Content by Marianne Kolbasuk McGee

Why Is Healthcare Sector So Vulnerable to Cyberattacks?

Marianne Kolbasuk McGee  •  October 27, 2016

What critical factors make the healthcare sector vulnerable to cyberattacks? In this audio interview, CISO Dave Summitt of the H. Lee Moffitt Cancer Center and Research Institute offers insights.

Hacktivist Pleads 'Not Guilty' in Children's Hospital DDoS Attack

Marianne Kolbasuk McGee  •  October 25, 2016

The hacktivist who allegedly launched distributed denial-of-service attacks in 2014 on Children's Hospital of Boston and another local healthcare facility in protest of a controversial child custody case has been arraigned on federal charges. Indictment documents provide details on the impact of the attacks.

Sorting Out HIPAA vs. FTC Act Requirements

Marianne Kolbasuk McGee  •  October 24, 2016

Federal regulators are reminding for-profit companies that if they collect and share consumers' health information, they not only need to comply with HIPAA security and privacy regulations, but also the Federal Trade Commission Act. Is their new guidance too narrow?

HIPAA Audit Update: Here's What's Next

Marianne Kolbasuk McGee  •  October 24, 2016

Federal regulators will be kicking off remote HIPAA compliance "desk audits" of business associates next month and more comprehensive onsite audits of both covered entities and BAs early next year. Learn more about what's next for the audit program.

Video on Alleged Medical Device Flaws Stirs Controversy

Marianne Kolbasuk McGee  •  October 20, 2016

Investment firm Muddy Waters Capital and security research start-up MedSec Holdings are again stirring up controversy, this time by releasing a video spotlighting more alleged cybersecurity flaws in St. Jude Medical cardiac devices.

$2 Million HIPAA Penalty After Patient Data Exposed on Web

Marianne Kolbasuk McGee  •  October 19, 2016

In the twelfth HIPAA enforcement action so far this year, federal regulators have smacked St. Joseph Health System with a $2 million penalty after investigating a breach that exposed patient information to internet searches for more than a year. And more enforcement actions tied to other breaches are on the way.

How MACRA Final Rule Promotes Secure Info Exchange

Marianne Kolbasuk McGee  •  October 17, 2016

Under a hefty new Medicare payment reform final rule, healthcare providers must attest that they will not inappropriately block secure patient information exchange. But how will the provisions work?

OIG Flags Security Flaws in Two States' Health Info Systems

Marianne Kolbasuk McGee  •  October 14, 2016

A federal watchdog agency's reviews of Minnesota's state-operated Obamacare health insurance exchange and Colorado's Medicaid eligibility and claims processing systems reveal a variety of security weaknesses that are also common among healthcare providers.

Engaging Smaller Healthcare Entities in Threat Info Sharing

Marianne Kolbasuk McGee  •  October 13, 2016

The National Health Information Sharing and Analysis Center aims to better engage smaller healthcare organizations in cyber threat information sharing, leveraging funds from two recent federal grants. Denise Anderson, president of NH-ISAC, describes the plans in this in-depth interview.

Federal Regulators Warn of FTP, NAS Risks

Marianne Kolbasuk McGee  •  October 12, 2016

As cyberattacks on healthcare entities continue to surge, federal regulators are urging organizations to safeguard network-attached storage devices and other gear that supports or enables file transfer protocol services.

More Congressional Scrutiny of FTC's LabMD Case

Marianne Kolbasuk McGee  •  October 11, 2016

Two Republican senators are demanding answers from the Federal Trade Commission about the "due process afforded" LabMD in the agency's data security enforcement case against the cancer testing laboratory. Meanwhile, LabMD has asked a federal court to delay the FTC's enforcement order while the lab appeals.

When Do Cloud Services Providers Have to Comply with HIPAA?

Marianne Kolbasuk McGee  •  October 10, 2016

New long-awaited federal guidance clarifies that cloud services providers that handle protected health information are nearly always considered business associates under HIPAA and, as a result, must meet the regulation's security requirements.

Growing Hacker Breach Tally: What's to Blame?

Marianne Kolbasuk McGee  •  October 7, 2016

Hacker attacks continue to account for the vast majority of health data breach victims this year, according to the latest federal tally. Some security experts expect that trend will persist as long as many organizations focus narrowly on HIPAA compliance rather than larger cybersecurity issues.

Business Associate Agreements: Not Just for Vendors

Marianne Kolbasuk McGee  •  October 6, 2016

Because the legal relationships between healthcare organizations can be very complex, it's not always crystal clear when business associate agreements should be in place to help safeguard patient data, says privacy attorney Adam Greene. He explains the legal issues in this in-depth interview.

Analysis: GAO Report on FDA Security Weaknesses

Marianne Kolbasuk McGee  •  October 5, 2016

Information security weaknesses that a watchdog agency found at the FDA are similar to those found at many healthcare organizations, some security experts say. But the FDA should be held to an even higher standard than the organizations that implement FDA-regulated drugs and devices, they argue.