangle of accounts, data and remote access was harder.
Week of 27 April 2020
For many Medicare patients, telehealth meant a phone call
Pandemic telehealth is remembered as video. For many older, rural and low-income Medicare patients it was a phone call, and a CMS rule on April 30, 2020, paid for those calls like office visits. Health systems then had to run the phone properly.
Week of 30 March 2020
Hospitals without walls still had to say where the care happened
On March 30, 2020, Medicare’s waivers let care move into tents, surgery centers, new hands and video screens. Every claim and medical record still had to say where, by whom and how, and the systems recording those facts assumed the old answers.
Week of 9 March 2020
Interoperability rules sent patient data beyond HIPAA’s reach
Two federal rules issued on March 9, 2020, banned information blocking and required standard data connections for patients. Together they let patients send their records into apps HIPAA does not cover, leaving health systems to govern data flows they could no longer refuse.
Week of 20 January 2020
Citrix gateways: the most exposed system in the hospital
The Citrix flaw exploited in January 2020 revealed that the gateway clinicians used to reach patient records from outside was a hospital’s most exposed system. Securing it took a clear owner, walls behind it and a search for intruders after every fix.