Content by Marianne Kolbasuk McGee

GoodRx Agrees to Pay $25M to Settle Web Tracker Lawsuit

Marianne Kolbasuk McGee  •  December 3, 2024

GoodRx has reached a $25 million preliminary settlement of proposed class action litigation alleging the telehealth company violated privacy and an assortment other laws and statues when it previously collected and shared consumers' information with third-parties through online tracking tools.

Feds Propose AI 'Guardrails' for Medicare Advantage Plans

Marianne Kolbasuk McGee  •  December 2, 2024

The Centers for Medicare and Medicaid Services has issued proposed "guardrails" to help ensure that the use of artificial intelligence for Medicare Advantage insurance plans does not result in inequitable access to healthcare-related services. The proposed rule will go into effect in 2026.

Cyber Incidents Hit Three NHS Hospitals in UK

Marianne Kolbasuk McGee  •  December 2, 2024

At least three National Health Service hospitals in U.K. are responding to recent cyber incidents, including a children's hospital and a heart and chest specialty hospital - both located in Liverpool - that share IT systems. INC Ransom claims to have stolen data from the two hospitals.

Overcoming Identity and Access Challenges in Healthcare

Marianne Kolbasuk McGee  •  November 29, 2024

Third-party access management poses significant cybersecurity risks in healthcare, but continuous identity management and monitoring can help mitigate those risks, said Jim Routh, chief trust officer at Saviynt.

Exposed on the Web: Thousands of Devices, Medical Records

Marianne Kolbasuk McGee  •  November 28, 2024

Thousands of unique IP addresses are potentially exposing medical devices, electronic medical records systems and other sensitive healthcare information to the internet, said security researcher Himaja Motheram of security firm Censys, which made the discovery.

Catholic Health Group Fined for Releasing Reproductive Info

Marianne Kolbasuk McGee  •  November 27, 2024

Federal regulators have fined a Catholic healthcare system $35,581 for HIPAA violations requiring a corrective action plan after the Pennsylvania provider impermissibly disclosed a female patient's reproductive health and other sensitive information to a prospective employer.

Watchdog Report: HHS OCR Should Beef-Up HIPAA Audit Program

Marianne Kolbasuk McGee  •  November 26, 2024

The U.S. Department of Health and Human Services' Office for Civil Rights should restart and toughen the scope of its HIPAA audits. A watchdog agency says HHS needs to better assess whether regulated healthcare organizations are taking required actions to reduce their cybersecurity risk.

Medical Specialty Groups: Why Cybercriminals are After Them

Marianne Kolbasuk McGee  •  November 25, 2024

An Illinois gastroenterology practice and a California pulmonary practice are among the latest medical specialty groups targeted by cybercriminals who claim to have their patients' sensitive health information. Attacks on such specialty healthcare practices appear to be rising, some experts said.

Feds Warn of New BianLian Ransomware Group Attack Profile

Marianne Kolbasuk McGee  •  November 22, 2024

Russian-based cybercrime gang BianLian has continued to thrive since shifting from using double extortion strategies to primarily data theft last year. BianLian is the third most active ransomware gang with a penchant for healthcare, and authorities are warning that the group has adopted new TTPs.

GAO: HHS Needs to Be a Better Leader in Health Sector Cyber

Marianne Kolbasuk McGee  •  November 21, 2024

The U.S. Department of Health and Human Services needs to take important actions to do a better job of carrying out its duties as the lead federal agency responsible for strengthening cybersecurity in the healthcare and public health sector, said a new federal watchdog agency report.

Feds Fine Mental Health Clinic $100K in 2020 HIPAA Case

Marianne Kolbasuk McGee  •  November 20, 2024

Federal regulators have fined a Los Angeles county mental health clinic $100,000 for failure to provide a patient with timely access to her requested health records during the COVID-19 pandemic. The case is the U.S. government's 51st HIPAA patient right-of-access enforcement action.

Oklahoma Hospital Says Ransomware Hack Hits 133,000 People

Marianne Kolbasuk McGee  •  November 19, 2024

An Oklahoma hospital quickly restored its IT systems after a ransomware attack in September, but the 62-bed hospital could not recover some data and later learned that hackers may have accessed the personal information of 133,000 people. The attack is the latest involving a small rural hospital.

Gang Shaking Down Pharmacy Group for Second Ransom Payment

Marianne Kolbasuk McGee  •  November 18, 2024

Ransomware group Embargo is threatening to publish nearly 1.5 terabytes of data allegedly stolen in an attack on American Associated Pharmacies, a collaborative of 2,000 independent pharmacies. The gang is shaking down AAP for the second installment of an alleged agreed-up ransom deal.

One Brooklyn Agrees to $1.5M Settlement in 2022 Hack Lawsuit

Marianne Kolbasuk McGee  •  November 15, 2024

A New York state court has approved a preliminary $1.5 million settlement of a consolidated proposed class action lawsuit against One Brooklyn Health System following a November 2022 cyberattack that involved theft of sensitive health data belonging to more than 235,000 people.

Trump Picks Robert F. Kennedy Jr. to Head HHS

Marianne Kolbasuk McGee  •  November 14, 2024

President elect Donald Trump said Thursday he will nominate prominent vaccine skeptic Robert F. Kennedy Jr. as secretary to head up the U.S. Department of Health and Human Services. His stances on health information privacy, security and healthcare sector cyber matters are not well known.