Content by Marianne Kolbasuk McGee

Hospital Notifies 316,000 of Breach in Christmas 2023 Hack

Marianne Kolbasuk McGee  •  December 10, 2024

A Massachusetts hospital is notifying 316,000 people that their information was compromised in a cyberattack discovered nearly a year ago on Christmas 2023. Cybercriminal group Money Message had claimed that it stole 600 gigabytes data, posting patient and employee records on the dark web.

FDA Urges Blood Suppliers to Beef Up Cyber

Marianne Kolbasuk McGee  •  December 9, 2024

The Food and Drug Administration is urging blood suppliers - a recent target of attacks - to bolster their cybersecurity practices to prevent and mitigate cyber incidents that could affect the supply and safety of critical blood and blood components used for transfusions and other patient care.

Insider Breach, Email Attacks Net $1.7M in HIPAA Fines

Marianne Kolbasuk McGee  •  December 6, 2024

An insider breach at a Florida pain management firm and an email breach at a Colorado pediatric hospital have resulted in more than $1.7 million in fines for HIPAA violations found by federal investigators. The two incidents affected fewer than 50,000 people.

Protecting the C-Suite in the Wake of UHC CEO's Murder

Marianne Kolbasuk McGee  •  December 6, 2024

The torrents of public hostility directed at health insurers in the aftermath of UnitedHealthCare CEO Brian Thompson's murder are serious signs of intensifying cyber and physical threats facing the C-suites of healthcare and many other sectors, said Chris Pierson, founder and CEO of BlackCloak.

CEO's Murder Sparks Outcry Over UHC's Coverage Denials

Marianne Kolbasuk McGee  •  December 5, 2024

Law enforcement investigating murder of Brian Thompson, CEO of UnitedHealthcare, are examining potential motives. But shell casings reportedly found at the crime scene spotlight one of the top motives speculated - anger over the company's alleged denial of coverage practices. Where does AI fit in?

How Hackers Can Manipulate AI to Affect Health App Accuracy

Marianne Kolbasuk McGee  •  December 4, 2024

Hackers can potentially use AI to manipulate data that's generated and shared by some health apps, diminishing the data's accuracy and integrity, said Sina Yazdanmehr and Lucian Ciobotaru of cybersecurity firm Aplite, describing a recent research project involving Google Health Connect.

GoodRx Agrees to Pay $25M to Settle Web Tracker Lawsuit

Marianne Kolbasuk McGee  •  December 3, 2024

GoodRx has reached a $25 million preliminary settlement of proposed class action litigation alleging the telehealth company violated privacy and an assortment of other laws and statutes when it previously collected and shared consumers' information with third parties through online tracking tools.

Feds Propose AI 'Guardrails' for Medicare Advantage Plans

Marianne Kolbasuk McGee  •  December 2, 2024

The Centers for Medicare and Medicaid Services has issued proposed "guardrails" to help ensure that the use of artificial intelligence for Medicare Advantage insurance plans does not result in inequitable access to healthcare-related services. The proposed rule will go into effect in 2026.

Cyber Incidents Hit Three NHS Hospitals in UK

Marianne Kolbasuk McGee  •  December 2, 2024

At least three National Health Service hospitals in U.K. are responding to recent cyber incidents, including a children's hospital and a heart and chest specialty hospital - both located in Liverpool - that share IT systems. INC Ransom claims to have stolen data from the two hospitals.

Overcoming Identity and Access Challenges in Healthcare

Marianne Kolbasuk McGee  •  November 29, 2024

Third-party access management poses significant cybersecurity risks in healthcare, but continuous identity management and monitoring can help mitigate those risks, said Jim Routh, chief trust officer at Saviynt.

Exposed on the Web: Thousands of Devices, Medical Records

Marianne Kolbasuk McGee  •  November 28, 2024

Thousands of unique IP addresses are potentially exposing medical devices, electronic medical records systems and other sensitive healthcare information to the internet, said security researcher Himaja Motheram of security firm Censys, which made the discovery.

Catholic Health Group Fined for Releasing Reproductive Info

Marianne Kolbasuk McGee  •  November 27, 2024

Federal regulators have fined a Catholic healthcare system $35,581 for HIPAA violations requiring a corrective action plan after the Pennsylvania provider impermissibly disclosed a female patient's reproductive health and other sensitive information to a prospective employer.

Watchdog Report: HHS OCR Should Beef-Up HIPAA Audit Program

Marianne Kolbasuk McGee  •  November 26, 2024

The U.S. Department of Health and Human Services' Office for Civil Rights should restart and toughen the scope of its HIPAA audits. A watchdog agency says HHS needs to better assess whether regulated healthcare organizations are taking required actions to reduce their cybersecurity risk.

Medical Specialty Groups: Why Cybercriminals are After Them

Marianne Kolbasuk McGee  •  November 25, 2024

An Illinois gastroenterology practice and a California pulmonary practice are among the latest medical specialty groups targeted by cybercriminals who claim to have their patients' sensitive health information. Attacks on such specialty healthcare practices appear to be rising, some experts said.

Feds Warn of New BianLian Ransomware Group Attack Profile

Marianne Kolbasuk McGee  •  November 22, 2024

Russian-based cybercrime gang BianLian has continued to thrive since shifting from using double extortion strategies to primarily data theft last year. BianLian is the third most active ransomware gang with a penchant for healthcare, and authorities are warning that the group has adopted new TTPs.