Did you know? 

Maintaining HIPAA compliance extends to cyber-security.

On February 21, the largest purveyor of revenue and payment cycle management for patients, providers, and payers suffered a cyber-security breach [1] causing billing and pharmacy services grind to a stop [2]; the supply of medications for clinical trials was interrupted[3]; and the healthcare data of the over 53 million global UnitedHealthcare members was compromised[4]. Change Healthcare worked with cybersecurity industry leaders including Palo Alto Networks to assess the damage[5] and eventually negotiated a Bitcoin payout of about $22 million to ransomware groups AlphV/BlackCat[1].

Even though the ransom has been paid, the reputational damages to Change Healthcare [6] may be an insurmountable blow as U.S. Department of Health and Human Services (HHS) and Centers for Medicare & Medicaid Services (CMS) has issued statements and major hospital systems refuse to re-activate communicating servers due to HIPAA concerns and the lack of cyber-security defensive strategy at Change Healthcare. This begs the question: How did this happen? The US Department of Health and Human Services Office for Civil Rights (OCR) has released a “Dear Colleagues” letter opening an investigation into the attack [7]. While we wait for the official word on a cause, rumors abound. Reporting from multiple outlets suggest that the hackers waltzed through an unlocked window. SC Media and others report that a known Connectwise ScreenConnect vulnerability was exploited due to critical security updates being ignored for over 48 hours [8]. At least $22 million and at most an entire healthcare company could have been saved by timely completion of security updates. That will make you certainly think twice next time before selecting “Ignore Update.” 

3 Tips to Keep Yourself Safe:

1. Update your software. 

2. Do not click unknown links, attachments, or downloads. 

3. Use multi-factor authentication when possible.