HHS OCR Plans to Resurrect Random HIPAA Audits

As U.S. federal regulators fine-tune a strategy to push the healthcare sector into strengthening its cybersecurity posture, they are revisiting a HIPAA compliance audit program that’s been dormant since 2017. A new round of HIPAA audits for regulated entities is in the works. The Department of Health and Human Services recently published a notice saying that its Office for Civil Rights would be pulling the trigger soon on a study to assess...

Read More

HHS Details New Cyber Performance Goals for Health Sector

‘Essential’ and ‘Enhanced’ Best Practices Will Influence Upcoming Rule-Making The Department of Health and Human Services has released guidance that spells out voluntary cybersecurity performance goals for the healthcare sector. The new 13-page Cybersecurity Performance Goals document, recently released by HHS’ Administration for Strategic Preparedness and Response, details both essential goals “to outline...

Read More

2023 Saw a Number of High-Profile Breaches

We hope that you had a successful 2023. Looking back, 2023 saw a number of high-profile breaches as criminals and nation-state-supported hackers both created new methods of attacking and took advantage of existing vulnerabilities. Looking to 2024, here are a few things that we think are worth keeping an eye on moving forward. Phishing NOW WITH AI Phishing continues to be a persistent and lucrative attack vector for criminals and state-...

Read More

Feds Levy First-Ever HIPAA Fine for Ransomware Data Breach

Massachusetts Management Firm to Pay $100,000, Monitor HIPAA Compliance for 3 Years A Massachusetts-based medical management firm holds the dubious honor of being the first ransomware victim fined for a data breach by the Department of Health and Human Services. Doctor Management Group agreed to a $100,000 financial settlement and three years of HIPAA compliance monitoring and corrective actions following an investigation into a 2019 ransomware...

Read More

Phishing Accounts for More than Half of Cybercrime

Cybercrime is an ever-evolving field. Technology evolves to allow new tactics or new scales for criminals, as well as giving firms new tools to combat fraud and theft. Due to the fact that it’s ever-evolving, sometimes it can be difficult to see vast changes that occur over time. Over the last 5 years, there have been significant changes to the landscape of cybercrime. Not just in the increases in scale but also significant changes in the types...

Read More

MOVEit Health Data Breach Tally Keeps Growing

More Hacks Compromising Protected Health Info Being Reported to Regulators Healthcare organizations are adding millions to the tally of individuals affected by the Memorial Day weekend hack of the MOVEit file transfer application by Russian-speaking hackers. In recent days, the U.S. Department of Health and Human Services’ Office for Civil Rights has posted several more reports submitted by entities involving MOVEit breaches. An estimated...

Read More

GPT Goes Evil: How Criminals Are Leveraging LLM’s

How GPT’s Evil Twin Could Be Used in BEC Attacks A black hat AI tool called Worm GPT is being used to improve the efficacy of phishing emails. This is particularly troubling because a recent survey shows that 1 in 5 people fall for the fake, AI-generated emails, according to cybersecurity researchers. Researchers at SlashNext recently assessed WormGPT, an evil twin of OpenAI’s GPT AI model designed specifically for malicious...

Read More

Iowa Reports 3rd Large Vendor Breach This Year

Latest Breach Affects 234,000 Individuals; Involves Recent MCNA Insurance Co. Hack The state government of Iowa reported to federal regulators a third major health data breach since April involving a third-party vendor. The breach stems from an incident at dental health insurer MCNA Insurance Co. The Iowa Department of Health and Human Services reported hackers had compromised the protected health information of nearly 234,000 Iowa residents in...

Read More

Lawsuit Alleges Iowa Health Center Sent PHI to Facebook

Latest in a String of Similar Proposed Class Actions Across Healthcare Industry The University of Iowa Health Care is facing a proposed class action lawsuit alleging it used website tracking pixels to transmit patient data to Facebook. The claim is the latest in a string of legal actions against other healthcare centers that pasted Facebook Pixel and similar online behavior tracking codes into their patient portals. Concerns, and lawsuits, over...

Read More

Most Common Connected Devices That Pose Risk to Hospitals

Study: Unpatched Nurse Call Systems, Printers and IP Cameras Top the List   Globally, hospitals are expected to deploy over 7 million medical devices by 2026 — or more than 3,850 devices per hospital, according to a study conducted last year by research firm Juniper Research. Many IoT device makers and users have lagged in updating these products to patch vulnerabilities, said Scott Singer, managing director of the University of...

Read More