Content by Marianne Kolbasuk McGee

Lawsuits: Negligence Led to UC San Diego Health Incident

Marianne Kolbasuk McGee  •  September 24, 2021

Two proposed class action lawsuits filed this week in a California federal court allege negligence and a variety of other claims against UC San Diego Health in the wake of a phishing incident that affected nearly 496,000 individuals.

Facilitating the Secure Exchange of Health Data

Marianne Kolbasuk McGee  •  September 22, 2021

The acquisition of the SAFE Identity consortium and its trust framework by DirectTrust, best known for creating and maintaining trust frameworks for secure email messaging in healthcare, will help facilitate new secure health information exchange use cases, says DirectTrust CEO Scott Stuewe.

Hacking Incidents Lead to 2 Big Eye Care Provider Breaches

Marianne Kolbasuk McGee  •  September 21, 2021

Two eye care entities are among the latest healthcare provider organizations recently reporting hacking breaches each affecting tens of thousands of individuals. One of the incidents involved a foiled wire transfer fraud attempt.

Post-Attack, Health Agency Notifying 'All Alaskans'

Marianne Kolbasuk McGee  •  September 20, 2021

Alaska's Department of Health and Social Services says it is notifying "all Alaskans" that their personal and protected health information may have been compromised in a nation-state-sponsored cyberattack that was detected in May, from which the department is still recovering.

HHS OCR's Latest HIPAA Enforcement Action

Marianne Kolbasuk McGee  •  September 17, 2021

While the wait continues for the Biden administration to name a new leader for the Department of Health and Human Services' Office for Civil Rights, the HIPAA enforcement agency recently issued its 20th settlement to date in a case involving a patient "right of access" dispute.

FTC: Health App, Device Makers Must Report Breaches

Marianne Kolbasuk McGee  •  September 16, 2021

The FTC warns makers of personal health records, mobile health apps, fitness devices and a variety of similar products and services that they will face stiff civil monetary penalties for failure to comply with the commission's 12-year-old - but never-yet enforced - Health Breach Notification Rule.

Lawsuit: Health System Failed to Heed Ransomware Warnings

Marianne Kolbasuk McGee  •  September 15, 2021

A proposed class action lawsuit filed this week against St. Joseph's/Candler Health System in the wake of a recent ransomware breach affecting 1.4 million individuals alleges that the Georgia-based healthcare entity was "reckless" and "negligent" in safeguarding patients' information.

Researchers: 61M Health IoT Device User Records Exposed

Marianne Kolbasuk McGee  •  September 14, 2021

An unsecured database belonging to an apparently recently defunct firm exposed 61 million records of wearable health and fitness device users on the internet, say the security researchers who discovered the non-password-protected database in cooperation with the WebsitePlanet research team.

Clinic: EHR Data Too Damaged to Recover Post-Attack

Marianne Kolbasuk McGee  •  September 14, 2021

An Arizona-based family medical practice says it is attempting to reconstruct thousands of patients' electronic health records following a May ransomware attack that badly corrupted the records as well as backup data.

HHS Warns Health Sector of BlackMatter Attacks

Marianne Kolbasuk McGee  •  September 13, 2021

Federal regulators are alerting healthcare and public health sector entities of the "elevated threat" for potential ransomware attacks by BlackMatter, despite the gang's purported claims that it is not targeting "critical infrastructure" organizations, such as hospitals.

HHS on Information Blocking Rule Enforcement: Stay Tuned

Marianne Kolbasuk McGee  •  September 10, 2021

While a final rule for enforcement of the 21st Century Cures Act information blocking regulations is slated to be issued this month, some regulators are still uncertain that timeline will stick, or when other related unresolved details will be disclosed.

Case Study: Team Approach for Medical Device Cybersecurity

Marianne Kolbasuk McGee  •  September 9, 2021

Effectively managing the cybersecurity of thousands of medical devices takes a highly collaborative approach and "delicate balance" between IT security leaders, biomedical staff and others, say Baptist Health Care's CISO, Thad Philips, and the senior manager of the biomedical program, Tony Williams.

Lawsuit: Fertility App Maker Sent Data to Google, Facebook

Marianne Kolbasuk McGee  •  September 8, 2021

A proposed class action lawsuit against Flo Health alleges the fertility-tracking mobile app maker unlawfully shared sensitive consumer health data with Google, Facebook and other software vendors. The lawsuit comes after a recent settlement with the FTC over similar data-sharing privacy concerns.

How Infusion Pump Security Flaws Can Mess with Drug Dosing

Marianne Kolbasuk McGee  •  September 7, 2021

Several security vulnerabilities in infusion pump products from B. Braun could collectively allow malicious actors to modify the dose of medicines delivered to patients, says Douglas McKee, a security researcher on a McAfee Enterprise team that recently discovered the flaws.

Lawsuit Alleges Security Failures at Clinic

Marianne Kolbasuk McGee  •  September 3, 2021

DuPage Medical Group in suburban Chicago has been smacked with a lawsuit following its recent "network outage" health data breach, which was reported to regulators as potentially affecting the protected health information of more than 655,000 individuals.. What are plaintiffs alleging?