Privacy & Security

Less than a week after a cyberattack caused the Ohio-based health system to shut down some of its care offerings, cancer patients again have access to radiotherapy treatments.

Ever since financial institutions have significantly increased their security preparedness, bad actors have turned to healthcare organizations, seeing them as more vulnerable – and lucrative – targets, says Dr. Eric Liederman, CEO of CyberSolutionsMD.

Managing the cybersecurity risk of growing numbers of connected medical devices with minimal disruption to patient care is a balancing act. As vulnerabilities also increase, the need for network level end-to-end risk management is greater than ever.

While data and digital positions have been retained, abolished roles still pose data security risks, says a local trade union. 

The agency is seeking comments on a newly pruned framework, which it updated to align with its second-generation version – and hopefully make life easier for users who need both.

Involving each department across an organization can help healthcare leaders build stronger cyberdefense strategies, says Michael Gross, Cleveland Clinic's manager of cybersecurity intelligence.  

Ferdinand Hamada, managing director of the healthcare, pharma and life sciences sector at MorganFranklin Cyber, shows how the current HIPAA rule lays the groundwork for a new forward-looking approach as the stakes are ever higher.

After the Change Healthcare breach, healthcare organizations are diversifying their buying strategies and asking about vendors' cybersecurity policies, says Karly Rowe, interim president of Inovalon's provider business unit.  

Healthcare security incidents in 2024 highlighted third-party vendor risk and the need to prepare business continuity plans and tabletop exercises in case of attack, says Lee Kim, senior principal of cybersecurity and privacy at HIMSS.

Garrett Weber, Akamai Technologies field CTO for enterprise security, explains how the new HIPAA security rule requires healthcare organizations to use specific technical controls, but it can also help to better position third-party risk management.