Content by Marianne Kolbasuk McGee

Health Data Thefts Keep Coming; Millions Affected in 2024

Marianne Kolbasuk McGee  •  April 4, 2024

What do a California cancer research center; an Indiana ear, nose and throat practice; an Oklahoma ambulance company; and a New York billing firm all have in common? They're among the latest firms to report data exfiltration breaches, which have affected millions of U.S. patients so far this year.

Feds Hit 2 Nursing Home Firms With 'Right of Access' Fines

Marianne Kolbasuk McGee  •  April 3, 2024

Federal regulators are continuing their crusade for healthcare firms to provide patients and their representatives with timely access to medical records when requested. HHS OCR recently hit two nursing home operators with fines in separate incidents involving HIPAA "right of access" disputes.

Poor Cloud Controls at HHS Put Families, Children at Risk

Marianne Kolbasuk McGee  •  April 2, 2024

A Department of Health and Human Services division that administers funding, training and other services to children and families is putting sensitive data at high risk because of gaps in cloud security controls and practices, according to a watchdog agency report.

Judge Certifies 'Contract Class' in CareFirst Breach Lawsuit

Marianne Kolbasuk McGee  •  April 2, 2024

A federal judge has ruled to certify a "contract class" of more than 1 million CareFirst customers in a class action lawsuit claiming that the health insurer breached its contractual obligations to safeguard their data, which was accessed by hackers in a 2014 cyberattack.

How 'Security by Default' Boosts Health Sector Cybersecurity

Marianne Kolbasuk McGee  •  April 1, 2024

Healthcare entities can easily achieve many of the cyber performance goals set by regulators if they deploy technology solutions that provide robust security by default and create an organizational culture in which security-mindedness is ingrained, said Taylor Lehmann of Google Cloud.

How the NIST CSF 2.0 Can Help Healthcare Sector Firms

Marianne Kolbasuk McGee  •  April 1, 2024

The National Institute of Standards and Technology's updated Cybersecurity Framework 2.0 can help healthcare organizations better formalize their governance functions to enhance their cybersecurity posture and resilience, said Robert Booker, chief strategy officer at HITRUST.

Feds Warn of Credential Harvesting Threats in Healthcare

Marianne Kolbasuk McGee  •  March 29, 2024

Federal regulators are sounding an alarm to warn healthcare sector entities of cyberattacks involving a tried-and-true hacking method - credential harvesting, which can be used to compromise patient data, disrupt healthcare operations and enable other crimes.

UnitedHealth Admits Patient Data Was 'Taken' in Mega Attack

Marianne Kolbasuk McGee  •  March 28, 2024

UnitedHealth Group has admitted data was "taken" in the cyberattack on Change Healthcare and has just started analyzing the types of personal, financial and health information potentially compromised. The U.S. is offering a $10 million bounty for BlackCat, which claims to have launched the attack.

Change Healthcare Wake-Up Call: Is Sector Too Codependent?

Marianne Kolbasuk McGee  •  March 27, 2024

The Change Healthcare attack - the most disruptive cyber incident to ever hit the U.S. healthcare ecosystem - spotlights the risks that come from relying on a handful of major suppliers, said leaders of the Health Information Sharing and Analysis Center.

Feds Wave Sticks & Carrots at Health Sector to Bolster Cyber

Marianne Kolbasuk McGee  •  March 26, 2024

Proposed federal sticks and carrots to incentivize the health sector to implement stronger cybersecurity standards are already meeting opposition from some industry groups that say financial help is welcome but payment penalties for perceived laggards likely will do more harm than good.

Hospitals Lobby Feds to Clarify Breach Duties in UHG Attack

Marianne Kolbasuk McGee  •  March 25, 2024

As thousands of hospitals, clinics and doctor practices potentially have to notify millions of patients about the Change Healthcare breach, the American Hospital Association said the IT services firm and parent company, UnitedHealth Group, should be the sole sender of notifications.

Nursing Home Declares Bankruptcy, Blames Recent Cyberattacks

Marianne Kolbasuk McGee  •  March 22, 2024

A nursing home operator is seeking bankruptcy protection, citing the effects of a ransomware attack last fall and fallout from the recent Change Healthcare outage as factors that contributed to its financial woes. Also, a Senate bill aims to address cash flows for some health firms hit by an attack.

Revenue Cycle Firm Settles GitHub PHI Breach Lawsuit for $7M

Marianne Kolbasuk McGee  •  March 21, 2024

Revenue cycle management firm MedData has agreed to a $7 million settlement in a class action lawsuit filed after an employee inadvertently uploaded and exposed the health and personal information of about 136,000 individuals on the public-facing part of GitHub for more than a year.

Email Bomb Attacks: Filling Up Inboxes and Servers Near You

Marianne Kolbasuk McGee  •  March 20, 2024

Federal authorities are warning healthcare and public health sector entities of email bomb attacks, a type of denial-of-service attack that can overwhelm email systems and networks and distract victims from other nefarious activities. The incidents can also disrupt clinical and business workflow.

Tracker Backtrack? Feds Revise HIPAA Guidance on Web Tools

Marianne Kolbasuk McGee  •  March 19, 2024

Federal regulators have issued updated guidance about web trackers on patient portals or other health-related websites, saying that collecting and disclosing certain information - such as device IP addresses - does not necessarily pose HIPAA violations, under some circumstances.