Content by Marianne Kolbasuk McGee

CISA: Why Healthcare Is No Longer Off-Limits for Attackers

Marianne Kolbasuk McGee  •  April 17, 2023

Healthcare entities of all types and sizes could be the next targets of major cybersecurity attacks, said Nitin Natarajan, deputy director of the Cybersecurity and Infrastructure Security Agency. Healthcare firms need to be vigilant against ransomware, DDoS and medical device breaches, he said.

How New Federal Cyber Resources Can Help Healthcare Entities

Marianne Kolbasuk McGee  •  April 17, 2023

New resources released Monday from a high-profile federal advisory group provide insights into the state of healthcare sector preparedness and best practices for dealing with evolving cyberthreats, according to Erik Decker, CISO of Intermountain Healthcare and co-chair of the task force.

How FDA's New Policy Aims to Improve Medical Device Security

Marianne Kolbasuk McGee  •  April 14, 2023

A new Food and Drug Administration policy to "refuse to accept" premarket submissions for new medical devices if they lack of cybersecurity details will help substantially improve the state of legacy devices in the future, said the FDA's Dr. Suzanne Schwartz. Here's a look at the new requirements.

HIMSS23: Tackling Some of Healthcare's Top Cyber Challenges

Marianne Kolbasuk McGee  •  April 14, 2023

Most healthcare organizations allocate 6% or less of their information technology budget for cybersecurity, putting them at a disadvantage in their security defenses and for competitive hiring, according to a recent survey by the Healthcare Information Management Systems Society.

Online Alcohol Counselor: Web Tracker Breach Affects 109,000

Marianne Kolbasuk McGee  •  April 13, 2023

An online alcohol abuse counseling service is notifying about 109,000 clients of a data breach involving the company's prior use of tracking tools on its websites dating back to 2017. The breach affects members of Monument Inc. and Tempest, a counseling service acquired in May 2022.

HHS Wants HIPAA Changes to Protect Reproductive Health Info

Marianne Kolbasuk McGee  •  April 12, 2023

Federal regulators have issued proposed changes to the HIPAA privacy rule aimed at protecting reproductive healthcare information from disclosures or uses involving law enforcement and related purposes in the wake of the Supreme Court last year overturning Roe v. Wade.

Proposed Health IT Certification Rules Target AI, Privacy

Marianne Kolbasuk McGee  •  April 11, 2023

Federal regulators have issued new rules aimed at securing certified healthcare software, helping patients decide which records to keep private, and protecting data used by AI and predictive tools. The 556-page proposed rule seeks to promote innovation and data sharing while tightening security.

Making the Most of Threat Intelligence in Healthcare

Marianne Kolbasuk McGee  •  April 10, 2023

The onslaught of distributed denial-of-service, ransomware, data exfiltration and other attacks on the healthcare sector highlight the importance of optimizing the many sources of threat intelligence available today, says Taylor Lehmann, director of the office of the CISO at Google Cloud.

Why Health Entities Must Scrutinize Use of Web Tracking Tech

Marianne Kolbasuk McGee  •  April 7, 2023

Regulators are scrutinizing the use of website tracking codes and analytics such as Meta Pixel and Google Analytics. Health entities must carefully assess how those tools are being used on their health-related websites, say privacy attorneys Cory Brennan of Taft and Mark Swearingen of Hall Render.

US Trauma Centers Hit by KillNet's Recent DDoS Barrage

Marianne Kolbasuk McGee  •  April 6, 2023

Most of the healthcare organizations hit by distributed denial-of-service attacks by pro-Russia hacktivists in January have one or more level 1 trauma centers, indicating that the attackers aimed to disrupt care for the most critically ill and injured patients, according to a new government report.

Army Doc Seeks Separate Trial From Spouse in Records Case

Marianne Kolbasuk McGee  •  April 5, 2023

A former U.S. Army physician set to go to trial next month in a case alleging a scheme to provide military medical records to the Russian government contends they will not get a fair trial unless they are tried separately from their alleged co-conspirator spouse.

West Virginia Hospital to Report Breach in 'Donut' Data Leak

Marianne Kolbasuk McGee  •  April 4, 2023

A West Virginia hospital will soon begin notifying patients and employees affected by ransomware attackers who leaked data on the dark web. Hackers encrypted a handful of servers hosting historic "institutional data," including budget documents, cost reports and payments to vendors.

Florida Hospital Begins Breach Notification Post-Attack

Marianne Kolbasuk McGee  •  April 4, 2023

A Florida-based community healthcare system has begun notifying about 20,000 individuals whose information was compromised in a data security incident that prompted the organization to operate under its IT downtime procedures, including diverting some emergency patients, for two weeks in February.

How Post-Quantum Encryption Mandates Affect Healthcare

Marianne Kolbasuk McGee  •  April 3, 2023

A 3-month-old federal law meant to future-proof federal computers from quantum computer decryption will have an effect on healthcare sector entities, too, says Mac McMillan, founder and CEO emeritus of privacy and security consulting firm CynergisTek.

3 More Healthcare Entities Report Website Tracking Breaches

Marianne Kolbasuk McGee  •  March 31, 2023

Three healthcare organizations joined the list of entities treating past use of tracking technologies in patient websites as a data breach reportable to federal authorities. The entities admitting such incidents are New York-Presbyterian Hospital, UC San Diego Health and Brooks Rehabilitation.