Tag: Cybersecurity

Summary of article from HIT Consultant, by Fred Pennic:

A resent report highlights significant vulnerabilities in healthcare organizations’ data security practices, particularly concerning insecure file sharing. Key findings reveal that 25% of publicly shared files and 68% of externally shared private files contain Personally Identifiable Information (PII), while 77% of internally shared private files also include PII. Additionally, many organizations fail to update or remove access permissions, increasing security risks. The consequences of these practices include rising data breaches, substantial financial impacts from ransomware attacks, and potential compliance violations with HIPAA and GDPR regulations. The report also notes the risk to financial data, such as credit card information, stored in insecure files. To mitigate these risks, healthcare organizations must adopt robust data loss prevention (DLP) solutions and data security tools to ensure proper handling and sharing of sensitive information. Metomic emphasizes the need for these tools to prevent data leaks and protect both patient information and organizational integrity.

Summary of article from Bradley Arant Boult Cummings LLP, by Sinan Pismisoglu, Eric Setterlund:

The proposed cyber incident reporting rule by the Cybersecurity and Infrastructure Security Agency (CISA) aims to enhance national cyber defenses but has raised concerns about its broad scope and potential overreporting, which could overwhelm CISA with low-value data. Industry groups, particularly in manufacturing and healthcare, worry about the rule’s impact, citing increased compliance burdens and potential disruptions. Recommendations to address these issues include narrowing the rule’s scope, harmonizing reporting mechanisms, providing support to smaller entities, and tailoring requirements to specific industry needs. The debate highlights the need for a balanced approach that strengthens cybersecurity while ensuring practical compliance for businesses. Collaboration between CISA and industry stakeholders is essential to refine the rule and achieve this balance.

Summary of article from Healthcare Dive, by Emily Olsen:

Healthcare and hospital groups are urging the Cybersecurity and Infrastructure Security Agency (CISA) to explicitly include insurers and third-party vendors in its proposed cybersecurity reporting rule, citing the interconnected nature of the healthcare sector and the potential widespread impact of cyber incidents. The rule, which mandates reporting of cyber incidents within 72 hours and ransom payments within 24 hours, currently does not specify sector-specific criteria for these entities. Industry groups argue that the exclusion could leave significant vulnerabilities unaddressed, as demonstrated by the recent cyberattack on Change Healthcare. They also express concerns over the stringent reporting timelines and the additional burdens they could impose, particularly on under-resourced hospitals. These groups are calling for more flexibility, financial support, and technical assistance to ensure effective incident management without compromising patient care.

Summary of article from The HIPAA Journal, by Steve Adler:

SecurityScorecard awarded the U.S. healthcare industry a B+ cybersecurity rating for the first half of 2024, despite significant breaches, including a major ransomware attack on Change Healthcare. The study assessed the top 500 publicly traded healthcare companies, revealing a mean security score of 88. Medical device manufacturers and suppliers had the lowest security scores within the sector, largely due to their extensive attack surfaces. Key areas for improvement include application security, DNS health, and network security, with common issues such as weak SSL/TLS protocols and outdated web browsers. Recommendations for enhancing security emphasize third-party risk management and improved application and endpoint security practices.

Summary of article from Medical Economics, by Grace Koennecke:

In 2023, the US experienced a significant rise in data breaches, with 3,205 incidents reported, marking a 78% increase from 2022. The healthcare industry saw a 136% increase in data breaches, affecting 56 million individuals, while the financial services sector experienced a 177% rise, impacting 61 million people. The Identify Theft Resource Center recommends the healthcare sector adopt stronger breach notice laws and improve vendor due diligence to mitigate cyber threats.