Cybersecurity

The digital security of healthcare institutions and data is a growing concern, with an increasing number of cyberattacks each year against healthcare systems, which are seen as easy targets. Cyber attacks often use ransomware to target personal health information, patient data and medical devices to cut off access to the data until a ransom is payed to the hacker. Cybercriminals have become more sophisticated, using malware, ransomware and spyware to attack outdated and vulnerable systems and software. Due to the interconnected nature of hospital IT systems today, the weakest link can be older web-enabled medical devices, including clinical and non-clinical systems. Employees are also a major target of attacks via malicious e-mails that prompt them to open attachments that then download malware onto the hospital's IT system.

Bon Secours employees cause of breach

Bon Secours Mary Immaculate Hospital in Suffolk, Va., is notifying about 5,000 patients after discovering a significant amount of inappropriate access to patients’ EHRs from two employees inside the facility.

HITRUST discloses breach of 111 records

The Health Information Trust Alliance (HITRUST) informed the public that a compromised web server caused the leak of 111 records, which included some real names, companies, addresses, phone numbers and email addresses, in addition to six encrypted passwords. The files did not contain personal health or other sensitive information, according to the May 28 notice.

Thumbnail

Weekly roundup: Breaches, HIE in the news

Breaches are back in the news this week with two more reported breaches impacting almost 3,000 patients in Miami and Sonoma, and Idaho State University (ISU) settling on a hefty $400,000 fine for its HIPAA violations.

Sonoma hospital breach impacts 1,350

Sonoma Valley Hospital has notified 1,350 patients that their information was inadvertently posted on its website, according to the organization.

ONC releases Direct guidelines for secure HIE

The Office of the National Coordinator for Health IT has released guidelines to provide recommended policies and practices for health information service providers (HISPs), trust communities and accrediting bodies such as DirectTrust to enable providers to securely exchange patient information across geographic, organizational and vendor boundaries.

Breach: Miami org loses 1,400 paper records

The paper medical records of 1,407 patients have been lost by Jackson Health System in Miami.

Idaho university to pay $400K for HIPAA violations

Idaho State University will pay $400,000 to the Department of Health and Human Services to settle alleged violations of the HIPAA Security Rule. The settlement comes after ISU’s Pocatello Family Medicine Clinic disabled server firewall protections for a period of at least 10 months, resulting in the breach of electronic protected health information for 17,500 patients.

Data entry error causes La. breach

A data entry error in March caused a data breach affecting 8,330 patients of Louisiana State University Health System in Shreveport.

Around the web

The tirzepatide shortage that first began in 2022 has been resolved. Drug companies distributing compounded versions of the popular drug now have two to three more months to distribute their remaining supply.

The 24 members of the House Task Force on AI—12 reps from each party—have posted a 253-page report detailing their bipartisan vision for encouraging innovation while minimizing risks. 

Merck sent Hansoh Pharma, a Chinese biopharmaceutical company, an upfront payment of $112 million to license a new investigational GLP-1 receptor agonist. There could be many more payments to come if certain milestones are met.