Content by Marianne Kolbasuk McGee

The FDA's New Digital Health Cyber Unit: What Would It Do?

Marianne Kolbasuk McGee  •  September 27, 2018

The Food and Drug Administration plans to launch a new digital health "center of excellence" that includes a cybersecurity unit. The new unit would not only deal with cyber issues pertaining to new health technologies, but also challenges facing older medical devices.

White House National Cyber Strategy: An Analysis

Marianne Kolbasuk McGee  •  September 26, 2018

A national cybersecurity strategy document released by the White House last week - along with comments from a top Trump administration official that the U.S. would step up its offensive cyber measures - are getting mixed reviews from cybersecurity experts.

Health Data Breach Tally Shows Mistakes That Lead to Trouble

Marianne Kolbasuk McGee  •  September 25, 2018

Recent additions to the federal health data breach tally shine a light on the mistakes that contribute to breaches - and in some cases, make situations far worse.

Massachusetts HIPAA Case Outlines Series of Missteps

Marianne Kolbasuk McGee  •  September 24, 2018

A HIPAA-related enforcement case in Massachusetts involving two insider breaches alleges a trail of missteps, including failure to take prompt action after receiving tips about potential misuse of patient information. What can other entities learn from the mistakes?

Opioid Crisis Raises Tough Privacy Issues

Marianne Kolbasuk McGee  •  September 21, 2018

As CISOs, CIOs and privacy officers look for ways to boost the timely, secure sharing of healthcare information to improve treatment, one obstacle that potentially stands in the way is CFR-42 Part 2, a 1970s-era regulation. Dozens of healthcare organizations are pushing Congress to change that regulation.

Hospitals Fined $1 Million After TV Crews Film Patients

Marianne Kolbasuk McGee  •  September 20, 2018

HIPAA privacy violations can come in many forms. Case in point: Federal regulators have smacked three Boston hospitals with settlements totaling nearly $1 million for allowing crews for the documentary TV show "Save My Life: Boston Trauma" to film on their premises without obtaining authorization from patients.

GDPR Compliance: Common Misconceptions

Marianne Kolbasuk McGee  •  September 19, 2018

Attorney Elizabeth Harding clears up confusion about certain provisions of the EU's General Data Protection Regulation, including the issue of when organizations need to obtain a European consumer's consent to process their data.

Hospital Insider PHI Theft Case: Lessons to Learn

Marianne Kolbasuk McGee  •  September 18, 2018

A case involving alleged insider theft of protected health information from a hospital in New York illustrates why healthcare organizations need to take extra precautions to prevent similar incidents. Security experts offer recommendations.

Health Information Exchange: The Missing Links

Marianne Kolbasuk McGee  •  September 17, 2018

Making bigger advances in implementing nationwide health information exchange will require a multipronged effort, including getting patients more involved and using a variety of technical approaches, says Scott Stuewe, the new president and CEO of DirectTrust.

Are State AGs Picking Up Slack in HIPAA Enforcement?

Marianne Kolbasuk McGee  •  September 14, 2018

Is a recent HIPAA settlement issued by the New York state attorney general's office another sign that states might begin to overshadow federal regulators when it comes to enforcement actions involving health data security and privacy?

Can a Watch Be a Medical Device?

Marianne Kolbasuk McGee  •  September 13, 2018

The new Apple Watch 4, which includes a sensor that can conduct an electrocardiogram, spotlights the emergence of consumer apps that appear to cross over into the territory of medical devices, raising potential cybersecurity concerns.

FDA to Ramp Up Medical Device Cybersecurity Scrutiny

Marianne Kolbasuk McGee  •  September 12, 2018

The Food and Drug Administration should increase its scrutiny of the cybersecurity of networked medical devices before they're approved to be marketed, a new government watchdog agency report says. FDA says it will carry out the report's recommendations.

Simplifying Vendor Security Risk Management

Marianne Kolbasuk McGee  •  September 11, 2018

Why did CISOs at a half-dozen leading healthcare organizations launch a new council aimed at standardizing vendor security risk management? One of those CISOs, John Houston of UPMC, explains why the group was launched, how it will work and why managing cloud vendor risks is a top priority.

Protecting PHI on Devices: Essential Steps

Marianne Kolbasuk McGee  •  September 10, 2018

While healthcare entities and their vendors apparently are improving their encryption practices for computing and storage devices, regulators are also urging organizations to avoid overlooking the importance of physically securing and tracking these devices to help safeguard PHI.

Alert: 'Ryuk' Ransomware Attacks the Latest Threat

Marianne Kolbasuk McGee  •  September 7, 2018

Organizations should be on guard for attacks involving an apparent variant of Hermes ransomware - dubbed Ryuk - that attempts to encrypt network resources. It has already victimized several global organizations in the U.S. and elsewhere, according to a federal alert, which offers mitigation advice.