Cybersecurity

The digital security of healthcare institutions and data is a growing concern, with an increasing number of cyberattacks each year against healthcare systems, which are seen as easy targets. Cyber attacks often use ransomware to target personal health information, patient data and medical devices to cut off access to the data until a ransom is payed to the hacker. Cybercriminals have become more sophisticated, using malware, ransomware and spyware to attack outdated and vulnerable systems and software. Due to the interconnected nature of hospital IT systems today, the weakest link can be older web-enabled medical devices, including clinical and non-clinical systems. Employees are also a major target of attacks via malicious e-mails that prompt them to open attachments that then download malware onto the hospital's IT system.

Nurse fired for prying into patient records

A Canadian hospital has fired a nurse over allegations that she inappropriately accessed more than 1,300 patient records over the past nine years.

Few details revealed on Vermont home health breach

A stolen laptop is the source of a breach for patients of Caledonia Home Health Care & Hospice in St. Johnsbury, Vt., but the organization isn't revealing the number of patients affected or the extent of the types of protected health information at risk.

Stolen laptop impacts Calif. eye patients

Retinal Consultants Medical Group has announced the theft of an unencrypted laptop computer but has not revealed the scope of the breach, including how many patients are affected.

HITPC: Update on query, MU Stage 3 security requirements

Despite previous requests for more thoughtful discussion, the Privacy & Tiger Team re-affirmed its previous conclusions about nontargeted queries to the Health IT Policy Committee during its Aug. 7 meeting.

32K patients' data breached due to downed firewall

A breach of protected health information of approximately 32,000 patients in 48 states was the result of a health IT vendor's firewall being down for more than a month, allowing, in some cases, for patient data to be indexed by Google.   

Software glitch causes Missouri Medicaid breach

Missouri's state Medicaid program, MO HealthNet, is notifying 1,357 individuals that some of their personal information was mailed to an incorrect address by one of its IT infrastructure management contractors. The disclosure was caused by a software programming error.

Governance key to making security progress

“Traditionally, the security guy is the bad guy. Historically, security has to kick open doors. Governance is the key to open those closed doors,” said Kim Sassaman, director of information security and HIPAA security officer, Presbyterian Health System in Albuquerque, speaking during a webcast on security governance hosted by the Institute for Health Technology Transformation.

Privacy and security strategies

“If individuals lack trust that information will be protected as health IT moves forward and as mobile devices continue to be used, it’s going to affect their willingness to disclose and share information and could have life-threatening consequences,” John Benevelli, acting senior advisor, HIPAA Compliance and Enforcement, Office for Civil Rights. Benevelli spoke on a panel discussing privacy and security at the Centers for Medicare & Medicaid Services’ 2013 eHealth Summit.

Around the web

The tirzepatide shortage that first began in 2022 has been resolved. Drug companies distributing compounded versions of the popular drug now have two to three more months to distribute their remaining supply.

The 24 members of the House Task Force on AI—12 reps from each party—have posted a 253-page report detailing their bipartisan vision for encouraging innovation while minimizing risks. 

Merck sent Hansoh Pharma, a Chinese biopharmaceutical company, an upfront payment of $112 million to license a new investigational GLP-1 receptor agonist. There could be many more payments to come if certain milestones are met.