Content by Marianne Kolbasuk McGee

Mississippi Health System Ransomware Attack Affects 253,000

Marianne Kolbasuk McGee  •  January 15, 2024

A Mississippi health system is notifying nearly 253,000 individuals that their data was potentially compromised in a "malicious and sophisticated ransomware" attack last August that also took IT systems offline. The cybercriminal gang Rhysida had claimed responsibility for the assault.

Fertility Test Lab Will Pay $1.25M to Settle Breach Lawsuit

Marianne Kolbasuk McGee  •  January 12, 2024

A fertility testing laboratory has agreed to improve its data security practices and pay up to $1.25 million to settle a consolidated class action lawsuit filed in the wake of a 2021 ransomware attack that compromised sensitive health information of about 350,000 patients.

How the Merck Case Shapes the Future of Cyber Insurance

Marianne Kolbasuk McGee  •  January 11, 2024

Merck & Co.'s proposed settlement with insurers over a $1.4 billion claim related to the NotPetya attack will change the language the insurance industry uses to exclude acts of war in its policies, and organizations need to consider how those changes affect risk, said attorney Peter Halprin.

Cybercriminals Bully Cancer Patients With Swatting Threat

Marianne Kolbasuk McGee  •  January 10, 2024

Cybercriminals are extorting some patients and threatening them with swatting in the wake of a recent cyberattack on a Seattle cancer center. The incident, stemming from a Citrix Bleed exploit, has triggered multiple lawsuits and affected the personal data of at least 1 million people.

Fallout Mounting From Recent Major Health Data Hacks

Marianne Kolbasuk McGee  •  January 9, 2024

Fallout is mounting, and new developments are emerging in several high-profile health data hacks. Data breaches reported in recent weeks and months at a medical transcription vendor, a hospital chain and a law firm are affecting a growing list of clients and individuals - and triggering lawsuits.

NYS: Clinic Must Pay $450K Fine, Spend $1.2M on Security

Marianne Kolbasuk McGee  •  January 8, 2024

A federally funded health center that provides services to underserved communities in New York has been fined up to $450,000 and must invest $1.2 million in improving its data security, under a settlement with state regulators involving a 2021 ransomware attack that affected about 261,000 people.

Insurers Drop Bid to Exclude Merck's $1.4B NotPetya Claims

Marianne Kolbasuk McGee  •  January 5, 2024

A proposed settlement has been reached between Merck & Co. and several insurers that were appealing a 2023 court decision saying the insurance companies could not invoke "hostile warlike action" exclusions in refusing to pay drugmakers' claims filed after the 2017 NotPetya cyberattack.

Practice Fined $160K for 6 'Right of Access' Complaints

Marianne Kolbasuk McGee  •  January 4, 2024

It's a new year, but federal regulators are beating an old HIPAA drum: The Department of Health and Human Services has hit a New Jersey medical practice with a $160,000 settlement in the agency's 46th enforcement action involving HIPAA complaint about right of access to health records.

Hospitals Sue LockBit, Ask Cloud Firm to Return Stolen Data

Marianne Kolbasuk McGee  •  January 4, 2024

An upstate New York hospital group has filed a lawsuit against cybercriminal group LockBit in a legal maneuver aimed at forcing a Boston-based cloud services firm to turn over patient data LockBit had stolen from the entities last summer and allegedly stored on the tech company's servers.

Population Health Management Firm's Breach Affects Millions

Marianne Kolbasuk McGee  •  January 3, 2024

A hacking incident at a New Jersey-based vendor of artificial intelligence-enabled population health management services that involved a network server has affected more than a dozen of its healthcare clients across the country and nearly 4.5 million of their patients.

Hack on Defunct Ambulance Firm Affects 912,000 People

Marianne Kolbasuk McGee  •  January 3, 2024

A defunct ambulance company is notifying nearly 912,000 patients and employees that their archived records were compromised in an early 2023 data theft hack. The firm previously provided emergency care in the Boston region and administrative services to affiliated transportation companies.

State AG Hits Hospital With $300K Fine for Web Tracker Use

Marianne Kolbasuk McGee  •  January 2, 2024

State regulators fined a New York hospital $300,000 to settle privacy violations related to the organization's prior use of tracking tools in its websites and patient portal. Regulators said the hospital violated HIPAA rules in sharing patient information with third parties for marketing purposes.

Top Considerations for Complying With My Health My Data Act

Marianne Kolbasuk McGee  •  January 1, 2024

It's time for companies dealing with non-HIPAA-regulated health information to plan their compliance with Washington state's My Health My Data Act, which goes into effect in the new year and affects organizations that are based in other states, said attorney James Hennessy of law firm Reed Smith.

How One University Is Beefing Up Cyber Defenses, Programs

Marianne Kolbasuk McGee  •  December 29, 2023

Educational institutions are prime targets for ransomware and other cyberattacks due to their open nature and troves of sensitive data, requiring continuous investment in cyber defenses and strong security practices, said Steve Zuromski, CIO at Bridgewater State University in Massachusetts.

Legacy Medical Devices: Critical Cyber Risk Considerations

Marianne Kolbasuk McGee  •  December 28, 2023

Legacy medical gear continues to pose big cyber challenges to healthcare entities. A joint report by the Food and Drug Administration and MITRE Corp. emphasizes the importance of entities taking a consistent risk-based approach to managing these and other devices, said Jessica Wilkerson of the FDA.