Cybersecurity & Privacy Archives - Page 8 of 14 - HIT Leaders and News

Skip to main content

Cybersecurity

HCA Settlement Reveals Patient Data Exposure Without Clinical Detail Is Still a Breach

A recently finalized class action settlement involving HCA Healthcare underscores a growing legal and operational truth: the consequences of healthcare data breaches are no longer mitigated by the absence of clinical or financial information. As federal courts finalize a multimillion-dollar resolution to the 2023 incident, which exposed non-medical patient data from an external email formatting tool, executives across the provider landscape must confront a new liability paradigm: structure, not content, is now the breach trigger.

Illustration 59549239 © Emotionart | Dreamstime.com

Why Preferred Vendor Status Is No Longer Enough in Hospital Cyber Defense

Hospitals and health systems now exist in a cyber threat environment where traditional defenses, endpoint protection, firewalls, network segmentation, can no longer function as a standalone perimeter. The recent designation of Celerium as a Preferred Cybersecurity Provider by the American Hospital Association underscores an evolving model: one in which credibility is conferred not only by technology, but by institutional alignment and endorsement.

Photo 217658546 © One Photo | Dreamstime.com

The Cybersecurity Reporting System That Healthcare Still Doesn’t Use

The federal government has built a voluntary cybersecurity reporting system for critical infrastructure sectors, including healthcare. It is robust, centralized, and designed to improve threat visibility across providers, payers, and vendors. But in practice, few organizations use it, and no one is required to.

ID 187020383 © Josepalbert13 | Dreamstime.com

Breach Notification Rules Were Designed for Disclosure Not Protection

The Health Insurance Portability and Accountability Act (HIPAA) requires covered entities and business associates to notify affected individuals when protected health information (PHI) is breached. This rule, established to promote transparency and accountability, now serves as the healthcare sector’s primary line of defense against public fallout after cyber incidents. But that purpose is increasingly out of step with modern threats.

Hackers Steal Medical and Financial Data of 1.2M Patients

SimonMed Imaging’s disclosure that 1.2 million patients’ records were stolen in a ransomware attack is another chapter in a long, predictable narrative. The breach, reportedly executed by the Medusa ransomware group, included not just personally identifiable information but raw medical imaging files, payment records, and identity documents, data that cannot be replaced, reset, or revoked.

HIPAA Enforcement Is Rising But Who’s Really Paying the Price

In 2024, the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services took more enforcement actions than in any previous year. It also levied its lowest average financial penalties in more than a decade. This divergence reveals a strategic pivot: OCR is broadening its enforcement net, but its ability to impose meaningful consequences remains constrained.

Why the Most Dangerous Data Breaches Are Still the Least Regulated

While the Change Healthcare ransomware attack drew national attention in 2024, its implications extend far beyond a single event. It spotlighted a structural vulnerability in the healthcare sector that continues to grow unchecked: the underregulation of business associates.

The Ransomware Reckoning in Healthcare Is Just Beginning

The 2024 Change Healthcare breach may prove to be a defining event in the history of digital health infrastructure. With over 190 million individuals affected and core operations across thousands of health systems disrupted, the incident was unprecedented in both scale and systemic impact. But it was not an outlier. Ransomware in healthcare is the dominant breach vector.

HIPAA Violations at Verily Signal Deeper Risk for Health Tech Compliance

A recent lawsuit against Verily has reignited concerns about whether health technology firms can consistently meet the operational demands of privacy law. The case, filed by former Verily executive Ryan Sloan, alleges that the company concealed multiple violations of the Health Insurance Portability and Accountability Act (HIPAA), impacting more than 25,000 patients. If substantiated, these claims expose not only lapses in internal governance but also structural weaknesses in how emerging digital health platforms manage regulatory accountability.

Tracking Pixel Lawsuits Signal Operational Blind Spots in Healthcare Privacy

Mount Sinai Health System’s recent $5.3 million settlement over the use of web trackers on its patient portal is the latest in a wave of litigation reframing digital analytics as a high-risk privacy exposure, especially for healthcare organizations operating under HIPAA.

MDLand Data Event Reinforces Urgency of EMR Vendor Accountability in Health IT Ecosystems

The recent disclosure of a data security incident by MDLand International Corporation, a New York-based electronic medical records (EMR) vendor, adds another entry to a growing list of third-party breaches exposing sensitive patient information. While MDLand states that there is no evidence of data misuse and that the event did not involve health systems directly, the incident reflects a broader, structural vulnerability: health data security is only as strong as the least-secure vendor in the healthcare technology chain.

HIPAA Risk Analysis Failures Keep OCR’s Crosshairs on Business Associates

The recent enforcement action against BST & Co. CPAs, LLP underscores a sharpened federal focus on business associates that fall short of HIPAA Security Rule compliance, especially when ransomware is involved. The $175,000 settlement with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) marks the agency’s 15th ransomware-related HIPAA action and the 10th to fall under its ongoing Risk Analysis Initiative.

Asset Intelligence Converges with Clinical Security

Hospitals have spent the past decade connecting everything from infusion pumps to MRI scanners to corporate networks. That connectivity delivered valuable data streams and operational efficiencies, yet it also created a vast, largely invisible attack surface.

Microsoft Breach Exposes Structural Incoherence in Federal Cybersecurity Governance

The recent compromise of Microsoft SharePoint environments, impacting the Department of Homeland Security (DHS), the Department of Health and Human Services (HHS), and the National Institutes of Health (NIH), underscores a persistent dissonance between federal cybersecurity mandates and operational enforcement.

Forget Reading Regulatory Tea Leaves and Take Control of Data Security

It’s a challenging time for healthcare IT executives. Companies need to maintain HIPAA compliance as proposed government rule changes are still being solidified. Interoperability is required, so that authorized providers with patient consent can access sensitive data quickly and gain insights to make the best possible decisions about patient care.