Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In an increasingly interconnected world, the Internet of Things (IoT) has become a significant driver of innovation across various industries. Healthcare institutions were early adopters of IoT technology, leveraging it to improve patient care, streamline operations, and enhance data management. However, this surge in IoT adoption brings with it new challenges, one of which is the need for more transparency and security in the supply chain of connected medical devices.

Deer Oaks Behavioral Health is a national provider of mental health based in San Antonio, Texas. They offer the nation long-term care focused on psychiatry and psychology. Deer Oaks hosts more than 1,500 facilities nationwide. Their services include medication and medical treatment planning while spearheading new techniques for rural tele-behavioral health.

In 2007, a group of healthcare organizations, technology companies, and government agencies—including the American Hospital Association, Blue Cross Blue Shield Association, the Centers for Medicare & Medicaid Services (CMS), McKesson Corporation, and Microsoft—got together to create a unified approach to information security and privacy. The result was the Health Information Trust Alliance’s Common Security Framework (HITRUST CSF).

The healthcare industry is progressing towards a more mature cybersecurity posture. However, given it remains a popular attack target, more attention is needed. Results from The Cost of a Data Breach Report 2023 reported that healthcare has had the highest industry cost of breach for 13 consecutive years, to the tune of $10.93M. In 2022, the top 35 global security breaches exposed 1.2 billion records, and 34% of those attacks hit the public sector and healthcare organizations.

A HIPAA (Health Insurance Portability and Accountability Act) questionnaire is essential for evaluating third-party vendors for healthcare organizations to ensure they follow HIPAA regulations and standards. As one of the most breached industries, it is vastly important for healthcare organizations to send out comprehensive security questionnaires to properly assess their vendors’ risks and determine a plan of action on how to remediate those risks or potentially end the business partnership.

Akumin is a radiology and oncology clinic based in Florida with multiple locations. Last week, three of their South Florida locations shut down their computer systems to hobble a ransomware cyberattack. The downtime significantly impacted the three clinics, as the doctors could not complete patient assessments. Recent patients in the area should consider protective monitoring services to help mitigate potential outcomes from the attack.

In the digital era, Electronic Health Records (EHRs) are crucial in healthcare, making Electronic Protected Health Information (ePHI) an essential asset. However, ePHI is vulnerable to threats like cyber attacks and natural disasters, making disaster recovery planning (DRP) vital. Healthcare organizations must implement HIPAA-compliant DRPs to protect ePHI, ensuring continued operation during disasters.

Chicago’s health providers are prime targets for opportunistic hackers; Cook County Health is the most recently discovered victim of a cyber assault. Assailants took advantage of a third-party medical transcription service Perry Johnson & Associates, Inc. (PJ&A) provided. The attack targeted PJ&A’s systems, resulting in the exposure of numerous patient records. If hackers accessed your information during the breach, there’s still time to protect yourself.