Health care organizations must provide patients with unfettered access to their digital health records under new federal rules taking effect October 6, 2022. Under the 21st Century Cures Act, new federal rules are designed to shift the balance of power so that patients can not only get their data, but also choose who else can access it. Using this system, health care consumers can use the fluidity they’ve enjoyed in banking for decades in a patient-mediated data economy: they can move their information easily and electronically, and they can connect their accounts with new software and services.
Healthcare IT experts find 3 ways to fight ransomware
By ensuring vulnerability management, focusing on remediation, and learning from other victims, organizations can minimize their chances of becoming repeat victims of healthcare ransomware attacks, Health IT Security reports. A ransomware attack on healthcare can disrupt EHRs, cause data encryption, divert ambulances, and cause other disruptions. After an attack, healthcare organizations must work quickly to restore critical operations and ensure patient safety. Despite a comprehensive incident response plan, organizations may overlook critical considerations during the rapid response and recovery process, making them vulnerable to future attacks. A 2022 study by Cybereason found that organizations that pay the ransom are more likely to be victimized again in the future. Surveyed cybersecurity professionals from diverse sectors (including healthcare) were hit again for a higher ransom less than a month after paying the ransom. Even though risk cannot be eliminated, organizations can reduce the likelihood that they will fall victim to repeat healthcare ransomware attacks. This is done by ensuring that they have a thorough vulnerability management process, learning from other healthcare organizations, and remediating properly the first time around. According to a Sophos report from August 2022, more organizations in a variety of industries have been attacked multiple times within a few hours, days, weeks, or months. According to Sophos, most of these incidents were caused by exploitable vulnerabilities and misconfigurations left by earlier attackers. “If you get hit, make sure you fully remediate,” Erick Galinkin, principal researcher at Rapid7, said in an interview with Health IT Security. “Getting back to working order is all well and good, but if you are already having downtime because of a successful attack, adding a couple of minutes or hours to that downtime to make sure it doesn’t happen again is a worthwhile investment.”