Content by Marianne Kolbasuk McGee

Epic Systems vs. Tata: Key Security Questions

Marianne Kolbasuk McGee  •  April 21, 2016

Epic Systems' successful lawsuit against India's Tata Consultancy Services raises many security questions. For example, why did Epic find out about the allegedly inappropriate downloading of trade secrets from an external whistleblower, rather than as a result of internal detection efforts?

NY Presbyterian Hospital Slapped With Second HIPAA Fine

Marianne Kolbasuk McGee  •  April 21, 2016

For the second time in two years, federal regulators have slapped New York Presbyterian Hospital with a multi-million dollar penalty as part of a HIPAA settlement. The latest incident involved filming of patients without their permission.

Lack of BA Agreement Costs Clinic $750,000

Marianne Kolbasuk McGee  •  April 20, 2016

A North Carolina orthopedic clinic will pay a $750,000 penalty as part of a breach-related federal settlement involving the release of 17,300 X-ray films containing patient information to a vendor without having a business associate agreement in place, as required under HIPAA.

Drug Fraud Scheme Includes Criminal HIPAA Violations

Marianne Kolbasuk McGee  •  April 19, 2016

A former pharmaceutical company manager faces sentencing in July after pleading guilty to criminal HIPAA violations for his part in a complex fraud scheme involving drug maker Warner Chilcott. Why are criminal HIPAA cases so rare?

Jury Awards EHR Vendor $940 Million in Trade Secrets Case

Marianne Kolbasuk McGee  •  April 18, 2016

A jury's decision to award $940 million in damages to electronic health records software vendor Epic Systems, which had sued India's Tata Consultancy Services alleging theft of trade secrets, serves up lessons about the importance of restricting access to all sensitive data, including intellectual property.

Analysis: Impact of Anthem Breach Case Ruling

Marianne Kolbasuk McGee  •  April 15, 2016

A federal court's recent rejection of a motion filed by health insurer Anthem Inc. in its attempt to fight a class-action lawsuit in the wake of its massive data breach is important because it upholds the privacy rights of breach victims, says attorney Steven Teppler.

Old IT Project Raises New Concerns for 1,400 Organizations

Marianne Kolbasuk McGee  •  April 14, 2016

A data security incident at the American College of Cardiology, which potentially affected nearly 98,000 patients at 1,400 medical institutions, points to the need to refrain from using real patient data in test environments as well as the importance of properly securing those environments.

Report: EHR-Enabled Fraud Still a Concern

Marianne Kolbasuk McGee  •  April 13, 2016

Federal regulators have still not developed a plan for curbing billing fraud enabled by the cut-and-paste function in electronic health records, as was recommended in a 2013 watchdog agency report.

Analysis: Security Blunders at Government Health Agencies

Marianne Kolbasuk McGee  •  April 12, 2016

Recent data breaches in Washington state and Florida illustrate that government health agencies can be just as vulnerable to security incidents involving sloppy breach prevention or detection practices as healthcare organizations in the private sector.

Living With Malware: How to Become 'Intrusion-Tolerant'

Marianne Kolbasuk McGee  •  April 11, 2016

As the threat of malware infections, especially those involving ransomware, grows, organizations need to balance their perimeter-based security practices with an "intrusion tolerance" strategy that helps ensure a quick recovery, says medical device cybersecurity expert Kevin Fu.

Unusual Ploy in Anthem Breach Case Fails

Marianne Kolbasuk McGee  •  April 8, 2016

Health insurer Anthem, the victim of a massive hacker attack, failed in its effort to persuade a court to allow it to inspect certain customers' computers to help it fight a class-action lawsuit tied to the breach. Why did Anthem make the move? And what issues does it raise?

Cyber Insurer Offers Ransomware Defense Insights

Marianne Kolbasuk McGee  •  April 7, 2016

What steps can organizations take to help ensure they're not the next victim of a ransomware attack? Technology expert Craig Musgrave of The Doctors Company, which offers cyber insurance, identifies the top priorities.

Continuing Hospital Ransomware Attacks: A Call to Action

Marianne Kolbasuk McGee  •  April 6, 2016

As Medstar Health completes its recovery from a recent malware attack that led to a temporary shutdown of most of its systems, other U.S. hospitals continue to struggle with similar attacks, many of them involving ransomware. What risk mitigation steps are most essential?

OCR Releases New HIPAA Audit Protocol

Marianne Kolbasuk McGee  •  April 5, 2016

Federal regulators have quietly released an updated, extremely detailed protocol for use in phase two of HIPAA compliance audits of covered entities and business associates later this year. Experts say the protocol also can be a helpful tool in self-assessing compliance as well as security strategies.

Thwarting Healthcare Cyberattacks: New Guidance

Marianne Kolbasuk McGee  •  April 4, 2016

Federal regulators have issued new guidance urging healthcare organizations and business associates to bolster their cyberattack defenses. The advice comes after a string of recent high-profile attacks on hospitals.