Content by Marianne Kolbasuk McGee

Medical Specialty Practice Says Recent Hack Affects 224,500

Marianne Kolbasuk McGee  •  May 26, 2023

An upstate New York medical specialty practice has reported to regulators that the information of nearly 224,500 employees and patients was compromised in a hacking incident discovered in March. Ransomware group RansomHouse claims to have downloaded 2 terabytes of the entity's data.

AHA Tells HHS to 'Amend or Suspend' Web Tracking Guidance

Marianne Kolbasuk McGee  •  May 25, 2023

The American Hospital Association is urging federal regulators to back off from recent guidance that treats patient IP addresses as protected health information, saying that the new rules would "reduce public access to credible health information" and create hardships for doctors and hospitals.

Help Available for Tackling Legacy Medical Device Security

Marianne Kolbasuk McGee  •  May 25, 2023

Healthcare providers are struggling with protecting legacy medical devices against a rising tide of cyberthreats. New Health Sector Coordinating Council guidance can help, said Jessica Wilkerson of the Food and Drug Administration and Mike Powers of Intermountain Health.

CommonSpirit Ups Cost Estimate on Its 2022 Ransomware Breach

Marianne Kolbasuk McGee  •  May 24, 2023

Hospital chain CommonSpirit has upped its estimate on the financial toll incurred by a ransomware incident last fall that disrupted IT systems and patient services at some of its facilities for weeks. But company officials reportedly expect many of the costs to be covered by the company's insurance.

NY AG Fines Practice Management Firm $550K in 2020 Breach

Marianne Kolbasuk McGee  •  May 23, 2023

A practice management software firm has agreed to pay a $550,000 fine and implement a comprehensive data security program to settle an enforcement action by New York state regulators after a 2020 ransomware attack that affected 1.2 million individuals nationwide, including 428,000 New Yorkers.

Home Health Gear Firm Says Breach Affects Nearly 1.9 Million

Marianne Kolbasuk McGee  •  May 23, 2023

Home healthcare equipment firm Apria Healthcare is notifying nearly 1.9 million individuals of a hacking incident discovered in September 2021 that affected information dating back to mid-2019. The company says the breach was related to an attempt to fraudulently obtain funds from Apria.

Federal Lawsuits in Fortra Health Data Breach Piling Up

Marianne Kolbasuk McGee  •  May 22, 2023

Proposed class action lawsuits are piling up over hackers' use of a vulnerability in Fortra's GoAnywhere secure file transfer and a resulting data breach affecting 3 million individuals. NationsBenefits Holdings disclosed that hackers accessed personal information by using the widely exploited flaw.

The FTC Pushes Boundaries With Proposed Health Rule Change

Marianne Kolbasuk McGee , David Perera  •  May 19, 2023

The Federal Trade Commission's proposed changes to its 14-year-old Health Breach Notification Rule come at a time when some advocates say stronger consumer data privacy protections are needed. But will the FTC potentially face legal challenges to its authority to make these sweeping changes?

FTC Makes Moves to Enhance Data Privacy Oversight

Marianne Kolbasuk McGee  •  May 18, 2023

The Federal Trade Commission on Thursday made a few bold moves to ramp up its oversight of data privacy. They include issuing a notice of proposed amendments to its Health Breach Notification Rule and releasing a policy statement warning of heightened scrutiny over the use of biometric information.

FTC Fines Fertility App Vendor, Bars It From Data Sharing

Marianne Kolbasuk McGee  •  May 17, 2023

The Federal Trade Commission has barred the developer of fertility tracking app Premom from sharing users' personal health data with third parties for advertising purposes and has fined the vendor $100,000 for alleged violations of the agency's Health Data Breach Notification Rule.

4 State AGs Punch EyeMed With $2.5 M Fine for 2020 Breach

Marianne Kolbasuk McGee  •  May 17, 2023

The attorneys general of four states have smacked vision care provider EyeMed Vision Care with a $2.5 million fine as part of a settlement in the aftermath of a 2020 email phishing incident that affected 2.1 million individuals in the United States.

Feds Hit Vendor With $350K Settlement in FTP Server Breach

Marianne Kolbasuk McGee  •  May 16, 2023

Federal regulators fined a practice management software and services vendor $350,000 in the aftermath of an investigation into a 2018 HIPAA breach that involved a file transfer protocol server mishap. The company said the incident was the result of "a singular human error."

NextGen Facing a Dozen Lawsuits So Far Following Breach

Marianne Kolbasuk McGee  •  May 16, 2023

Cloud-based electronic health records vendor NextGen Healthcare is so far facing a dozen proposed class action lawsuits filed in the last week in the same Georgia federal court following the company's disclosure this month of a data breach affecting 1 million individuals.

Bipartisan Bill Aims to Shut Rural Hospital Cyber Skill Gaps

Marianne Kolbasuk McGee  •  May 15, 2023

New bipartisan legislation introduced in the U.S. Senate - the Rural Hospital Cybersecurity Enhancement Act - aims to help address the shortage of cybersecurity skills facing rural hospitals, which increasingly find themselves in the crosshairs of hackers, including ransomware attackers.

What's Inside Washington State's New My Health My Data Act

Marianne Kolbasuk McGee  •  May 15, 2023

Organizations of all types have important work ahead to comply with Washington state's new My Health My Data Act, which pertains to any entity - inside or outside the state - that handles health data of consumers in the state, said Cat Kozlowski, attorney at law firm Polsinelli.