Content by Marianne Kolbasuk McGee

Offshoring PHI: Addressing the Security Issues

Marianne Kolbasuk McGee  •  December 10, 2017

U.S. healthcare entities need to keep security top of mind if they use offshore services to handle protected health information, security experts say, pointing to specific steps to take.

GAO: CMS Must Improve Medicare, Medicaid Anti-Fraud Efforts

Marianne Kolbasuk McGee  •  December 6, 2017

The Department of Health and Human Services has taken important steps to fight Medicare and Medicaid fraud, but can further strengthen its efforts in several ways, according to a new GAO report. GAO estimates that in fiscal 2016, improper Medicare and Medicaid payments totaled about $95 billion.

Insider Allegedly Steals Mental Health Data of 28,000 Patients

Marianne Kolbasuk McGee  •  December 5, 2017

The alleged theft of mental health information on more than 28,000 patients in Texas, which went undetected for well over a year, is yet another reminder of the substantial risks that terminated employees can pose as well as the need to take extra steps to protect the most sensitive patient information.

Reporting Breaches to Law Enforcement: Why Timing Matters

Marianne Kolbasuk McGee  •  December 4, 2017

The timing of reporting breaches to law enforcement is important because it could slow down an organization's incident response and internal investigation, says privacy attorney Kirk Nahra.

Mitigating Threats Posed By Terminated Employees

Marianne Kolbasuk McGee  •  December 1, 2017

Federal regulators are reminding healthcare entities and business associates of the serious security and privacy risks that terminated employees can pose and offering advice for mitigating those risks.

Creating a Playbook for Incident Response

Marianne Kolbasuk McGee  •  December 1, 2017

The lack of skilled personnel is hampering incident response, but automation can help, says Mike Fowler of DFLabs. Providing responders with "playbooks" for step-by-step incident response processes, for example, is essential, he contends.

Dealing with Evolving Cyber Threats

Marianne Kolbasuk McGee  •  December 1, 2017

Cyberattacks are evolving in many ways, including new schemes to steal credentials as well as assaults by lower-skilled hackers using ransomware-as-a-service products, says Eric Rydberg of Sophos.

DMARC in Healthcare: Lots of Work to Be Done

Marianne Kolbasuk McGee  •  November 30, 2017

Adoption of the Domain-based Message Authentication, Reporting & Conformance - or DMARC - standard is very low in the healthcare sector, and broader use could greatly reduce phishing risks, according to a new study.

Avoiding Privileged Access Pitfalls

Marianne Kolbasuk McGee  •  November 30, 2017

Organizations must consider using privileged access controls throughout their entire "stack" of applications, as well as during the app development stages, says Andy Givens of CyberArk.

Why Security Priorities Need to Shift to Safety Issues

Marianne Kolbasuk McGee  •  November 29, 2017

The healthcare sector's cybersecurity efforts needs to shift from a focus on protecting patient information confidentiality to protecting patient safety, says Joshua Corman, co-founder I Am The Cavalry, a grassroots, not-for-profit cyber safety organization.

Lawsuit: Hospitals Lied About Providing Quick Records Access

Marianne Kolbasuk McGee  •  November 28, 2017

Two Indiana attorneys, frustrated by delays in obtaining patient records on behalf of clients, are seeking more than $1 billion in damages in a lawsuit alleging 60 hospitals in the state fraudulently received HITECH Act electronic health record incentive payments.

Health Data Breaches Lead to $2 Million California Penalty

Marianne Kolbasuk McGee  •  November 27, 2017

The California attorney general's office has smacked Cottage Health System with a $2 million settlement in the wake of breaches in 2013 and 2015. What lessons can be learned from this significant enforcement action?

Health Data Breaches: The Legal Issues

Marianne Kolbasuk McGee  •  November 22, 2017

Several significant pending legal cases, including the CareFirst lawsuit, showcase the cybersecurity challenges facing the healthcare sector, says attorney Lisa Rivera in an in-depth interview.

House Committee Urges HHS Action on Medical Device Risks

Marianne Kolbasuk McGee  •  November 21, 2017

A House committee is urging HHS to act soon on a recommendation made by its cybersecurity task force: Develop a description of the cyber risks of components of medical devices. But a task force member says Congress should be pressing HHS to take action on all of the panel's recommendations, not just one.

$1 Billion Lawsuit Focuses on EHR Data Integrity Concerns

Marianne Kolbasuk McGee  •  November 20, 2017

Some legal experts say a nearly $1 billion class action lawsuit filed against electronic health records vendor eClinicalWorks could be the first of many cases scrutinizing the data integrity issues of EHR vendors. Others, however, contend that those filing such lawsuits will face many hurdles.